From 3390462c7e45a86e1c27f9c91e64a1bf2588d814 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 18 Dec 2024 15:51:54 +0000 Subject: [PATCH] Publish Advisories GHSA-2ff4-xfpr-m32r GHSA-m56h-5xx3-2jc2 --- .../GHSA-2ff4-xfpr-m32r.json | 71 ++++++++++ .../GHSA-m56h-5xx3-2jc2.json | 128 ++++++++++++++++++ 2 files changed, 199 insertions(+) create mode 100644 advisories/github-reviewed/2024/12/GHSA-2ff4-xfpr-m32r/GHSA-2ff4-xfpr-m32r.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-m56h-5xx3-2jc2/GHSA-m56h-5xx3-2jc2.json diff --git a/advisories/github-reviewed/2024/12/GHSA-2ff4-xfpr-m32r/GHSA-2ff4-xfpr-m32r.json b/advisories/github-reviewed/2024/12/GHSA-2ff4-xfpr-m32r/GHSA-2ff4-xfpr-m32r.json new file mode 100644 index 00000000000..1d4f7384184 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-2ff4-xfpr-m32r/GHSA-2ff4-xfpr-m32r.json @@ -0,0 +1,71 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2ff4-xfpr-m32r", + "modified": "2024-12-18T15:51:24Z", + "published": "2024-12-18T15:51:24Z", + "aliases": [], + "summary": "`Slip10Like` derivation method instantiated with certain curves may allow attacker to find derivation path which results into very long derivation (possible DoS)", + "details": "### Impact\n\n\n**Impacted are the only ones who use [`hd_wallet::Slip10Like`](https://docs.rs/hd-wallet/0.5.1/hd_wallet/struct.Slip10Like.html) or [`slip_10`](https://docs.rs/slip-10/latest/slip_10/) derivation method instantiated with curves other than secp256k1 and secp256r1.**\n\n`hd_wallet` crate used to provide `Slip10Like` derivation method, which is also provided in `slip-10` crate as a default derivation method. It's based on [slip10](https://github.com/satoshilabs/slips/blob/master/slip-0010.md) method that searches for a valid child key in an infinite loop until it's found.\n\nTheoretically, this could be exploited by an attacker by finding a derivation path that would force someone to execute a lot of iterations of this loop to find a valid child key. This attack, however, requires the probability of getting an invalid scalar from random 32 bytes to be high. Slip10 is protected from this attack as it's only defined on secp256k1 and secp256r1 curves, for which such probability is very low:\n\n- For secp256k1, probability is $< 2^{-127}$. This means that a loop with 2 or more iterations is vanishingly impossible.\n- For secp256r1, probability is $< 2^{-32}$. This means that a loop with 5 or more iterations is vanishingly impossible.\n\nWhile standard curves are safe to use with slip10, we used to allow slip10-like derivation which can be instantiated with any curve. For instance, one could instantiate it with ed25519 or stark curves, for which probability of getting invalid scalar from random 32 bytes is >90%, so theoretically, attacker could try to DoS such construction.\n\n### Patches\n\n\n`hd_wallet v0.6.0` has been patched by removing slip10-like derivation from public API.\n\nIf you need HD derivation on other curves than secp256k1 and secp256r1, we suggest you to use:\n* [`hd_wallet::Edwards`](https://docs.rs/hd-wallet/latest/hd_wallet/edwards/struct.Edwards.html) derivation method available for ed25519 curve\n* [`hd_wallet::Stark`](https://docs.rs/hd-wallet/latest/hd_wallet/stark/struct.Stark.html) derivation method available for stark curve\n\nBoth derivation methods are non-standard, but secure and efficient.\n\n**If you're still using `slip_10`** and would like to migrate to patched version, please migrate to `hd_wallet v0.6`. You may first migrate from `slip_10 v0.4` to `hd_wallet v0.5` by following migration instructions available [in the docs](https://docs.rs/slip-10/latest/slip_10/), and then upgrade from `hd_wallet v0.5` to `hd_wallet v0.6`.\n\n### Workarounds\nTechnically, you don't need to upgrade if you don't use slip10-like derivation instantiated with other curves than secp256k1 or secp256r1.\n\nHowever, if you do, migrating to other derivation method might be required.\n\n### Reach out to us in Discord\n\nIf you want to reach out to us, feel free to write to [`#lockness` room in Discord](https://discordapp.com/channels/905194001349627914/1294284489635139585)\n\n### Credits\n\nThanks to Alessio Marziali for discovering and flagging this issue", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "hd-wallet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.6.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "slip-10" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/LFDT-Lockness/hd-wallet/security/advisories/GHSA-2ff4-xfpr-m32r" + }, + { + "type": "WEB", + "url": "https://github.com/LFDT-Lockness/hd-wallet/commit/a7e37704600ee7c737dbb02db08814dd2d15389d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/LFDT-Lockness/hd-wallet" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-18T15:51:24Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-m56h-5xx3-2jc2/GHSA-m56h-5xx3-2jc2.json b/advisories/github-reviewed/2024/12/GHSA-m56h-5xx3-2jc2/GHSA-m56h-5xx3-2jc2.json new file mode 100644 index 00000000000..145196ef641 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-m56h-5xx3-2jc2/GHSA-m56h-5xx3-2jc2.json @@ -0,0 +1,128 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m56h-5xx3-2jc2", + "modified": "2024-12-18T15:50:10Z", + "published": "2024-12-18T15:50:09Z", + "aliases": [], + "summary": "Prototype pollution in jsii.configureCategories", + "details": "## Summary\n\n`jsii` is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library.\nWhen loaded as a library into a larger application, prototype pollution may happen if untrusted user input is passed to the library. When used as a command line-tool, this pollution cannot occur.\n\n## Impact\n\nYou may be impacted if you have written an application that loads jsii as a library, and passes untrusted user input into the `jsii.configureCategories()` function. In that case, a user can craft input in such a way that, following the invocation, a field named \"category\" with a user-controlled value is added to the JavaScript Object prototype. This will cause every object in the program (both new and existing) to have a field named \"category\", even if it shouldn't. \n\n**This will not affect jsii itself, but it might affect the application you have loaded jsii into.**\n\n> The function `jsii.configureCategories()` is used to configure the severity (error, warning, etc.) of various jsii diagnostics.\n\n**Impacted versions: <=5.7.2, <=5.6.3, <=5.5.14, <=5.4.45** \n\n**Example:**\n\n```js\nconst jsii = require('jsii');\n\n// prints 'undefined'\nconsole.log(JSON.stringify({}.category))\n\n// calling 'configureCategories' with user input\njsii.configureCategories(JSON.parse('{\"__proto__\": \"user-input\"}'))\n\n// from this point onwards, every single object literal in the program\n// will contain the 'category' key, with user controlled value\nconsole.log(JSON.stringify({}.category)) // prints 'user-input'\n\n\n// this can affect the execution of the main program in case it also makes \n// use of an object key called 'category'. for example, if the main programs \n// happens to have code like this:\n\nconst x = {} // some object in the main program (not necessarily empty)\n\nif (x.category) {\n // this block will always be executed, effectively \n // changing the behavior of the main program.\n console.log('Do something')\n} else {\n console.log('Do something else')\n}\n```\n\nFor more information about javascript prototype pollution, see [1].\n\n## Patches\n\nA patch is included in versions [5.7.3](https://github.com/aws/jsii-compiler/releases/tag/v5.7.3), [5.6.4](https://github.com/aws/jsii-compiler/releases/tag/v5.6.4), [5.5.15](https://github.com/aws/jsii-compiler/releases/tag/v5.5.15), [5.4.46](https://github.com/aws/jsii-compiler/releases/tag/v5.4.46)\n\n## Workarounds\n\nSanitize user input to configureCategories() by stripping the __proto__ property if detected.\n\n## References\n\nIf you have any questions or comments about this advisory, we ask that you contact AWS/Amazon Security via our issue reporting page [2] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://learn.snyk.io/lesson/prototype-pollution/\n\n[2] [https://aws.amazon.com/security/issue-reporting](https://aws.amazon.com/security/vulnerability-reporting)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "jsii" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.7.0" + }, + { + "fixed": "5.7.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "jsii" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.6.0" + }, + { + "fixed": "5.6.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "jsii" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.5.0" + }, + { + "fixed": "5.5.15" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "jsii" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.4.0" + }, + { + "fixed": "5.4.46" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aws/jsii-compiler/security/advisories/GHSA-m56h-5xx3-2jc2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aws/jsii-compiler" + }, + { + "type": "WEB", + "url": "https://github.com/aws/jsii-compiler/releases/tag/v5.4.46" + }, + { + "type": "WEB", + "url": "https://github.com/aws/jsii-compiler/releases/tag/v5.5.15" + }, + { + "type": "WEB", + "url": "https://github.com/aws/jsii-compiler/releases/tag/v5.6.4" + }, + { + "type": "WEB", + "url": "https://github.com/aws/jsii-compiler/releases/tag/v5.7.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-12-18T15:50:09Z", + "nvd_published_at": null + } +} \ No newline at end of file