Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-05 05:16:58 +00:00
parent 4a2b904f44
commit 054b40277e
884 changed files with 1292 additions and 3876 deletions
@@ -3,14 +3,10 @@
  "id": "GHSA-8j6j-4h2c-c65p",
  "modified": "2020-08-31T18:44:11Z",
  "published": "2020-09-03T17:02:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Arbitrary Code Execution in require-node",
  "details": "Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.\n\n\n## Recommendation\n\n- If you are using 1.x, upgrade to version 1.3.4 or later.\n- If you are using 2.x, upgrade to version 2.0.4 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki",
  "details": "### Impact\n\nWhen copying files with rsync, octorpki uses the \"-a\" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.  \n\n## For more information\n\nIf you have any questions or comments about this advisory email us at security@cloudflare.com",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-8gr3-2gjw-jj7g",
  "modified": "2022-03-16T23:54:33Z",
  "published": "2022-03-16T23:54:33Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Hidden functionality in node-ipc",
  "details": "The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-w2j5-3rcx-vx7x",
  "modified": "2022-03-15T20:02:54Z",
  "published": "2022-03-15T20:02:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Sysctls applied to containers with host IPC or host network namespaces can affect the host",
  "details": "### Impact\nBefore setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o/tree/main/pinns/) to configure the sysctls of the host. This allows a malicious user to set sysctls on the host, assuming they have access to hostNetwork and hostIPC.\n\nAny CRI-O cluster after CRI-O 1.18 that drops the infra container\n1.22 and 1.23 clusters drop infra container by default, and are thus vulnerable by default.\n\n### Patches\nCRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, 1.19.5 all have the patches.\n\n### Workarounds\nUsers can set `manage_ns_lifecycle` to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.\nAn admission webhook could also be created to deny pods that use host IPC or network namespaces and also attempt to configure sysctls related to that namespace.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)\n* To make a report, email your vulnerability to the private\n[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list\nwith the security details and the details expected for [all CRI-O bug\nreports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -119,9 +115,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-15T20:02:54Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Plone Cross-site Scripting vulnerability in the LiveSearch module",
  "details": "Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Tomcat Sensitive Information Disclosure",
  "details": "Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "PEAR::Auth potential authentication bypass vulnerability",
  "details": "Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote attackers to \"falsify authentication credentials,\" related to the \"underlying storage containers.\"",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -90,9 +88,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T22:02:11Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Tomcat information disclosure vulnerability",
  "details": "The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Joomla! Open Redirect vulnerability",
  "details": "Multiple open redirect vulnerabilities in Joomla! 1.5 before 1.5.7 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a \"passed in\" URL.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "WEBrick Denial of Service Vulnerability",
  "details": "httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-18T21:17:22Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-7h65-4p22-39j6",
  "modified": "2024-10-25T19:42:31Z",
  "published": "2024-10-25T19:42:31Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses",
  "details": "A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the `net/netip` package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.\n\n**Critical Vulnerabilities**\nVulnerability: [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790), `golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses`\nDescription: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.\n\nAffected versions: 1.17.1,1.16.2,1.15.5\n\nSee screenshot for more details\n![Screenshot from 2024-09-18 17-36-37](https://github.com/user-attachments/assets/2e7ad31f-228a-4534-a4aa-b63d4911351d)\n\nFixed versions: 1.17.2,1.16.3,1.15.6\n\nRelease notes:\n\n* https://github.com/crossplane/crossplane/releases/tag/v1.17.2\n* https://github.com/crossplane/crossplane/releases/tag/v1.16.3\n* https://github.com/crossplane/crossplane/releases/tag/v1.15.6",
  "severity": [
@@ -93,9 +91,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-25T19:42:31Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More