netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-wmxc-v39r-p9wf
GHSA-x3jx-5w6m-q2fc
This commit is contained in:
advisory-database[bot]
2025-02-28 17:44:18 +00:00
parent 8b79f2bcdb
commit 095d088483
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/04/GHSA-wmxc-v39r-p9wf/GHSA-wmxc-v39r-p9wf.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wmxc-v39r-p9wf",
"modified": "2024-04-04T14:21:49Z",
"modified": "2025-02-28T17:42:50Z",
"published": "2024-04-04T00:33:11Z",
"aliases": [
"CVE-2024-2689"
],
"summary": "Temporal Server Denial of Service",
"details": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.\n",
"details": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.",
"severity": [
{
"type": "CVSS_V3",
advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json
+4 -3
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x3jx-5w6m-q2fc",
"modified": "2024-09-18T22:40:12Z",
"modified": "2025-02-28T17:43:16Z",
"published": "2024-09-18T17:43:36Z",
"aliases": [
"CVE-2022-25768"
],
"summary": "Mautic vulnerable to Improper Access Control in UI upgrade process",
"details": "### Impact\nThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\n\n### Patches\nUpgrade to 4.4.13 or 5.1.1 or later.\n\n### Workarounds\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)\n",
"details": "### Impact\nThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\n\n### Patches\nUpgrade to 4.4.13 or 5.1.1 or later.\n\n### Workarounds\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)",
"severity": [
{
"type": "CVSS_V3",
@@ -121,7 +121,8 @@
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-287"
"CWE-287",
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": true,