From 3346f7dc9a5ac5e4c4c8fbb3f8b72bc0f7158fce Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 14 May 2024 22:33:40 +0000 Subject: [PATCH] Publish Advisories GHSA-2q2f-h83x-cx3x GHSA-hf54-fq2m-p9v6 GHSA-2q2f-h83x-cx3x GHSA-hf54-fq2m-p9v6 --- .../GHSA-2q2f-h83x-cx3x.json | 61 +++++++++++++++++ .../GHSA-hf54-fq2m-p9v6.json | 65 +++++++++++++++++++ .../GHSA-2q2f-h83x-cx3x.json | 35 ---------- .../GHSA-hf54-fq2m-p9v6.json | 42 ------------ 4 files changed, 126 insertions(+), 77 deletions(-) create mode 100644 advisories/github-reviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json create mode 100644 advisories/github-reviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json delete mode 100644 advisories/unreviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json delete mode 100644 advisories/unreviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json diff --git a/advisories/github-reviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json b/advisories/github-reviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json new file mode 100644 index 00000000000..ebcede49059 --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2q2f-h83x-cx3x", + "modified": "2024-05-14T22:32:09Z", + "published": "2024-05-14T21:34:44Z", + "aliases": [ + "CVE-2024-31556" + ], + "summary": "Reportico Web fails to invalidate cookies upon logout", + "details": "An issue in Reportico Web before v.8.1.0. This vulnerability arises from the failure of the web application to properly invalidate session cookies upon logout. When a user logs out of the application, the session cookie should be invalidated to prevent unauthorized access. However, due to the oversight in the application's implementation, the session cookie remains active even after logout. Consequently, if an attacker obtains the session cookie, they can exploit it to access the user's session and perform unauthorized actions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "reportico-web/reportico" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "8.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31556" + }, + { + "type": "WEB", + "url": "https://github.com/reportico-web/reportico/issues/53" + }, + { + "type": "PACKAGE", + "url": "https://github.com/reportico-web/reportico" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-613" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T22:32:09Z", + "nvd_published_at": "2024-05-14T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json b/advisories/github-reviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json new file mode 100644 index 00000000000..253e6e06305 --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hf54-fq2m-p9v6", + "modified": "2024-05-14T22:32:03Z", + "published": "2024-05-14T21:34:44Z", + "aliases": [ + "CVE-2020-26312" + ], + "summary": "dotmesh arbitrary file read and/or write", + "details": "Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder. The routine `untarFile` attempts to guard against creating symbolic links that point outside the directory a tar archive is extracted to. However, a malicious tarball first linking `subdir/parent` to `..` (allowed, because `subdir/..` falls within the archive root) and then linking `subdir/parent/escapes` to `..` results in a symbolic link pointing to the tarball’s parent directory, contrary to the routine’s goals. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, they may be able to read arbitrary system files the parent process has permissions to read. As of time of publication, no patch for this issue is available.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/dotmesh-io/dotmesh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.8.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26312" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dotmesh-io/dotmesh" + }, + { + "type": "WEB", + "url": "https://github.com/dotmesh-io/dotmesh/blob/master/pkg/archiver/tar.go#L255" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-254-zipslip-dotmesh" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T22:32:03Z", + "nvd_published_at": "2024-05-14T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json b/advisories/unreviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json deleted file mode 100644 index 242e1a6eb17..00000000000 --- a/advisories/unreviewed/2024/05/GHSA-2q2f-h83x-cx3x/GHSA-2q2f-h83x-cx3x.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2q2f-h83x-cx3x", - "modified": "2024-05-14T21:34:44Z", - "published": "2024-05-14T21:34:44Z", - "aliases": [ - "CVE-2024-31556" - ], - "details": "An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31556" - }, - { - "type": "WEB", - "url": "https://github.com/reportico-web/reportico/issues/53" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-05-14T21:15:12Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json b/advisories/unreviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json deleted file mode 100644 index 52a947be3e3..00000000000 --- a/advisories/unreviewed/2024/05/GHSA-hf54-fq2m-p9v6/GHSA-hf54-fq2m-p9v6.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hf54-fq2m-p9v6", - "modified": "2024-05-14T21:34:44Z", - "published": "2024-05-14T21:34:44Z", - "aliases": [ - "CVE-2020-26312" - ], - "details": "Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsafe handling of symbolic links in an unpacking routine may \nenable attackers to read and/or write to arbitrary locations outside the\n designated target folder. The routine `untarFile` attempts to guard against creating symbolic links that point outside the directory a tar archive is extracted to. However, a malicious tarball first linking `subdir/parent` to `..` (allowed, because `subdir/..` falls within the archive root) and then linking `subdir/parent/escapes` to `..` results in a symbolic link pointing to the tarball’s parent directory, contrary to the routine’s goals. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, they may be able to read arbitrary system files the parent process has permissions to read. As of time of publication, no patch for this issue is available.\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26312" - }, - { - "type": "WEB", - "url": "https://github.com/dotmesh-io/dotmesh/blob/master/pkg/archiver/tar.go#L255" - }, - { - "type": "ADVISORY", - "url": "https://securitylab.github.com/advisories/GHSL-2020-254-zipslip-dotmesh" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-125" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-05-14T21:15:10Z" - } -} \ No newline at end of file