diff --git a/advisories/github-reviewed/2023/12/GHSA-4mq4-7rw3-vm5j/GHSA-4mq4-7rw3-vm5j.json b/advisories/github-reviewed/2023/12/GHSA-4mq4-7rw3-vm5j/GHSA-4mq4-7rw3-vm5j.json new file mode 100644 index 00000000000..bb477e576a7 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-4mq4-7rw3-vm5j/GHSA-4mq4-7rw3-vm5j.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4mq4-7rw3-vm5j", + "modified": "2023-12-13T13:32:38Z", + "published": "2023-12-13T13:32:38Z", + "aliases": [ + + ], + "summary": "Filesystem sandbox not enforced", + "details": "### Summary\nAs of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox.\n\n### Details\nhttps://github.com/wasmerio/wasmer/issues/4267\n\n### PoC\nA minimal Rust program:\n\n```\nfn main() {\n let f = std::fs::OpenOptions::new()\n .write(true)\n .create_new(true)\n .open(\"abc\")\n .unwrap();\n}\n```\n\nThis should be compiled with `cargo build --target wasm32-wasi`. The compiled program, when run with wasmer WITHOUT `--dir`, can still create a file in the working directory.\n\n### Impact\nService providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "wasmer-cli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "4.2.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j" + }, + { + "type": "WEB", + "url": "https://github.com/wasmerio/wasmer/issues/4267" + }, + { + "type": "PACKAGE", + "url": "https://github.com/wasmerio/wasmer" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-12-13T13:32:38Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-59c9-pxq8-9c73/GHSA-59c9-pxq8-9c73.json b/advisories/github-reviewed/2023/12/GHSA-59c9-pxq8-9c73/GHSA-59c9-pxq8-9c73.json new file mode 100644 index 00000000000..08a8b105dee --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-59c9-pxq8-9c73/GHSA-59c9-pxq8-9c73.json @@ -0,0 +1,164 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59c9-pxq8-9c73", + "modified": "2023-12-13T13:33:57Z", + "published": "2023-12-13T13:33:57Z", + "aliases": [ + + ], + "summary": "Improper JWT Signature Validation in SAP Security Services Library ", + "details": "### Impact\nSAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n### Patches\nUpgrade to patched version >= 2.17.0 or >= 3.3.0 \nWe always recommend to upgrade to the latest released version.\n\n### Workarounds\nNo workarounds\n\n### References\nhttps://www.cve.org/CVERecord?id=CVE-2023-50422\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.sap.cloud.security:java-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.17.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.sap.cloud.security:java-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.3.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.sap.cloud.security:spring-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.17.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.sap.cloud.security:spring-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.3.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.sap.cloud.security.xsuaa:spring-xsuaa" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.17.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.sap.cloud.security.xsuaa:spring-xsuaa" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.3.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73" + }, + { + "type": "WEB", + "url": "https://github.com/SAP/cloud-security-services-integration-library/commit/4b3e42ab23df6418243b29908b1a2582818d9360" + }, + { + "type": "WEB", + "url": "https://github.com/SAP/cloud-security-services-integration-library/commit/7ce9601979c30ae269a1cbaf7cf33486d10736f1" + }, + { + "type": "WEB", + "url": "https://en.wikipedia.org/wiki/JSON_Web_Token" + }, + { + "type": "PACKAGE", + "url": "https://github.com/SAP/cloud-security-services-integration-library" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2023-12-13T13:33:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-cxfr-5q3r-2rc2/GHSA-cxfr-5q3r-2rc2.json b/advisories/github-reviewed/2023/12/GHSA-cxfr-5q3r-2rc2/GHSA-cxfr-5q3r-2rc2.json similarity index 61% rename from advisories/unreviewed/2023/12/GHSA-cxfr-5q3r-2rc2/GHSA-cxfr-5q3r-2rc2.json rename to advisories/github-reviewed/2023/12/GHSA-cxfr-5q3r-2rc2/GHSA-cxfr-5q3r-2rc2.json index bed7c3cf111..88ad99c3907 100644 --- a/advisories/unreviewed/2023/12/GHSA-cxfr-5q3r-2rc2/GHSA-cxfr-5q3r-2rc2.json +++ b/advisories/github-reviewed/2023/12/GHSA-cxfr-5q3r-2rc2/GHSA-cxfr-5q3r-2rc2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cxfr-5q3r-2rc2", - "modified": "2023-12-12T06:30:43Z", + "modified": "2023-12-13T13:33:30Z", "published": "2023-12-12T06:30:43Z", "aliases": [ "CVE-2023-6709" ], + "summary": "Jinja2 template injection in mlflow", "details": "Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mlflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/mlflow/mlflow/commit/432b8ccf27fd3a76df4ba79bb1bec62118a85625" }, + { + "type": "PACKAGE", + "url": "https://github.com/mlflow/mlflow" + }, { "type": "WEB", "url": "https://huntr.com/bounties/9e4cc07b-6fff-421b-89bd-9445ef61d34d" @@ -35,8 +58,8 @@ "CWE-1336" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-13T13:33:30Z", "nvd_published_at": "2023-12-12T04:15:07Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-ff5x-7qg5-vwf2/GHSA-ff5x-7qg5-vwf2.json b/advisories/github-reviewed/2023/12/GHSA-ff5x-7qg5-vwf2/GHSA-ff5x-7qg5-vwf2.json new file mode 100644 index 00000000000..50cac1bad25 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-ff5x-7qg5-vwf2/GHSA-ff5x-7qg5-vwf2.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ff5x-7qg5-vwf2", + "modified": "2023-12-13T13:32:21Z", + "published": "2023-12-13T13:32:21Z", + "aliases": [ + "CVE-2023-50251" + ], + "summary": "Denial of service caused by infinite recursion when parsing SVG document", + "details": "### Summary\nWhen parsing the attributes passed to a `use` tag inside an svg document, we can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself.\n\n### Details\nInside `Svg\\Tag\\UseTag::before`, php-svg-lib parses the attributes passed to an `use` tag inside an svg document. When it finds a `href` or `xlink:href`, it will try to retrieve the object representing this tag:\n\n```\n$link = $attributes[\"href\"] ?? $attributes[\"xlink:href\"];\n$this->reference = $document->getDef($link);\n\nif ($this->reference) {\n $this->reference->before($attributes);\n}\n```\n\n`$document->getDef` is implemented as follow:\n\n```\npublic function getDef($id) {\n $id = ltrim($id, \"#\");\n\n return isset($this->defs[$id]) ? $this->defs[$id] : null;\n}\n```\n\n_Note:_ the `$id` in the above method is actually the _link_ being used in `use` tag. This part is important, because this behaviour here actually leads to the vulnerability. It will be mentioned later on in this report.\n\nIf it finds the referenced object, it will try to call the `before` method on the referenced object (this is still inside `Svg\\Tag\\UseTag::before`) :\n\n```\nif ($this->reference) {\n $this->reference->before($attributes);\n}\n```\n\nIn order to cause an infinte loop, we need to be able to control the `$id` used in the `$this->defs[$id]` code above. This `defs` property (`Svg\\Document::defs`) is being populated when `Svg\\Document::_tagStart` is called. This is the handler being used when the php-svg-lib is parsing the svg structure:\n\n```\n// Svg\\Document line 343\nif ($tag) {\n if (isset($attributes[\"id\"])) {\n $this->defs[$attributes[\"id\"]] = $tag;\n }\n else {\n // ...\n }\n\n // ...\n}\n```\n\nSo if the `use` tag contains an `id`, then that `use` tag will be added to the `$defs` array with it's `id` as the key.\n\nNow as noted before, when there is a link inside the `use` tag, the library uses that link as the `id` to actually find the object or `tag` that has been added to the `Svg\\Document::defs`.\n\nSo if the `id` attribute is equal to the link attribute inside the `use` tag, then the referenced object (in this case it is the `Use` tag object) will be called recursively until the memory given to the script is exhausted.\n\n### PoC\n\nThis is an example svg file that can be used to demonstrate the vulnerability.\n\n```\n\n \n\n```\n\n### Impact\n\nWhen the lib parses the above payload, it will crash:\n\n```\nPHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 262144 bytes) in /xxx/dompdf/vendor/phenx/php-svg-lib/src/Svg/Tag/UseTag.php on line 37\n```\n\nAn attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phenx/php-svg-lib" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.5.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-ff5x-7qg5-vwf2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50251" + }, + { + "type": "WEB", + "url": "https://github.com/dompdf/php-svg-lib/commit/88163cbe562d9b391b3a352e54d9c89d02d77ee0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dompdf/php-svg-lib" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-674" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-13T13:32:21Z", + "nvd_published_at": "2023-12-12T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-rv74-m283-5j95/GHSA-rv74-m283-5j95.json b/advisories/github-reviewed/2023/12/GHSA-rv74-m283-5j95/GHSA-rv74-m283-5j95.json new file mode 100644 index 00000000000..c51be043660 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-rv74-m283-5j95/GHSA-rv74-m283-5j95.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rv74-m283-5j95", + "modified": "2023-12-13T13:33:04Z", + "published": "2023-12-05T18:30:23Z", + "aliases": [ + "CVE-2023-46674" + ], + "summary": "Elasticsearch-hadoop Unsafe Deserialization", + "details": "An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.elasticsearch:elasticsearch-hadoop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.17.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.elasticsearch:elasticsearch-hadoop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46674" + }, + { + "type": "WEB", + "url": "https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663" + }, + { + "type": "PACKAGE", + "url": "https://github.com/elastic/elasticsearch-hadoop" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-13T13:33:04Z", + "nvd_published_at": "2023-12-05T18:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-rv74-m283-5j95/GHSA-rv74-m283-5j95.json b/advisories/unreviewed/2023/12/GHSA-rv74-m283-5j95/GHSA-rv74-m283-5j95.json deleted file mode 100644 index c69e6ae519f..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-rv74-m283-5j95/GHSA-rv74-m283-5j95.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rv74-m283-5j95", - "modified": "2023-12-05T18:30:23Z", - "published": "2023-12-05T18:30:23Z", - "aliases": [ - "CVE-2023-46674" - ], - "details": "An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46674" - }, - { - "type": "WEB", - "url": "https://discuss.elastic.co/t/elasticsearch-hadoop-7-17-11-8-9-0-security-update-esa-2023-28/348663" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-05T18:15:12Z" - } -} \ No newline at end of file