netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2mj3-vfvx-fc43
GHSA-gh5c-3h97-2f3q
GHSA-59g5-xgcq-4qw3
GHSA-qmc2-jpr5-7rg9
This commit is contained in:
advisory-database[bot]
2024-12-02 21:39:01 +00:00
parent b46b8544f0
commit 2aa5313e7c
4 changed files with 254 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/11/GHSA-2mj3-vfvx-fc43/GHSA-2mj3-vfvx-fc43.json → advisories/github-reviewed/2024/11/GHSA-2mj3-vfvx-fc43/GHSA-2mj3-vfvx-fc43.json
+36 -6
View File
@@ -1,14 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2mj3-vfvx-fc43",
"modified": "2024-11-29T18:34:03Z",
"modified": "2024-12-02T21:38:01Z",
"published": "2024-11-29T18:34:03Z",
"aliases": [
"CVE-2024-36621"
],
"summary": "Moby Race Condition vulnerability",
"details": "moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/moby/moby"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "26.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +48,10 @@
"type": "WEB",
"url": "https://gist.github.com/1047524396/5d44459edab5fafcdf86b43909b81135"
},
{
"type": "PACKAGE",
"url": "https://github.com/moby/moby"
},
{
"type": "WEB",
"url": "https://github.com/moby/moby/blob/v25.0.5/builder/builder-next/adapters/snapshot/layer.go#L24"
@@ -29,9 +59,9 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T21:38:01Z",
"nvd_published_at": "2024-11-29T18:15:07Z"
}
}
advisories/unreviewed/2024/11/GHSA-gh5c-3h97-2f3q/GHSA-gh5c-3h97-2f3q.json → advisories/github-reviewed/2024/11/GHSA-gh5c-3h97-2f3q/GHSA-gh5c-3h97-2f3q.json
+36 -6
View File
@@ -1,14 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gh5c-3h97-2f3q",
"modified": "2024-11-29T18:34:03Z",
"modified": "2024-12-02T21:38:26Z",
"published": "2024-11-29T18:34:03Z",
"aliases": [
"CVE-2024-36623"
],
"summary": "Moby Race Condition vulnerability",
"details": "moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/moby/moby"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "26.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +48,10 @@
"type": "WEB",
"url": "https://gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29"
},
{
"type": "PACKAGE",
"url": "https://github.com/moby/moby"
},
{
"type": "WEB",
"url": "https://github.com/moby/moby/blob/v25.0.3/pkg/streamformatter/streamformatter.go#L115"
@@ -29,9 +59,9 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T21:38:26Z",
"nvd_published_at": "2024-11-29T18:15:08Z"
}
}
advisories/github-reviewed/2024/12/GHSA-59g5-xgcq-4qw3/GHSA-59g5-xgcq-4qw3.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-59g5-xgcq-4qw3",
"modified": "2024-12-02T21:37:04Z",
"published": "2024-12-02T21:37:04Z",
"aliases": [
"CVE-2024-53981"
],
"summary": "Denial of service (DoS) via deformation `multipart/form-data` boundary",
"details": "### Summary\n\nWhen parsing form data, `python-multipart` skips line breaks (CR `\\r` or LF `\\n`) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs.\n\nAn attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS).\n\n### Impact\n\nApplications that use `python-multipart` to parse form data (or use frameworks that do so) are affected. \n\n### Original Report\n\nThis security issue was reported by:\n- GitHub security advisory in Starlette on October 30 by @Startr4ck\n- Email to `python-multipart` maintainer on October 3 by @mnqazi",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "python-multipart"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.18"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53981"
},
{
"type": "WEB",
"url": "https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177"
},
{
"type": "PACKAGE",
"url": "https://github.com/Kludex/python-multipart"
}
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T21:37:04Z",
"nvd_published_at": "2024-12-02T16:15:14Z"
}
}
advisories/github-reviewed/2024/12/GHSA-qmc2-jpr5-7rg9/GHSA-qmc2-jpr5-7rg9.json
+113
View File
@@ -0,0 +1,113 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qmc2-jpr5-7rg9",
"modified": "2024-12-02T21:36:21Z",
"published": "2024-12-02T21:36:21Z",
"aliases": [
"CVE-2024-53983"
],
"summary": "Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery",
"details": "### Impact\n\nA vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these tokens, unauthorized access to sensitive resources in git can be achieved. The impact is considered medium severity as the Backstage Threat Model recommends restricting access to adding and editing templates in the Backstage Catalog plugin.\n\n### Patches\n\nThe issue has been resolved in versions `v0.4.12`, `v0.5.1` and `v0.6.1` of the `@backstage/plugin-scaffolder-node` package. Users are encouraged to upgrade to this version to mitigate the vulnerability.\n\n### Workarounds\n\nUsers can ensure that templates do not change git config.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-scaffolder-node"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.12"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-scaffolder-node"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "0.5.1"
}
]
}
],
"versions": [
"0.5.0"
]
},
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-scaffolder-node"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.6.0"
},
{
"fixed": "0.6.1"
}
]
}
],
"versions": [
"0.6.0"
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53983"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/tree/master/plugins/scaffolder-node"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-12-02T21:36:21Z",
"nvd_published_at": "2024-11-29T19:15:10Z"
}
}