From 1b47bcf8764aedddada9e3746d74554a284dfa33 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 19 Jul 2024 20:00:30 +0000 Subject: [PATCH] Publish Advisories GHSA-rpx8-fg6w-rm6x GHSA-3wf2-2pq4-4rvc GHSA-rwcj-7jjp-4w38 GHSA-xw35-rrcp-g7xm --- .../GHSA-rpx8-fg6w-rm6x.json | 35 ++++++- .../GHSA-3wf2-2pq4-4rvc.json | 92 +++++++++++++++++++ .../GHSA-rwcj-7jjp-4w38.json | 69 ++++++++++++++ .../GHSA-xw35-rrcp-g7xm.json | 88 ++++++++++++++++++ 4 files changed, 280 insertions(+), 4 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json (64%) create mode 100644 advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json create mode 100644 advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json create mode 100644 advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json diff --git a/advisories/unreviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json b/advisories/github-reviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json similarity index 64% rename from advisories/unreviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json rename to advisories/github-reviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json index dbde8ea0e2a..224c9c74363 100644 --- a/advisories/unreviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json +++ b/advisories/github-reviewed/2024/06/GHSA-rpx8-fg6w-rm6x/GHSA-rpx8-fg6w-rm6x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rpx8-fg6w-rm6x", - "modified": "2024-06-06T21:30:37Z", + "modified": "2024-07-19T19:59:18Z", "published": "2024-06-06T21:30:37Z", "aliases": [ "CVE-2024-5478" ], + "summary": "lunary-ai/lunary XSS in SAML metadata endpoint", "details": "A Cross-site Scripting (XSS) vulnerability exists in the SAML metadata endpoint `/auth/saml/${org?.id}/metadata` of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the `orgId` parameter supplied by the user before incorporating it into the generated response. Specifically, the endpoint generates XML responses for SAML metadata, where the `orgId` parameter is directly embedded into the XML structure without proper sanitization or validation. This flaw allows an attacker to inject arbitrary JavaScript code into the generated SAML metadata page, leading to potential theft of user cookies or authentication tokens.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "lunary" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.2.7" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5478" }, + { + "type": "PACKAGE", + "url": "https://github.com/lunary-ai/lunary" + }, + { + "type": "WEB", + "url": "https://github.com/lunary-ai/lunary/blob/main/packages/backend/src/api/v1/auth/saml.ts#L34" + }, { "type": "WEB", "url": "https://huntr.com/bounties/e899f496-d493-4c06-b596-cb0a88ad451b" @@ -31,8 +58,8 @@ "CWE-79" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:18Z", "nvd_published_at": "2024-06-06T19:16:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json b/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json new file mode 100644 index 00000000000..3e3c4071604 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wf2-2pq4-4rvc", + "modified": "2024-07-19T19:59:06Z", + "published": "2024-07-19T19:59:06Z", + "aliases": [ + "CVE-2024-41122" + ], + "summary": "Woodpecker's custom environment variables allow to alter execution flow of plugins", + "details": "### Impact\nThe server allow to create any user who can trigger a pipeline run malicious workflows:\n- Those workflows can either lead to a host takeover that runs the agent executing the workflow.\n- Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.\n\n### Patches\nhttps://github.com/woodpecker-ci/woodpecker/pull/3909\nhttps://github.com/woodpecker-ci/woodpecker/pull/3934\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n**Enable the \"gated\" repo feature and review each change upfront of running**\n\n### References\n- https://github.com/woodpecker-ci/woodpecker/pull/3909\n- https://github.com/woodpecker-ci/woodpecker/pull/3934\n- https://github.com/woodpecker-ci/woodpecker-security/issues/10 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3929)\n- https://github.com/woodpecker-ci/woodpecker/issues/3929 (info will be published later once we got adoption of the update)\n\n### Credits\n\n- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG)\n- Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/issues/3929" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/pull/3909" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/pull/3934" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/commit/8aa3e5ec82c92eca3279e4be68625111eeedf1c4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/woodpecker-ci/woodpecker" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:06Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json b/advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json new file mode 100644 index 00000000000..1770db7f5bc --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-rwcj-7jjp-4w38/GHSA-rwcj-7jjp-4w38.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwcj-7jjp-4w38", + "modified": "2024-07-19T19:59:14Z", + "published": "2024-07-19T19:59:14Z", + "aliases": [ + "CVE-2024-41124" + ], + "summary": "[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`", + "details": "### Impact\n`API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks.\n\n### References\n[ISSUE](https://github.com/ARPSyndicate/puncia/issues/8)\n[PATCH](https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "puncia" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.21" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38" + }, + { + "type": "WEB", + "url": "https://github.com/ARPSyndicate/puncia/issues/8" + }, + { + "type": "WEB", + "url": "https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ARPSyndicate/puncia" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:14Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json b/advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json new file mode 100644 index 00000000000..15aab711815 --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-xw35-rrcp-g7xm/GHSA-xw35-rrcp-g7xm.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xw35-rrcp-g7xm", + "modified": "2024-07-19T19:59:08Z", + "published": "2024-07-19T19:59:08Z", + "aliases": [ + "CVE-2024-41121" + ], + "summary": "Woodpecker's custom workspace allow to overwrite plugin entrypoint executable", + "details": "### Impact\nThe server allow to create any user who can trigger a pipeline run malicious workflows:\n- Those workflows can either lead to a host takeover that runs the agent executing the workflow.\n- Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.\n\n### Patches\nhttps://github.com/woodpecker-ci/woodpecker/pull/3933\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n**Enable the \"gated\" repo feature and review each change upfront**\n\n### References\n- https://github.com/woodpecker-ci/woodpecker/pull/3933\n- https://github.com/woodpecker-ci/woodpecker-security/pull/11\n- https://github.com/woodpecker-ci/woodpecker-security/issues/8 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924)\n- https://github.com/woodpecker-ci/woodpecker-security/issues/9 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924)\n- https://github.com/woodpecker-ci/woodpecker/issues/3924 (info will be published later once we got adoption of the update)\n\n### Credits\n\n- Daniel Kilimnik [@D_K_Dev](https://x.com/D_K_Dev) (Neodyme AG)\n- Felipe Custodio Romero [@_localo_](https://x.com/_localo_) (Neodyme AG)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "go.woodpecker-ci.org/woodpecker" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-xw35-rrcp-g7xm" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/issues/3924" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/pull/3933" + }, + { + "type": "WEB", + "url": "https://github.com/woodpecker-ci/woodpecker/commit/764329ed1dbc47c4a517ccc749e3feb34059fac8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/woodpecker-ci/woodpecker" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-07-19T19:59:08Z", + "nvd_published_at": null + } +} \ No newline at end of file