Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-03 05:03:22 +00:00
parent e4083b5b35
commit 3fb096e006
932 changed files with 1847 additions and 5541 deletions
@@ -3,9 +3,7 @@
  "id": "GHSA-3w6p-8f82-gw8r",
  "modified": "2021-12-17T20:34:04Z",
  "published": "2021-12-17T20:42:38Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Using JMSAppender in log4j configuration may lead to deserialization of untrusted data",
  "details": "### Impact\n\nClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.\n\n### Patches\n\nThe patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`.\n\n### Workarounds\n\n1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker\n2. Alternatively, you can issue below command to remove `JMSAppender.class`:\n\n```(bash)\n# install zip command if you don't have\napt-get update && apt-get install -y zip\n# remove the class\nzip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class\n```\n\n### References\n\nPlease refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please feel free to open an issue in the repository.\n",
  "severity": [
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-17T18:48:40Z",
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-17T18:40:51Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-hwvm-vfw8-93mw",
  "modified": "2021-12-16T18:40:26Z",
  "published": "2021-12-16T18:53:32Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Vulnerable dependency in XTDB connector",
  "details": "### Impact\n\nThe impacted portion of the XTDB connector is its connectivity to S3 as a backing store: this is the only portion of the connector that uses this vulnerable `httpclient` dependency. Per the description, the vulnerability regards URIs that may be misinterpreted, which given the area of impact within the connector we understand to be any URI used to configure connectivity to S3. Note therefore that if you do not use or configure S3 as a backing store in your use of the connector, you should not be exposed to any vulnerability from this component.\n\n### Patches\n\nThe problem has been addressed in version 4.5.13 of the httpclient library, which is included as a replacement dependency version for the build of the XTDB connector from release 3.5 onwards. Therefore, using release 3.5 (or newer) of the connector will include the fixes to address this CVE.\n\n### Workarounds\n\nWe have not investigated specific workarounds, but per the description of the issue it seems likely that ensuring the proper URIs are used for any S3 connectivity used by the connector (and ensuring there are appropriate controls around modifying such URIs in the connector's configuration) would be the first point of investigation.\n\n### References\n\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-13956",
  "severity": [
@@ -54,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-16T18:40:26Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-j5qg-w9jg-3wg3",
  "modified": "2021-12-16T15:47:47Z",
  "published": "2021-12-16T18:53:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Inability to de-op players if listed in ops.txt with non-lowercase letters",
  "details": "### Impact\nOriginally reported in iTXTech/Genisys#1188\n\n```txt\nPotterHarry98\npotterharry98\n```\n\n`deop PotterHarry98`\n\nwill remove `potterharry98` from the ops.txt but not `PotterHarry98`.\n\nOperator permissions are checked using `Config->exists()` with `lowercase=true`, which will result in a match:\nhttps://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449\n\nThis means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.\n\n### Patches\n4d37b79ff7f9d9452e988387f97919a9a1c4954e\n\n### Workarounds\nThis can be easily addressed by removing the offending lines from ops.txt manually.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n",
  "severity": [
@@ -58,9 +56,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-16T15:47:47Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-j7c3-96rf-jrrp",
  "modified": "2021-12-16T18:57:47Z",
  "published": "2021-12-16T21:01:51Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Critical vulnerability in log4j may affect generated PEAR projects",
  "details": "### Impact\nUIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.\n\n### Patches\n- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version >= `2.0.1` for generating new PEAR projects.\n\n- Existing maven PEAR projects can be patched by manually upgrading to `log4j` >= `2.16.0` in `pom.xml`.\n\n\n### References\nhttps://www.lunasec.io/docs/blog/log4j-zero-day/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/averbis/pear-archetype/issues\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -50,9 +46,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-16T18:57:47Z",
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-17T19:11:26Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-qq97-vm5h-rrhg",
  "modified": "2023-02-09T15:29:32Z",
  "published": "2022-02-08T18:53:56Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "OCI Manifest Type Confusion Issue",
  "details": "### Impact\n\nSystems that rely on digest equivalence for image attestations may be vulnerable to type confusion.\n\n### Patches\n\nUpgrade to at least `v2.8.0-beta.1`  if you are running `v2.x` release. If you use the code from the `main` branch, update at least to the commit after [b59a6f827947f9e0e67df0cfb571046de4733586](https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586).\n\n### Workarounds\n\nThere is no way to work around this issue without patching.\n\n### References\n\nDue to [an oversight in the OCI Image Specification](https://github.com/opencontainers/image-spec/pull/411) that removed the embedded `mediaType` field from manifests, a maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image’s digest by modifying the `Content-Type` header returned by a registry. This can invalidate a common pattern of relying on container image digests for equivalence.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [distribution](https://github.com/distribution/distribution) \n* Open an issue in [distribution-spec](https://github.com/opencontainers/distribution-spec) \n* Email us at [cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io)\n",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet Arbitrary Command Execution",
  "details": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -165,9 +165,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T23:00:10Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Symfony Allows URI Restrictions Bypass Via Double-Encoded String",
  "details": "On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.\n\nBoth the Routing component and the Security component uses the path returned by `getPathInfo()` to match a Request. The `getPathInfo()` returns a decoded path, but the Routing component (`Symfony\\Component\\Routing\\Matcher\\UrlMatcher`) decodes the path a second time; whereas the Security component, `Symfony\\Component\\HttpFoundation\\RequestMatcher`, does not.\n\nThis difference causes Symfony 2.0 to be vulnerable to double encoding attacks.\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Mortbay Jetty CRLF Injection Vulnerability",
  "details": "CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ",
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data",
  "details": "Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "XXE in SabreDAV",
  "details": "SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -74,9 +72,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-07T19:42:46Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "TYPO3 Flow Cross-site scripting (XSS) vulnerability",
  "details": "Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "DotNetNuke Vulnerable to XSS in Pass-Through Values",
  "details": "Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN), caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS.  A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -53,9 +53,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-14T18:02:16Z",
--- a/Show More
+++ b/Show More