From 4063658c6ce3219e027cfe95059a4cb98e98cc1a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 20 Feb 2025 20:25:30 +0000
Subject: [PATCH] Publish Advisories

GHSA-2gw2-qgjg-xh6p
GHSA-rq4w-cjrr-h8w8
---
 .../GHSA-2gw2-qgjg-xh6p.json                  | 53 +++++++++++++++++++
 .../GHSA-rq4w-cjrr-h8w8.json                  | 37 +++++++++++--
 2 files changed, 86 insertions(+), 4 deletions(-)
 create mode 100644 advisories/github-reviewed/2025/02/GHSA-2gw2-qgjg-xh6p/GHSA-2gw2-qgjg-xh6p.json
 rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json (60%)

diff --git a/advisories/github-reviewed/2025/02/GHSA-2gw2-qgjg-xh6p/GHSA-2gw2-qgjg-xh6p.json b/advisories/github-reviewed/2025/02/GHSA-2gw2-qgjg-xh6p/GHSA-2gw2-qgjg-xh6p.json
new file mode 100644
index 00000000000..be70c2fac21
--- /dev/null
+++ b/advisories/github-reviewed/2025/02/GHSA-2gw2-qgjg-xh6p/GHSA-2gw2-qgjg-xh6p.json
@@ -0,0 +1,53 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2gw2-qgjg-xh6p",
+  "modified": "2025-02-20T20:24:19Z",
+  "published": "2025-02-20T20:24:19Z",
+  "aliases": [],
+  "summary": "Namada-apps allows Post-Genesis Validator Bypass",
+  "details": "### Impact\n\nLedger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the `--force` flag. If this validator gets into the consensus set, then when computing PoS inflation inside `fn update_rewards_products_and_mint_inflation`, an instance of `mul_floor` will cause the return of an `Err`, which causes `finalize_block` to error.\n\n### Patches\n\nThis issue has been patched in apps version 1.1.0. The PoS validity predicate now enforces that the commission rate is not negative and any transaction that fails the check will be rejected, both for newly initialized validators and for commission rate change of an existing validator.\n\n### Workarounds\n\nThere are no workarounds and users are advised to upgrade.",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "namada-apps"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.0.0"
+            },
+            {
+              "fixed": "1.1.0"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "1.0.0"
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/anoma/namada/security/advisories/GHSA-2gw2-qgjg-xh6p"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/anoma/namada"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-248"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-20T20:24:19Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json b/advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json
similarity index 60%
rename from advisories/unreviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json
rename to advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json
index e0bc27b10e4..c8224658e2d 100644
--- a/advisories/unreviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json
+++ b/advisories/github-reviewed/2025/02/GHSA-rq4w-cjrr-h8w8/GHSA-rq4w-cjrr-h8w8.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rq4w-cjrr-h8w8",
-  "modified": "2025-02-17T15:32:01Z",
+  "modified": "2025-02-20T20:23:38Z",
   "published": "2025-02-17T15:32:01Z",
   "aliases": [
     "CVE-2025-1391"
   ],
+  "summary": "Keycloak allows Incorrect Assignment of an Organization to a User",
   "details": "A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.",
   "severity": [
     {
@@ -13,12 +14,36 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.keycloak:keycloak-services"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "26.1.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1391"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/keycloak/keycloak/commit/5aa2b4c75bb474303ab807017582bc01a9f7e378"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2025-1391"
@@ -26,6 +51,10 @@
     {
       "type": "WEB",
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346082"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/keycloak/keycloak"
     }
   ],
   "database_specific": {
@@ -33,8 +62,8 @@
       "CWE-284"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-20T20:23:38Z",
     "nvd_published_at": "2025-02-17T14:15:08Z"
   }
 }
\ No newline at end of file