From 3d3e9ab25a52a1916c880cb7d9b33cba70a2c2b3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 3 Jan 2024 20:07:37 +0000 Subject: [PATCH] Publish Advisories GHSA-5crp-9r3c-p9vr GHSA-7xg2-83f8-39mr GHSA-8rfx-6mr3-5jh3 --- .../GHSA-5crp-9r3c-p9vr.json | 4 +- .../GHSA-7xg2-83f8-39mr.json | 70 +++++++++++++++++++ .../GHSA-8rfx-6mr3-5jh3.json | 34 +++++++-- 3 files changed, 99 insertions(+), 9 deletions(-) create mode 100644 advisories/github-reviewed/2024/01/GHSA-7xg2-83f8-39mr/GHSA-7xg2-83f8-39mr.json rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json (51%) diff --git a/advisories/github-reviewed/2022/06/GHSA-5crp-9r3c-p9vr/GHSA-5crp-9r3c-p9vr.json b/advisories/github-reviewed/2022/06/GHSA-5crp-9r3c-p9vr/GHSA-5crp-9r3c-p9vr.json index 0c01210c2a5..7b969d1ad50 100644 --- a/advisories/github-reviewed/2022/06/GHSA-5crp-9r3c-p9vr/GHSA-5crp-9r3c-p9vr.json +++ b/advisories/github-reviewed/2022/06/GHSA-5crp-9r3c-p9vr/GHSA-5crp-9r3c-p9vr.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-5crp-9r3c-p9vr", - "modified": "2022-12-08T16:42:36Z", + "modified": "2024-01-03T20:06:36Z", "published": "2022-06-22T15:08:47Z", "aliases": [ - + "CVE-2024-21907" ], "summary": "Improper Handling of Exceptional Conditions in Newtonsoft.Json", "details": "Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS). \n\nThe serialization and deserialization path have different properties regarding the issue.\n\nDeserializing methods (like `JsonConvert.DeserializeObject`) will process the input that results in burning the CPU, allocating memory, and consuming a thread of execution. Quite high nesting level (>10kk, or 9.5MB of `{a:{a:{...` input) is needed to achieve the latency over 10 seconds, depending on the hardware.\n\nSerializing methods (like `JsonConvert.Serialize` or `JObject.ToString`) will throw StackOverFlow exception with the nesting level of around 20k.\n\nTo mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set `MaxDepth` parameter in the `JsonSerializerSettings`. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with `Newtonsoft.Json.JsonReaderException`:\n\n``` \nJsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };\n```\n\nRepro code:\n```\n//Create a string representation of an highly nested object (JSON serialized)\nint nRep = 25000;\nstring json = string.Concat(Enumerable.Repeat(\"{a:\", nRep)) + \"1\" +\n string.Concat(Enumerable.Repeat(\"}\", nRep));\n\n//Parse this object (leads to high CPU/RAM consumption)\nvar parsedJson = JsonConvert.DeserializeObject(json);\n\n// Methods below all throw stack overflow with nRep around 20k and higher\n// string a = parsedJson.ToString();\n// string b = JsonConvert.SerializeObject(parsedJson);\n```\n\n### Additional affected product and version information\n**The original statement about the problem only affecting IIS applications is misleading.** Any application is affected, however the IIS has a behavior that stops restarting the instance after some time resulting in a harder-to-fix DoS.**", diff --git a/advisories/github-reviewed/2024/01/GHSA-7xg2-83f8-39mr/GHSA-7xg2-83f8-39mr.json b/advisories/github-reviewed/2024/01/GHSA-7xg2-83f8-39mr/GHSA-7xg2-83f8-39mr.json new file mode 100644 index 00000000000..649a9fb8131 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-7xg2-83f8-39mr/GHSA-7xg2-83f8-39mr.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xg2-83f8-39mr", + "modified": "2024-01-03T20:06:51Z", + "published": "2024-01-03T20:06:51Z", + "aliases": [ + + ], + "summary": "The DES/3DES cipher was used as part of the TLS protocol by installation tools", + "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe Karmada components deployed with `karmadactl`, `karma-operator`, and `helm chart` take Golang default cipher suites as part of the TLS protocol, which includes the insecure algorithm. Referring to https://github.com/golang/go/issues/41476#issuecomment-694914728, the 3DES algorithm vulnerability is very unlikely to be attacked. However, to address the concerns and to avoid being disturbed by the security scanner, Karmada has decided to limit the cipher suites to exclude the insecure 3DES algorithm and accordingly release this security advisory.\n\nThe components affected areļ¼š\n- karmada-apiserver\n- karmada-aggregated-apiserver\n- karmada-search\n- karmada-metrics-adapter\n- etcd\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFrom Karmada v1.8.0, when deploying Karmada with `karmadactl`, `karma-operator`, and `helm chart`, the default minimum TLS version of components(include `karmada-apiserver`, `karmada-aggregated-apiserver`, `karmada-search`, and `karmada-metrics-adapter`) would be set to `TLS1.3` to get rid of the insecure algorithm, and set default cipher suites(`TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305`) for `etcd`.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nBy setting the `--tls-min-version` for the affected components to TLS 1.3, or explicitly setting the `--cipher-suites` to secure algorithms.\n\n### References\n_Are there any links users can visit to find out more?_\n\n1. Enhancements made from the Karmada community: https://github.com/karmada-io/karmada/issues/4191\n2. Impact discussions from the Golang community: https://github.com/golang/go/issues/41476", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/karmada-io/karmada" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/karmada-io/karmada/security/advisories/GHSA-7xg2-83f8-39mr" + }, + { + "type": "WEB", + "url": "https://github.com/golang/go/issues/41476" + }, + { + "type": "WEB", + "url": "https://github.com/karmada-io/karmada/issues/4191" + }, + { + "type": "WEB", + "url": "https://github.com/karmada-io/karmada/commit/98e655fc552b2987c3f2d2a061007889ce8be536" + }, + { + "type": "WEB", + "url": "https://github.com/karmada-io/karmada/commit/c3c376605403e07ca0ed2dc39c9e0f3c38f8e29d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/karmada-io/karmada" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T20:06:51Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json b/advisories/github-reviewed/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json similarity index 51% rename from advisories/unreviewed/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json rename to advisories/github-reviewed/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json index f9d0a0633df..f9240519a74 100644 --- a/advisories/unreviewed/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json +++ b/advisories/github-reviewed/2024/01/GHSA-8rfx-6mr3-5jh3/GHSA-8rfx-6mr3-5jh3.json @@ -1,17 +1,37 @@ { "schema_version": "1.4.0", "id": "GHSA-8rfx-6mr3-5jh3", - "modified": "2024-01-03T18:30:51Z", + "modified": "2024-01-03T20:06:13Z", "published": "2024-01-03T18:30:51Z", + "withdrawn": "2024-01-03T20:06:13Z", "aliases": [ - "CVE-2024-21907" + ], - "details": "Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.\n", + "summary": "Duplicate Advisory: Improper Handling of Exceptional Conditions in Newtonsoft.Json", + "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5crp-9r3c-p9vr. This link is maintained to preserve external references.\n\n### Original Description\nNewtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.\n", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "NuGet", + "name": "Newtonsoft.Json" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "13.0.1" + } + ] + } + ] + } ], "references": [ { @@ -55,9 +75,9 @@ "cwe_ids": [ "CWE-755" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T20:06:13Z", "nvd_published_at": "2024-01-03T16:15:08Z" } } \ No newline at end of file