Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-05 05:10:40 +00:00
parent 86412da07f
commit 0ddd841bbd
855 changed files with 1061 additions and 3183 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "JSON gem has Improper Input Validation vulnerability",
  "details": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -62,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-06T13:46:32Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-5j5w-g665-5m35",
  "modified": "2023-03-30T14:50:04Z",
  "published": "2021-11-18T16:08:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Ambiguous OCI manifest parsing",
  "details": "### Impact\n\nIn the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header.  Versions of containerd prior to 1.4.12 and 1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header.  If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.\n\n### Patches\n\nThis issue has been fixed in containerd 1.4.12 and 1.5.8.  Image pulls for manifests that contain a “manifests” field or indices which contain a “layers” field are rejected.\n\n### Workarounds\n\nEnsure you only pull images from trusted sources.\n\n### References\n\nhttps://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m\nhttps://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)",
  "severity": [
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-05T15:16:37Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-gf8q-jrpm-jvxq",
  "modified": "2022-01-07T22:20:43Z",
  "published": "2022-01-08T00:22:02Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "URL parsing in node-forge could lead to undesired behavior.",
  "details": "### Impact\nThe regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.\n\n### Patches\n`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.\n\n### Workarounds\nEnsure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.\n\n### References\n- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [forge](https://github.com/digitalbazaar/forge)\n* Email us at support@digitalbazaar.com\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross Site Request Forgery in concrete5/concrete5 ",
  "details": "A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-14T22:43:02Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Spree allows remote attackers to obtain sensitive information",
  "details": "Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) `admin/products.json`, (2) `admin/users.json`, or (3) `admin/overview/get_report_data`, related to a \"JSON hijacking\" issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework",
  "details": "Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.  NOTE: this might be the same vulnerability as CVE-2013-7072.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter",
  "details": "Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-2c7c-3mj9-8fqh",
  "modified": "2024-05-20T21:57:47Z",
  "published": "2023-11-21T22:17:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Decryption of malicious PBES2 JWE objects can consume unbounded system resources",
  "details": "The go-jose package is subject to a \"billion hashes attack\" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-7f32-hm4h-w77q",
  "modified": "2024-04-22T18:47:56Z",
  "published": "2024-02-03T00:22:22Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "github-slug-action use of `set-env` Runner commands which are processed via stdout",
  "details": "### Impact\nThis GitHub Action use `set-env` runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w\n\n### Patches\nThe following versions use the recommended [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files).\n\n- 2.1.1\n- 1.1.1\n\n### Workarounds\nNone, it is strongly suggested that you upgrade as soon as possible.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [rlespinasse/github-slug-action](https://github.com/rlespinasse/github-slug-action)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -68,9 +64,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-03T00:22:22Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-f56g-chqp-22m9",
  "modified": "2024-04-22T18:49:42Z",
  "published": "2024-02-03T00:28:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Use after free in libpulse-binding",
  "details": "### Overview\n\nVersion 2.5.0 of the `libpulse-binding` Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a `proplist::Iterator` to the `Proplist` object for which it was created. This made it possible for users, without experiencing a compiler error/warning, to destroy the `Proplist` object before the iterator, thus destroying the underlying C object the iterator works upon, before the iterator may be finished with it.\n\nThis advisory is being written retrospectively, having previously only been noted in the changelog. No CVE assignment was sought.\n\nThis impacts all versions of the crate before 2.5.0 back to 1.0.5. Before version 1.0.5 the function that produces the iterator was broken to the point of being useless.\n\n### Patches\n\nUsers are required to update to version 2.5.0 or newer.\n\nVersions older than 2.5.0 have been yanked from crates.io as of the 22nd of October 2020.",
  "severity": [
@@ -57,9 +57,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-08T18:32:10Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-7jwh-3vrq-q3m8",
  "modified": "2024-09-13T15:36:58Z",
  "published": "2024-03-04T20:45:25Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "pgproto3 SQL Injection via Protocol Message Size Overflow",
  "details": "### Impact\n\nSQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.\n\n### Patches\n\nThe problem is resolved in v2.3.3\n\n### Workarounds\n\nReject user input large enough to cause a single query or bind message to exceed 4 GB in size.\n",
  "severity": [
@@ -62,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-04T17:01:56Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-x883-2vmg-xwf7",
  "modified": "2024-04-22T15:52:39Z",
  "published": "2024-04-22T15:52:39Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Authelia's Group Changes may not have the expected results (YAML file backend)",
  "details": "### Impact\n\nUnder very specific conditions changes to a users groups may not have the expected results.\n\nThe specific conditions are:\n\n* The file authentication backend is being used.\n* The [watch](https://www.authelia.com/configuration/first-factor/file/#watch) option is set to true.\n* The [refresh_interval](https://www.authelia.com/configuration/first-factor/introduction/#refresh_interval) is configured to a non-disabled value.\n* The users groups are adjusted by an administrator.\n* The user attempts to access a resource that their groups previously had access to but their new groups do not have access to.\n\nWhen these conditions are met administrators may find the changes are not taken into account by access control for longer than expected periods. While this may not necessarily be a security vulnerability it's security-adjacent and because of the unexpected nature of it and our dedication to a security-first culture we feel it's important to make users aware of this behaviour utilizing a security advisory and the existence of a fix.\n\nThis:\n\n* Can not have an Impact for Unauthenticated Users.\n* Can not have an Impact for Configurations utilizing the LDAP Backend.\n* Can not be directly or indirectly caused by a users or third parties actions.\n\n### Patches\n\nThis behaviour was identified **_after_** it was inadvertently fixed in the `master` branch during the multi-cookie domain rework (i.e. between feature releases). A patch for prior versions can be provided upon request. The fix was to ensure the details are updated regardless of backend, it was a small oversight in previous functionality which made refreshing ineffectual prior to v4.37.0.\n\n### Workarounds\n\nEnsure you restart between user database changes.\n\n### References\n\n* https://github.com/authelia/authelia/blob/v4.37.5/internal/handlers/handler_verify.go#L376-L394\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-2g98-f9jv-w8c5",
  "modified": "2024-05-20T18:06:52Z",
  "published": "2024-05-20T18:06:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "robrichards/xmlseclibs XPath injection",
  "details": "A vulnerability has been identified in the robrichards/xmlseclibs library, specifically related to XPath injection. The issue arises from inadequate filtering of user input before it is incorporated into XPath expressions.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-7v7m-pcw5-h3cg",
  "modified": "2024-05-20T17:49:10Z",
  "published": "2024-05-20T17:49:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": " Pusher Service Channel Authentication Bypass",
  "details": "The service offered by Pusher provides \"private\" channels with an authentication mechanism that restricts subscription access. The decision on allowing subscriptions to private channels is delegated to customers, who implement an authentication endpoint. End-users request a token from this endpoint to join a specific channel. The token is an HMAC signature of the end-user's connection ID (socket_id) and the desired channel.\n\nThe issue arises from a lack of validation in the libraries provided to customers. This vulnerability allows a malicious end-user to submit a malformed socket_id field, leading the customer to unknowingly sign a string. This signed string grants access to a different private channel than the one the end-user is ostensibly requesting. Consequently, a malicious end-user, with permission to subscribe to one private channel, can forge permission for any private channel owned by the same customer.\n\nAdditionally, the HTTP API is secured by requiring a signature with each request, generated by the customer's secret key. In specific cases, a malicious end-user may deceive a customer into signing a value for socket_id, effectively authenticating an API request to Pusher.",
  "severity": [
--- a/Show More
+++ b/Show More