From 2ca704ed0ef3d4b24c7ce904626ac5490f630e43 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 7 May 2025 15:27:27 +0000 Subject: [PATCH] Publish Advisories GHSA-79m9-55jc-p6mw GHSA-qv97-5qr8-2266 GHSA-whxr-3p84-rf3c GHSA-whxr-3p84-rf3c --- .../GHSA-79m9-55jc-p6mw.json | 59 +++++ .../GHSA-qv97-5qr8-2266.json | 55 +++++ .../GHSA-whxr-3p84-rf3c.json | 206 ++++++++++++++++++ .../GHSA-whxr-3p84-rf3c.json | 40 ---- 4 files changed, 320 insertions(+), 40 deletions(-) create mode 100644 advisories/github-reviewed/2025/05/GHSA-79m9-55jc-p6mw/GHSA-79m9-55jc-p6mw.json create mode 100644 advisories/github-reviewed/2025/05/GHSA-qv97-5qr8-2266/GHSA-qv97-5qr8-2266.json create mode 100644 advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json delete mode 100644 advisories/unreviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json diff --git a/advisories/github-reviewed/2025/05/GHSA-79m9-55jc-p6mw/GHSA-79m9-55jc-p6mw.json b/advisories/github-reviewed/2025/05/GHSA-79m9-55jc-p6mw/GHSA-79m9-55jc-p6mw.json new file mode 100644 index 00000000000..77ca99ff70b --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-79m9-55jc-p6mw/GHSA-79m9-55jc-p6mw.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79m9-55jc-p6mw", + "modified": "2025-05-07T15:26:32Z", + "published": "2025-05-07T15:26:32Z", + "aliases": [], + "summary": "scanner has a Public API without sufficient bounds checking", + "details": "`Match::get()` and `Match::ptr()` lack sufficient bounds checks, leading to potential out of bounds reads.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "scanner" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pombredanne/scanner-rs/pull/1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pombredanne/scanner-rs" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0033.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-05-07T15:26:32Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-qv97-5qr8-2266/GHSA-qv97-5qr8-2266.json b/advisories/github-reviewed/2025/05/GHSA-qv97-5qr8-2266/GHSA-qv97-5qr8-2266.json new file mode 100644 index 00000000000..f2511e2022a --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-qv97-5qr8-2266/GHSA-qv97-5qr8-2266.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qv97-5qr8-2266", + "modified": "2025-05-07T15:25:18Z", + "published": "2025-05-07T15:25:18Z", + "aliases": [], + "summary": "Mithril snapshots for Cardano database could be compromised by an adversary", + "details": "### Impact\n\n#### Mithril certification of Cardano database\n\nThe Mithril network provides certification for snapshots of the Cardano database, enabling users to quickly bootstrap a Cardano node without relying on the slower peer-to-peer synchronization process.\n\nTo generate a multi-signature, a minimum threshold of Cardano stake registered in the protocol must agree on signing the same message. In this context, a digest is computed from the internal files of the Cardano node's database. However, this mechanism has certain limitations. Specifically, some files are not identically generated across all Cardano nodes, and there is no API to provide consistent snapshots at a specific beacon on the Cardano chain:\n\n- All immutable files, except the last one (which is still being created), are used to compute the message\n- The last immutable file is excluded from the signature\n- The ledger state files are also excluded from the signature.\n\n#### Cardano node startup sequence\n\nA Cardano node can only perform a fast bootstrap if a pre-computed ledger state is loaded into its database; otherwise, a full re-computation is required, which is time-consuming. During the startup phase with a pre-computed ledger state, the node performs structural verification of the ledger state and lightweight conformity checks which may not be enough to systematically detect invalid ledger state.\n\n#### Attack scenarios\n\nInconsistencies could be introduced into a tampered ledger state distributed through Mithril snapshots, either by an unknown source or by a compromised IOG-operated aggregator. These inconsistencies would not be immediately detected by Cardano nodes started with such snapshots, potentially enabling long-range attacks that might not be corrected by honest nodes, even if they sync from genesis.\n\nCurrently, a Mithril network has only one aggregator, which serves snapshots from a secure cloud location operated by IOG and is therefore assumed to be trustworthy. In the future, as Mithril networks become more decentralized, multiple aggregators will operate independently. This increased decentralization could raise the risk of a malicious aggregator distributing a tampered ledger state.\n\n### Patches\n\nAs a mitigation, the Mithril aggregator now signs the ledger state snapshot and the latest immutable file using an IOG-owned key, and the client library and CLI validate the signature of these files upon download.\n\n- The **Mithril client library** has been fixed with version `0.12.2`, **previous versions must not be used anymore**.\n- The **Mithril client CLI** has been fixed with version `0.12.1`, **previous versions must not be used anymore**.\n- The **Mithril aggregator** has been fixed with version `0.7.44`, **previous versions must not be used anymore**.\n\n### References\n\n- _Mithril protocol in depth_: https://mithril.network/doc/next/mithril/mithril-protocol/protocol\n- _Bootstrap a Cardano node_: https://mithril.network/doc/manual/getting-started/bootstrap-cardano-node\n- _Mithril certification of the Cardano node database_: https://mithril.network/doc/mithril/advanced/mithril-certification/cardano-node-database", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "mithril-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.12.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/input-output-hk/mithril/security/advisories/GHSA-qv97-5qr8-2266" + }, + { + "type": "PACKAGE", + "url": "https://github.com/input-output-hk/mithril" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-345" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-07T15:25:18Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json b/advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json new file mode 100644 index 00000000000..67a10acc44b --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json @@ -0,0 +1,206 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whxr-3p84-rf3c", + "modified": "2025-05-07T15:25:42Z", + "published": "2025-05-07T09:31:19Z", + "aliases": [ + "CVE-2025-27533" + ], + "summary": "Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation", + "details": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.16.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.16.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.17.0" + }, + { + "fixed": "5.17.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.18.0" + }, + { + "fixed": "5.18.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-openwire-legacy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.1.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.17.0" + }, + { + "fixed": "5.17.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.18.0" + }, + { + "fixed": "5.18.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:activemq-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.1.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27533" + }, + { + "type": "WEB", + "url": "https://github.com/apache/activemq/commit/fc4372b9f0f72b8b5eed917f0019c5cea45c5d06" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/activemq" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/AMQ-6596" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/05/06/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-789" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-07T15:25:41Z", + "nvd_published_at": "2025-05-07T09:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json b/advisories/unreviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json deleted file mode 100644 index 549f363ccef..00000000000 --- a/advisories/unreviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-whxr-3p84-rf3c", - "modified": "2025-05-07T09:31:19Z", - "published": "2025-05-07T09:31:19Z", - "aliases": [ - "CVE-2025-27533" - ], - "details": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.", - "severity": [ - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Red" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27533" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/05/06/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-789" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-05-07T09:15:18Z" - } -} \ No newline at end of file