mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Apache Tomcat's CookieExample Vulnerable to XSS",
|
||||
"details": "Multiple cross-site scripting (XSS) vulnerabilities in `examples/servlet/CookieExample` in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Apache Tomcat Mishandles Character Sequence in Cookies",
|
||||
"details": "Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the `\\\"` character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Apache Tomcat XSS Vulnerabilities in Examples Web Application",
|
||||
"details": "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the `;` character, as demonstrated by a URI containing a `snp/snoop.jsp;` sequence.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -168,9 +166,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-09-22T21:05:33Z",
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-4v48-4q5m-8vx4",
|
||||
"modified": "2022-12-05T22:02:05Z",
|
||||
"published": "2022-12-05T22:01:08Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Prometheus vulnerable to basic authentication bypass",
|
||||
"details": "### Impact\n\nPrometheus can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.\n\nPasswords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.\n\nHowever, a flaw in the way this mechanism was implemented in the [exporter toolkit](https://github.com/prometheus/exporter-toolkit) makes it possible with people who know the hashed password to authenticate against Prometheus.\n\nA request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.\n\n### Patches\n\nPrometheus 2.37.4 ([LTS](https://prometheus.io/docs/introduction/release-cycle/)) and 2.40.4 have been released to address this issue.\n\n### Workarounds\n\nThere is no workaround but attacker must have access to the hashed password, stored in disk, to bypass the authentication.",
|
||||
"severity": [
|
||||
|
||||
@@ -4,9 +4,7 @@
|
||||
"modified": "2023-02-07T23:25:27Z",
|
||||
"published": "2023-01-30T06:30:27Z",
|
||||
"withdrawn": "2023-02-01T20:04:51Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Withdrawn: safeurl-python contains Server-Side Request Forgery",
|
||||
"details": "## Withdrawn\n\nThis advisory has been withdrawn as a duplicate of [GHSA-jgh8-vchw-q3g7](https://github.com/advisories/GHSA-jgh8-vchw-q3g7).\n\n## Original Description\n\nisInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.",
|
||||
"severity": [
|
||||
|
||||
@@ -54,9 +54,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-02-01T01:38:25Z",
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to",
|
||||
"details": "The `redirect_to` method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.\n\nVersions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4\n\n# Impact\n\nThis introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).\n\n# Releases\n\nThe FIXED releases are available at the normal locations.\n\n# Workarounds\n\nAvoid providing user supplied URLs with arbitrary schemes to the `redirect_to` method.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -74,9 +72,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-06-29T15:03:16Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-gpv5-7x3g-ghjv",
|
||||
"modified": "2023-06-15T19:05:13Z",
|
||||
"published": "2023-06-15T19:05:13Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "fast-xml-parser regex vulnerability patch could be improved from a safety perspective",
|
||||
"details": "### Summary\nThis is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it.\n\n### Details\nThe code which validates a name calls the validator:\nhttps://github.com/NaturalIntelligence/fast-xml-parser/blob/ecf6016f9b48aec1a921e673158be0773d07283e/src/xmlparser/DocTypeReader.js#L145-L153\nThis checks for the presence of an invalid character. Such an approach is always risky, as it is so easy to forget to include an invalid character in the list. A safer approach is to validate entity names against the XML specification: https://www.w3.org/TR/xml11/#sec-common-syn - an ENTITY name is a Name:\n\n```\n[4] NameStartChar ::= \":\" | [A-Z] | \"_\" | [a-z] | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF] | [#x370-#x37D] |\n [#x37F-#x1FFF] | [#x200C-#x200D] | [#x2070-#x218F] | [#x2C00-#x2FEF] | [#x3001-#xD7FF] |\n [#xF900-#xFDCF] | [#xFDF0-#xFFFD] | [#x10000-#xEFFFF]\n[4a] NameChar ::= NameStartChar | \"-\" | \".\" | [0-9] | #xB7 | [#x0300-#x036F] | [#x203F-#x2040]\n[5] Name ::= NameStartChar (NameChar)*\n```\n\nso the safest way to validate an entity name is to build a regex to represent this expression and check whether the name given matches the regex. (Something along the lines of `/^[name start char class][name char class]*$/`.) There's probably a nice way to simplify the explicit list rather than typing it out verbatim using Unicode character properties, but I don't know enough to do so.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -59,9 +55,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "LOW",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-06-15T19:05:13Z",
|
||||
|
||||
@@ -4,9 +4,7 @@
|
||||
"modified": "2023-08-01T20:09:43Z",
|
||||
"published": "2023-07-24T18:30:44Z",
|
||||
"withdrawn": "2023-08-01T20:09:43Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Duplicate Advisory: Keylime's registrar vulnerable to Denial-of-service attack via a single open connection",
|
||||
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-pg75-v6fp-8q59. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.",
|
||||
"severity": [
|
||||
@@ -55,9 +53,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-08-01T20:09:43Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-jm77-qphf-c4w8",
|
||||
"modified": "2023-08-01T22:34:41Z",
|
||||
"published": "2023-08-01T22:34:41Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "pyca/cryptography's wheels include vulnerable OpenSSL",
|
||||
"details": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -63,9 +59,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "LOW",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-08-01T22:34:41Z",
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-xqcq-j8w9-3pxv",
|
||||
"modified": "2023-08-01T19:53:16Z",
|
||||
"published": "2023-08-01T19:53:16Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Jettison parser crash by stackoverflow",
|
||||
"details": "Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.\n\n### References\n\n- https://nvd.nist.gov/vuln/detail/CVE-2022-40149\n- https://github.com/jettison-json/jettison/issues/45\n- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538\n- https://github.com/jettison-json/jettison/pull/49/files\n- https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1\n- https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html\n- https://www.debian.org/security/2023/dsa-5312",
|
||||
"severity": [
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-7v4p-328v-8v5g",
|
||||
"modified": "2023-10-17T02:37:42Z",
|
||||
"published": "2023-10-17T02:37:42Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Traefik vulnerable to HTTP/2 request causing denial of service ",
|
||||
"details": "### Impact\n\nA vulnerability CVE-2023-39325 exists in [Go managing HTTP/2 requests](https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ?pli=1), which impacts Traefik. This vulnerability could be exploited to cause a denial of service.\n\n### References\n\n- [CVE-2023-44487](https://www.cve.org/CVERecord?id=CVE-2023-44487)\n- [CVE-2023-39325](https://www.cve.org/CVERecord?id=CVE-2023-39325)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.10.5\n- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta4",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-cfqx-f43m-vfh7",
|
||||
"modified": "2024-10-03T19:46:43Z",
|
||||
"published": "2024-10-03T19:46:42Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "@saltcorn/server arbitrary file and directory listing when accessing build mobile app results",
|
||||
"details": "### Summary\n\nA user with admin permission can read arbitrary file and directory names on the filesystem by calling the `admin/build-mobile-app/result?build_dir_name=` endpoint. The `build_dir_name` parameter is not properly validated and it's then used to construct the `buildDir` that is read. The file/directory names under the `buildDir` will be returned. \n\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/admin.js#L2884-L2893\n\n```js\nrouter.get(\n \"/build-mobile-app/result\",\n isAdmin,\n error_catcher(async (req, res) => {\n const { build_dir_name } = req.query; // [1] source\n const rootFolder = await File.rootFolder();\n const buildDir = path.join(\n rootFolder.location,\n \"mobile_app\",\n build_dir_name // [2]\n );\n const files = await Promise.all(\n fs\n .readdirSync(buildDir) // [3] sink\n .map(async (outFile) => await File.from_file_on_disk(outFile, buildDir))\n );\n [...]\n })\n);\n```\n\n### PoC\n\n- log into the application as an admin user\n- visit the following url: `http://localhost:3000/admin/build-mobile-app/result?build_dir_name=/../../../../../../../../`\n\n\n**NOTE**: it's possible to only see file and directory names but not to download their content.\n\n### Impact\n\nInformation disclosure\n\n### Recommended Mitigation\n\nResolve the `buildDir` and check if it starts with `${rootFolder.location}/mobile_app`.",
|
||||
"severity": [
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user