From 095d0884832131df71f1b7ba30661dad4da110ef Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 28 Feb 2025 17:44:18 +0000 Subject: [PATCH] Publish Advisories GHSA-wmxc-v39r-p9wf GHSA-x3jx-5w6m-q2fc --- .../2024/04/GHSA-wmxc-v39r-p9wf/GHSA-wmxc-v39r-p9wf.json | 4 ++-- .../2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/advisories/github-reviewed/2024/04/GHSA-wmxc-v39r-p9wf/GHSA-wmxc-v39r-p9wf.json b/advisories/github-reviewed/2024/04/GHSA-wmxc-v39r-p9wf/GHSA-wmxc-v39r-p9wf.json index 3363fe0426e..8482b914eaa 100644 --- a/advisories/github-reviewed/2024/04/GHSA-wmxc-v39r-p9wf/GHSA-wmxc-v39r-p9wf.json +++ b/advisories/github-reviewed/2024/04/GHSA-wmxc-v39r-p9wf/GHSA-wmxc-v39r-p9wf.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-wmxc-v39r-p9wf", - "modified": "2024-04-04T14:21:49Z", + "modified": "2025-02-28T17:42:50Z", "published": "2024-04-04T00:33:11Z", "aliases": [ "CVE-2024-2689" ], "summary": "Temporal Server Denial of Service", - "details": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.\n", + "details": "Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json b/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json index 0c44f692050..a42a07a7014 100644 --- a/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json +++ b/advisories/github-reviewed/2024/09/GHSA-x3jx-5w6m-q2fc/GHSA-x3jx-5w6m-q2fc.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x3jx-5w6m-q2fc", - "modified": "2024-09-18T22:40:12Z", + "modified": "2025-02-28T17:43:16Z", "published": "2024-09-18T17:43:36Z", "aliases": [ "CVE-2022-25768" ], "summary": "Mautic vulnerable to Improper Access Control in UI upgrade process", - "details": "### Impact\nThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\n\n### Patches\nUpgrade to 4.4.13 or 5.1.1 or later.\n\n### Workarounds\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)\n", + "details": "### Impact\nThe logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.\n\n### Patches\nUpgrade to 4.4.13 or 5.1.1 or later.\n\n### Workarounds\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@mautic.org](mailto:security@mautic.org)", "severity": [ { "type": "CVSS_V3", @@ -121,7 +121,8 @@ "database_specific": { "cwe_ids": [ "CWE-284", - "CWE-287" + "CWE-287", + "CWE-862" ], "severity": "HIGH", "github_reviewed": true,