From 276e5228d8e5e8cefce4ad5b4fccc2c2081940bf Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Mar 2025 19:57:26 +0000 Subject: [PATCH] Publish Advisories GHSA-53gh-p8jc-7rg8 GHSA-6w62-3jvj-mfj6 GHSA-6w62-3jvj-mfj6 --- .../GHSA-53gh-p8jc-7rg8.json | 37 +++++++- .../GHSA-6w62-3jvj-mfj6.json | 84 +++++++++++++++++++ .../GHSA-6w62-3jvj-mfj6.json | 36 -------- 3 files changed, 117 insertions(+), 40 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json (60%) create mode 100644 advisories/github-reviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json diff --git a/advisories/unreviewed/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json b/advisories/github-reviewed/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json similarity index 60% rename from advisories/unreviewed/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json rename to advisories/github-reviewed/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json index 79b9f1dddf1..b827dcb951e 100644 --- a/advisories/unreviewed/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json +++ b/advisories/github-reviewed/2025/03/GHSA-53gh-p8jc-7rg8/GHSA-53gh-p8jc-7rg8.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-53gh-p8jc-7rg8", - "modified": "2025-03-20T12:32:45Z", + "modified": "2025-03-20T19:55:11Z", "published": "2025-03-20T12:32:45Z", "aliases": [ "CVE-2024-6825" ], + "summary": "LiteLLM Vulnerable to Remote Code Execution (RCE)", "details": "BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.", "severity": [ { @@ -13,12 +14,40 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "litellm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.40.3.dev2" + }, + { + "last_affected": "1.40.12" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6825" }, + { + "type": "PACKAGE", + "url": "https://github.com/BerriAI/litellm" + }, + { + "type": "WEB", + "url": "https://github.com/BerriAI/litellm/blob/056913fd7049923a106130b02d7c29e7f312beec/litellm/utils.py#L2818" + }, { "type": "WEB", "url": "https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5" @@ -29,8 +58,8 @@ "CWE-77" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-20T19:55:11Z", "nvd_published_at": "2025-03-20T10:15:33Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json b/advisories/github-reviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json new file mode 100644 index 00000000000..d938da38266 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6w62-3jvj-mfj6", + "modified": "2025-03-20T19:56:42Z", + "published": "2025-03-20T12:32:46Z", + "aliases": [ + "CVE-2024-7765" + ], + "summary": "H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing", + "details": "In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "h2o" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.32.1.2" + }, + { + "last_affected": "3.46.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "ai.h2o:h2o-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.32.1.2" + }, + { + "last_affected": "3.46.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7765" + }, + { + "type": "PACKAGE", + "url": "https://github.com/h2oai/h2o-3" + }, + { + "type": "WEB", + "url": "https://github.com/h2oai/h2o-3/blob/7d418fa19d3ab434f742818e37f891bef9102c97/h2o-core/src/main/java/water/parser/ParseDataset.java#L900" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-409" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-20T19:56:42Z", + "nvd_published_at": "2025-03-20T10:15:36Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json b/advisories/unreviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json deleted file mode 100644 index 518be7c0ddf..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-6w62-3jvj-mfj6/GHSA-6w62-3jvj-mfj6.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6w62-3jvj-mfj6", - "modified": "2025-03-20T12:32:46Z", - "published": "2025-03-20T12:32:46Z", - "aliases": [ - "CVE-2024-7765" - ], - "details": "In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7765" - }, - { - "type": "WEB", - "url": "https://huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-409" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-20T10:15:36Z" - } -} \ No newline at end of file