From 29526b47c4f28085b2cc50ed7a8abc901b9ea2ee Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 4 Feb 2025 17:18:26 +0000 Subject: [PATCH] Publish Advisories GHSA-2ccp-vqmv-4r4x GHSA-rpmj-rpgj-qmpm --- .../GHSA-2ccp-vqmv-4r4x/GHSA-2ccp-vqmv-4r4x.json | 12 +++++++++--- .../GHSA-rpmj-rpgj-qmpm/GHSA-rpmj-rpgj-qmpm.json | 14 +++++++++++--- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2025/02/GHSA-2ccp-vqmv-4r4x/GHSA-2ccp-vqmv-4r4x.json b/advisories/github-reviewed/2025/02/GHSA-2ccp-vqmv-4r4x/GHSA-2ccp-vqmv-4r4x.json index b218c74f806..6862ff05684 100644 --- a/advisories/github-reviewed/2025/02/GHSA-2ccp-vqmv-4r4x/GHSA-2ccp-vqmv-4r4x.json +++ b/advisories/github-reviewed/2025/02/GHSA-2ccp-vqmv-4r4x/GHSA-2ccp-vqmv-4r4x.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-2ccp-vqmv-4r4x", - "modified": "2025-02-03T17:56:03Z", + "modified": "2025-02-04T17:17:49Z", "published": "2025-02-03T17:56:03Z", - "aliases": [], + "aliases": [ + "CVE-2025-24961" + ], "summary": "S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends", "details": "### Impact\nUsers of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients.\n\n### Patches\nUpgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980.\n\n### Workarounds\nNone\n\n### References\nPrivately reported by XBOW Team @xbow-security.", "severity": [ @@ -38,6 +40,10 @@ "type": "WEB", "url": "https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24961" + }, { "type": "WEB", "url": "https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3" @@ -58,6 +64,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-02-03T17:56:03Z", - "nvd_published_at": null + "nvd_published_at": "2025-02-03T21:15:16Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-rpmj-rpgj-qmpm/GHSA-rpmj-rpgj-qmpm.json b/advisories/github-reviewed/2025/02/GHSA-rpmj-rpgj-qmpm/GHSA-rpmj-rpgj-qmpm.json index 925f487fbe2..57d0363282f 100644 --- a/advisories/github-reviewed/2025/02/GHSA-rpmj-rpgj-qmpm/GHSA-rpmj-rpgj-qmpm.json +++ b/advisories/github-reviewed/2025/02/GHSA-rpmj-rpgj-qmpm/GHSA-rpmj-rpgj-qmpm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-rpmj-rpgj-qmpm", - "modified": "2025-02-03T17:56:46Z", + "modified": "2025-02-04T17:17:24Z", "published": "2025-02-03T17:56:46Z", "aliases": [ "CVE-2025-24898" ], "summary": "rust-openssl ssl::select_next_proto use after free", - "details": "### Impact\n`ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `server` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.\n\n### Patches\n`openssl` 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.\n\n### Workarounds\nIn standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback. For example:\n\nNot vulnerable - the server buffer has a `'static` lifetime:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n ssl::select_next_proto(b\"\\x02h2\", client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nNot vulnerable - the server buffer outlives the handshake:\n```rust\nlet server_protos = b\"\\x02h2\".to_vec();\nbuilder.set_alpn_select_callback(|_, client_protos| {\n ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nVulnerable - the server buffer is freed when the callback returns:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n let server_protos = b\"\\x02h2\".to_vec();\n ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\n### References\nhttps://github.com/sfackler/rust-openssl/pull/2360\n", + "details": "### Impact\n`ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `server` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client.\n\n### Patches\n`openssl` 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers.\n\n### Workarounds\nIn standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback. For example:\n\nNot vulnerable - the server buffer has a `'static` lifetime:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n ssl::select_next_proto(b\"\\x02h2\", client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nNot vulnerable - the server buffer outlives the handshake:\n```rust\nlet server_protos = b\"\\x02h2\".to_vec();\nbuilder.set_alpn_select_callback(|_, client_protos| {\n ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\nVulnerable - the server buffer is freed when the callback returns:\n```rust\nbuilder.set_alpn_select_callback(|_, client_protos| {\n let server_protos = b\"\\x02h2\".to_vec();\n ssl::select_next_proto(&server_protos, client_protos).ok_or_else(AlpnError::NOACK)\n});\n```\n\n### References\nhttps://github.com/sfackler/rust-openssl/pull/2360", "severity": [ { "type": "CVSS_V4", @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/sfackler/rust-openssl/security/advisories/GHSA-rpmj-rpgj-qmpm" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24898" + }, { "type": "WEB", "url": "https://github.com/sfackler/rust-openssl/pull/2360" @@ -48,6 +52,10 @@ "type": "WEB", "url": "https://github.com/sfackler/rust-openssl/commit/f014afb230de4d77bc79dea60e7e58c2f47b60f2" }, + { + "type": "WEB", + "url": "https://crates.io/crates/openssl" + }, { "type": "PACKAGE", "url": "https://github.com/sfackler/rust-openssl" @@ -64,6 +72,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-02-03T17:56:46Z", - "nvd_published_at": null + "nvd_published_at": "2025-02-03T18:15:43Z" } } \ No newline at end of file