Publish Advisories

GHSA-2ccp-vqmv-4r4x
GHSA-rpmj-rpgj-qmpm

advisories/github-reviewed/2025/02/GHSA-2ccp-vqmv-4r4x/GHSA-2ccp-vqmv-4r4x.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2ccp-vqmv-4r4x",
-  "modified": "2025-02-03T17:56:03Z",
+  "modified": "2025-02-04T17:17:49Z",
   "published": "2025-02-03T17:56:03Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-24961"
+  ],
   "summary": "S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends",
   "details": "### Impact\nUsers of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients.\n\n### Patches\nUpgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980.\n\n### Workarounds\nNone\n\n### References\nPrivately reported by XBOW Team @xbow-security.",
   "severity": [
@@ -38,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24961"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3"
@@ -58,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2025-02-03T17:56:03Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-02-03T21:15:16Z"
   }
 }

advisories/github-reviewed/2025/02/GHSA-rpmj-rpgj-qmpm/GHSA-rpmj-rpgj-qmpm.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rpmj-rpgj-qmpm",
-  "modified": "2025-02-03T17:56:46Z",
+  "modified": "2025-02-04T17:17:24Z",
   "published": "2025-02-03T17:56:46Z",
   "aliases": [
     "CVE-2025-24898"
   ],
   "summary": "rust-openssl ssl::select_next_proto use after free",
-  "details": "### Impact\n`ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `server` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.\n\n### Patches\n`openssl` 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.\n\n### Workarounds\nIn standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback. For example:\n\nNot vulnerable - the server buffer has a `'static` lifetime:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    ssl::select_next_proto(b\"\\x02h2\", client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nNot vulnerable - the server buffer outlives the handshake:\n```rust\nlet server_protos = b\"\\x02h2\".to_vec();\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nVulnerable - the server buffer is freed when the callback returns:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    let server_protos = b\"\\x02h2\".to_vec();\n    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\n### References\nhttps://github.com/sfackler/rust-openssl/pull/2360\n",
+  "details": "### Impact\n`ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `server` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.\n\n### Patches\n`openssl` 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.\n\n### Workarounds\nIn standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback. For example:\n\nNot vulnerable - the server buffer has a `'static` lifetime:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    ssl::select_next_proto(b\"\\x02h2\", client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nNot vulnerable - the server buffer outlives the handshake:\n```rust\nlet server_protos = b\"\\x02h2\".to_vec();\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nVulnerable - the server buffer is freed when the callback returns:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n    let server_protos = b\"\\x02h2\".to_vec();\n    ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\n### References\nhttps://github.com/sfackler/rust-openssl/pull/2360",
   "severity": [
     {
       "type": "CVSS_V4",
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24898"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/sfackler/rust-openssl/pull/2360"
@@ -48,6 +52,10 @@
       "type": "WEB",
       "url": "https://github.com/sfackler/rust-openssl/commit/f014afb230de4d77bc79dea60e7e58c2f47b60f2"
     },
+    {
+      "type": "WEB",
+      "url": "https://crates.io/crates/openssl"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/sfackler/rust-openssl"
@@ -64,6 +72,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2025-02-03T17:56:46Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-02-03T18:15:43Z"
   }
 }