From 383d7f8e727eb8da1485101d868a106eda7ef6e6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 9 Apr 2025 12:59:06 +0000 Subject: [PATCH] Publish Advisories GHSA-3f7v-qx94-666m GHSA-9r25-rp3p-h2w4 GHSA-fmhh-rw3h-785m GHSA-q7rw-w4cq-2j6w --- .../GHSA-3f7v-qx94-666m.json | 57 ++++++++++++++++ .../GHSA-9r25-rp3p-h2w4.json | 61 +++++++++++++++++ .../GHSA-fmhh-rw3h-785m.json | 65 +++++++++++++++++++ .../GHSA-q7rw-w4cq-2j6w.json | 65 +++++++++++++++++++ 4 files changed, 248 insertions(+) create mode 100644 advisories/github-reviewed/2025/04/GHSA-3f7v-qx94-666m/GHSA-3f7v-qx94-666m.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-9r25-rp3p-h2w4/GHSA-9r25-rp3p-h2w4.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-fmhh-rw3h-785m/GHSA-fmhh-rw3h-785m.json create mode 100644 advisories/github-reviewed/2025/04/GHSA-q7rw-w4cq-2j6w/GHSA-q7rw-w4cq-2j6w.json diff --git a/advisories/github-reviewed/2025/04/GHSA-3f7v-qx94-666m/GHSA-3f7v-qx94-666m.json b/advisories/github-reviewed/2025/04/GHSA-3f7v-qx94-666m/GHSA-3f7v-qx94-666m.json new file mode 100644 index 00000000000..ff55e28650f --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-3f7v-qx94-666m/GHSA-3f7v-qx94-666m.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3f7v-qx94-666m", + "modified": "2025-04-09T12:58:28Z", + "published": "2025-04-09T12:58:28Z", + "aliases": [ + "CVE-2025-32372" + ], + "summary": "DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)", + "details": "A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks.\n\n### Impact\n\nThis vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "DotNetNuke.Core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.13.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3f7v-qx94-666m" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dnnsoftware/Dnn.Platform" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T12:58:28Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-9r25-rp3p-h2w4/GHSA-9r25-rp3p-h2w4.json b/advisories/github-reviewed/2025/04/GHSA-9r25-rp3p-h2w4/GHSA-9r25-rp3p-h2w4.json new file mode 100644 index 00000000000..e0914d7f4cf --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-9r25-rp3p-h2w4/GHSA-9r25-rp3p-h2w4.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9r25-rp3p-h2w4", + "modified": "2025-04-09T12:57:13Z", + "published": "2025-04-09T12:57:13Z", + "aliases": [ + "CVE-2025-32020" + ], + "summary": "crud-query-parser SQL Injection vulnerability", + "details": "### Impact\n\nImproper neutralization of the `order`/`sort` parameter in the TypeORM adapter, which allows SQL injection.\n\nYou are impacted by this vulnerability if you are using the TypeORM adapter, ordering is enabled and you have not set-up a property filter.\n\nVersions 0.0.1, 0.0.2 and 0.0.3 are affected by this vulnerability.\n\n### Patches\n\nThis vulnerability has been fixed in version 0.1.0 and newer, which introduces TypeORM field validation (enabled by default).\n\n### Workarounds\n\n#### Add an allowlist of fields\nList all valid fields and use the `filterProperties` function to filter out invalid fields before passing the crudRequest to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest = filterProperties(crudRequest, ['id', 'title', 'category.name']);\n```\n\n#### Disable ordering\nCleanup the `order` field just before passing it to the `TypeOrmQueryAdapter`. Here's an example:\n```ts\ncrudRequest.order = [];\n```", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "crud-query-parser" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Guichaguri/crud-query-parser/security/advisories/GHSA-9r25-rp3p-h2w4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32020" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Guichaguri/crud-query-parser" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T12:57:13Z", + "nvd_published_at": "2025-04-08T15:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-fmhh-rw3h-785m/GHSA-fmhh-rw3h-785m.json b/advisories/github-reviewed/2025/04/GHSA-fmhh-rw3h-785m/GHSA-fmhh-rw3h-785m.json new file mode 100644 index 00000000000..5dde6ffd7fd --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-fmhh-rw3h-785m/GHSA-fmhh-rw3h-785m.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fmhh-rw3h-785m", + "modified": "2025-04-09T12:57:56Z", + "published": "2025-04-09T12:57:56Z", + "aliases": [ + "CVE-2025-32025" + ], + "summary": "bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing", + "details": "### Impact\n\nThe buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before `v0.11.0`, If you didn't trust the input images, this could be abused to construct denial-of-service attacks.\n\n### Patches\n\n`v0.11.0` added a 10 MB upper limit.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/bep/imagemeta" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.11.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/bep/imagemeta/security/advisories/GHSA-fmhh-rw3h-785m" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32025" + }, + { + "type": "WEB", + "url": "https://github.com/bep/imagemeta/commit/ee0de9b029f4e82106729f69559f27c9a404229d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/bep/imagemeta" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T12:57:56Z", + "nvd_published_at": "2025-04-08T16:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-q7rw-w4cq-2j6w/GHSA-q7rw-w4cq-2j6w.json b/advisories/github-reviewed/2025/04/GHSA-q7rw-w4cq-2j6w/GHSA-q7rw-w4cq-2j6w.json new file mode 100644 index 00000000000..570b3067fcc --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-q7rw-w4cq-2j6w/GHSA-q7rw-w4cq-2j6w.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7rw-w4cq-2j6w", + "modified": "2025-04-09T12:57:44Z", + "published": "2025-04-09T12:57:44Z", + "aliases": [ + "CVE-2025-32024" + ], + "summary": "bep/imagemeta allows excessively large EXIF data structures", + "details": "### Impact\nThe EXIF data format allows for defining excessively large data structures in relatively small payloads. Before `v0.10.0`, If you didn't trust the input images, this could be abused to construct denial-of-service attacks.\n\n### Patches\n`v0.10.0` added LimitNumTags (default 5000) and LimitTagSize (default 10000) options.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/bep/imagemeta" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/bep/imagemeta/security/advisories/GHSA-q7rw-w4cq-2j6w" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32024" + }, + { + "type": "WEB", + "url": "https://github.com/bep/imagemeta/commit/4fd89616d8bf7f9bb892360d3fb19080ec2b4602" + }, + { + "type": "PACKAGE", + "url": "https://github.com/bep/imagemeta" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-09T12:57:44Z", + "nvd_published_at": "2025-04-08T16:15:27Z" + } +} \ No newline at end of file