From 2e8aaa29067b8b5b8f0c6c857acd986b5cc6538d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Jun 2023 22:01:08 +0000 Subject: [PATCH] Publish Advisories GHSA-7fpw-cfc4-3p2c GHSA-3862-fmr3-4f3h GHSA-77fw-rf4v-vfp9 GHSA-wg6p-jmpc-xjmr GHSA-3862-fmr3-4f3h --- .../GHSA-7fpw-cfc4-3p2c.json | 9 +-- .../GHSA-3862-fmr3-4f3h.json | 58 ++++++++++++++++ .../GHSA-77fw-rf4v-vfp9.json | 69 +++++++++++++++++++ .../GHSA-wg6p-jmpc-xjmr.json | 65 +++++++++++++++++ .../GHSA-3862-fmr3-4f3h.json | 35 ---------- 5 files changed, 197 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json create mode 100644 advisories/github-reviewed/2023/06/GHSA-77fw-rf4v-vfp9/GHSA-77fw-rf4v-vfp9.json create mode 100644 advisories/github-reviewed/2023/06/GHSA-wg6p-jmpc-xjmr/GHSA-wg6p-jmpc-xjmr.json delete mode 100644 advisories/unreviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json diff --git a/advisories/github-reviewed/2017/12/GHSA-7fpw-cfc4-3p2c/GHSA-7fpw-cfc4-3p2c.json b/advisories/github-reviewed/2017/12/GHSA-7fpw-cfc4-3p2c/GHSA-7fpw-cfc4-3p2c.json index 5ada23c3882..6385703b780 100644 --- a/advisories/github-reviewed/2017/12/GHSA-7fpw-cfc4-3p2c/GHSA-7fpw-cfc4-3p2c.json +++ b/advisories/github-reviewed/2017/12/GHSA-7fpw-cfc4-3p2c/GHSA-7fpw-cfc4-3p2c.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-7fpw-cfc4-3p2c", - "modified": "2021-09-02T21:17:05Z", + "modified": "2023-06-21T22:00:08Z", "published": "2017-12-28T22:51:45Z", + "withdrawn": "2023-06-21T22:00:08Z", "aliases": [ - "CVE-2017-16897" + ], - "summary": "High severity vulnerability that affects passport-wsfed-saml2", - "details": "A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).", + "summary": "Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2", + "details": "## Duplicate advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references.\n\n## Original Description\nA vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json b/advisories/github-reviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json new file mode 100644 index 00000000000..073c4ed366f --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3862-fmr3-4f3h", + "modified": "2023-06-21T21:59:31Z", + "published": "2023-06-21T18:31:08Z", + "aliases": [ + "CVE-2023-33725" + ], + "summary": "Broadleaf vulnerable to Cross-site Scripting", + "details": "Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.7-GA.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.broadleafcommerce:broadleaf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-GA" + }, + { + "fixed": "6.2.7-GA" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33725" + }, + { + "type": "PACKAGE", + "url": "https://github.com/BroadleafCommerce/BroadleafCommerce" + }, + { + "type": "WEB", + "url": "https://github.com/Contrast-Security-OSS/Burptrast/tree/main/docs/CVE-2023-33725" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-06-21T21:59:31Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-77fw-rf4v-vfp9/GHSA-77fw-rf4v-vfp9.json b/advisories/github-reviewed/2023/06/GHSA-77fw-rf4v-vfp9/GHSA-77fw-rf4v-vfp9.json new file mode 100644 index 00000000000..ecfae71901e --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-77fw-rf4v-vfp9/GHSA-77fw-rf4v-vfp9.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-77fw-rf4v-vfp9", + "modified": "2023-06-21T22:00:18Z", + "published": "2023-06-21T22:00:18Z", + "aliases": [ + "CVE-2017-16897" + ], + "summary": "passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token", + "details": "## Information\nPlease note that this is not a new disclosure, and is previously reported in our [SECURITY-NOTICE.md](https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70\n) which we removed in favor of github advisory. \n\n# Overview \n This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider:\n\n- signs SAML response and signs assertion\n\n- does not sign SAML response and signs assertion\n\n# Am I affected?\n\nYou may be affected if you use SAML2 protocol with passport-wsfed-saml2 versions below 3.0.5 and your SAML identity Provider: \n1. signs SAML response and signs assertion; or \n2. does not sign SAML response and signs assertion\n\n# How do I fix it?\n\nYou may fix this vulnerability by upgrading your library to version 3.0.5 or above. \n\n# Will the fix impact my users?\nThis fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "passport-wsfed-saml2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-77fw-rf4v-vfp9" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16897" + }, + { + "type": "WEB", + "url": "https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70" + }, + { + "type": "WEB", + "url": "https://auth0.com/docs/security/bulletins/cve-2017-16897" + }, + { + "type": "PACKAGE", + "url": "https://github.com/auth0/passport-wsfed-saml2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-290" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-06-21T22:00:18Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-wg6p-jmpc-xjmr/GHSA-wg6p-jmpc-xjmr.json b/advisories/github-reviewed/2023/06/GHSA-wg6p-jmpc-xjmr/GHSA-wg6p-jmpc-xjmr.json new file mode 100644 index 00000000000..08b223f2137 --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-wg6p-jmpc-xjmr/GHSA-wg6p-jmpc-xjmr.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wg6p-jmpc-xjmr", + "modified": "2023-06-21T22:00:30Z", + "published": "2023-06-21T22:00:30Z", + "aliases": [ + "CVE-2023-35926" + ], + "summary": "Backstage Scaffolder plugin has insecure sandbox", + "details": "The Backstage scaffolder-backend plugin uses a templating library that requires a sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library.\n\n### Impact\n\nA malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data.\n\n### Patches\n\nThis is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.\n\n### Workarounds\n\nNote that the [Backstage Threat Model](https://backstage.io/docs/overview/threat-model) states that scaffolder templates are considered to be a sensitive area that with the recommendation that you control access and perform manual reviews of changes to the scaffolder templates. The exploit is of a nature where it is easily discoverable in manual review.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@backstage/plugin-scaffolder-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.15.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/security/advisories/GHSA-wg6p-jmpc-xjmr" + }, + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/commit/fb7375507d56faedcb7bb3665480070593c8949a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/backstage/backstage" + }, + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/releases/tag/v1.15.0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-06-21T22:00:30Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json b/advisories/unreviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json deleted file mode 100644 index 0b6b190a5d7..00000000000 --- a/advisories/unreviewed/2023/06/GHSA-3862-fmr3-4f3h/GHSA-3862-fmr3-4f3h.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3862-fmr3-4f3h", - "modified": "2023-06-21T18:31:08Z", - "published": "2023-06-21T18:31:08Z", - "aliases": [ - "CVE-2023-33725" - ], - "details": "Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33725" - }, - { - "type": "WEB", - "url": "https://github.com/Contrast-Security-OSS/Burptrast/tree/main/docs/CVE-2023-33725" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file