netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-92xg-gmrq-5c3w
GHSA-c392-whpc-vfpr
GHSA-qwgc-rr35-h4x9
GHSA-r9pp-r4xf-597r
GHSA-92xg-gmrq-5c3w
This commit is contained in:
advisory-database[bot]
2024-09-09 18:18:03 +00:00
parent ebb839e677
commit 1b202e6900
5 changed files with 263 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/09/GHSA-92xg-gmrq-5c3w/GHSA-92xg-gmrq-5c3w.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-92xg-gmrq-5c3w",
"modified": "2024-09-09T18:16:43Z",
"published": "2024-09-07T09:30:31Z",
"aliases": [
"CVE-2024-45034"
],
"summary": "Apache Airflow vulnerable to Execution with Unnecessary Privileges",
"details": "Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. \nUsers are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45034"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/41672"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6d"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx"
}
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-09-09T18:16:43Z",
"nvd_published_at": "2024-09-07T08:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-c392-whpc-vfpr/GHSA-c392-whpc-vfpr.json → advisories/github-reviewed/2024/09/GHSA-c392-whpc-vfpr/GHSA-c392-whpc-vfpr.json
+40 -6
View File
@@ -1,17 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c392-whpc-vfpr",
"modified": "2024-09-07T09:30:31Z",
"modified": "2024-09-09T18:17:00Z",
"published": "2024-09-07T09:30:31Z",
"aliases": [
"CVE-2024-45498"
],
"summary": "Apache Airflow vulnerable to Improper Encoding or Escaping of Output",
"details": "Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873  for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.1"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +48,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/41873"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/09ec2616568f8a18e0d5fe408110fae06ddf748f"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n"
@@ -31,9 +65,9 @@
"cwe_ids": [
"CWE-116"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-09-09T18:17:00Z",
"nvd_published_at": "2024-09-07T08:15:11Z"
}
}
advisories/github-reviewed/2024/09/GHSA-qwgc-rr35-h4x9/GHSA-qwgc-rr35-h4x9.json
+81
View File
@@ -0,0 +1,81 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qwgc-rr35-h4x9",
"modified": "2024-09-09T18:16:22Z",
"published": "2024-09-09T18:16:22Z",
"aliases": [
"CVE-2024-45041"
],
"summary": "External Secrets Operator vulnerable to privilege escalation",
"details": "### Details\nThe external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has \"get/list\" verbs of secrets resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49). It also has path/update verb of validatingwebhookconfigurations resources(https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27). As a result, if a malicious user can access the worker node which has this deployment. he/she can:\n1. For the \"get/list secrets\" permission, he/she can abuse the SA token of this deployment to retrieve or get ALL secrets in the whole cluster, including the cluster-admin secret if created. After that, he/she can abuse the cluster-admin secret to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.\n\n2. For the patch/update verb of validatingwebhookconfigurations, the malicious user can abuse these permissions to get sensitive data or lanuch DoS attacks:\n\nFor the privilege escalation attack, by updating/patching a Webhook to make it listen to Secret update operations, the attacker can capture and log all data from requests attempting to update Secrets. More specifically, when a Secret is updated, this Webhook sends the request data to the logging-service, which can then log the content of the Secret. This way, an attacker could indirectly gain access to the full contents of the Secret.\n\nFor the DoS attack, by updating/patching a Webhook, and making it deny all Pod create and update requests, the attacker can prevent any new Pods from being created or existing Pods from being updated, resulting in a Denial of Service (DoS) attack.\n\n### PoC\nPlease see the \"Details\" section\n\n### Impact\nPrivilege escalation",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/external-secrets/external-secrets"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.2"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45041"
},
{
"type": "WEB",
"url": "https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35"
},
{
"type": "WEB",
"url": "https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c"
},
{
"type": "PACKAGE",
"url": "https://github.com/external-secrets/external-secrets"
},
{
"type": "WEB",
"url": "https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27"
},
{
"type": "WEB",
"url": "https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-09-09T18:16:22Z",
"nvd_published_at": "2024-09-09T15:15:11Z"
}
}
advisories/github-reviewed/2024/09/GHSA-r9pp-r4xf-597r/GHSA-r9pp-r4xf-597r.json
+69
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/09/GHSA-92xg-gmrq-5c3w/GHSA-92xg-gmrq-5c3w.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-92xg-gmrq-5c3w",
"modified": "2024-09-07T09:30:31Z",
"published": "2024-09-07T09:30:31Z",
"aliases": [
"CVE-2024-45034"
],
"details": "Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. \nUsers are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45034"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/41672"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx"
}
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-07T08:15:11Z"
}
}