From 4156d1a15b858d2925376365d03469a173b28276 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Aug 2024 18:27:31 +0000 Subject: [PATCH] Publish Advisories GHSA-2rqw-cfhc-35fh GHSA-g9ph-j5vj-f8wm GHSA-r3jc-vhf4-6v32 --- .../GHSA-2rqw-cfhc-35fh.json | 69 ++++++++++++++++++ .../GHSA-g9ph-j5vj-f8wm.json | 73 +++++++++++++++++++ .../GHSA-r3jc-vhf4-6v32.json | 73 +++++++++++++++++++ 3 files changed, 215 insertions(+) create mode 100644 advisories/github-reviewed/2024/08/GHSA-2rqw-cfhc-35fh/GHSA-2rqw-cfhc-35fh.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-g9ph-j5vj-f8wm/GHSA-g9ph-j5vj-f8wm.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-r3jc-vhf4-6v32/GHSA-r3jc-vhf4-6v32.json diff --git a/advisories/github-reviewed/2024/08/GHSA-2rqw-cfhc-35fh/GHSA-2rqw-cfhc-35fh.json b/advisories/github-reviewed/2024/08/GHSA-2rqw-cfhc-35fh/GHSA-2rqw-cfhc-35fh.json new file mode 100644 index 00000000000..e2cbcc0731f --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-2rqw-cfhc-35fh/GHSA-2rqw-cfhc-35fh.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2rqw-cfhc-35fh", + "modified": "2024-08-21T18:26:27Z", + "published": "2024-08-21T18:26:27Z", + "aliases": [ + "CVE-2024-41674" + ], + "summary": "CKAN may leak Solr credentials via error message in package_search action", + "details": "If there were connection issues with the Solr server, the internal Solr URL (potentially including credentials) could be leaked to `package_search` calls as part of the returned error message\n\n### Patches\nThis has been patched in CKAN 2.10.5 and 2.11.0\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ckan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.10.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/security/advisories/GHSA-2rqw-cfhc-35fh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41674" + }, + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/commit/f6b032cd7082d784938165bbd113557639002ca7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ckan/ckan" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T18:26:27Z", + "nvd_published_at": "2024-08-21T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-g9ph-j5vj-f8wm/GHSA-g9ph-j5vj-f8wm.json b/advisories/github-reviewed/2024/08/GHSA-g9ph-j5vj-f8wm/GHSA-g9ph-j5vj-f8wm.json new file mode 100644 index 00000000000..7e151d6b550 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-g9ph-j5vj-f8wm/GHSA-g9ph-j5vj-f8wm.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9ph-j5vj-f8wm", + "modified": "2024-08-21T18:27:12Z", + "published": "2024-08-21T18:27:11Z", + "aliases": [ + "CVE-2024-43371" + ], + "summary": "Potential access to sensitive URLs via CKAN extensions (SSRF)", + "details": "### Impact\n\nThere are a number of CKAN plugins, including [XLoader](https://github.com/ckan/ckanext-xloader), [DataPusher](https://github.com/ckan/datapusher), [Resource proxy](https://docs.ckan.org/en/latest/maintaining/data-viewer.html#resource-proxy) and [ckanext-archiver](https://github.com/ckan/ckanext-archiver/), that work by downloading the contents of local or remote files in order to perform some actions with their contents (e.g. pushing to the DataStore, streaming contents or saving a local copy). All of them use the resource URL, and there are currently no checks to limit what URLs can be requested. This means that a malicious (or unaware) user can create a resource with a URL pointing to a place where they should not have access in order for one of the previous tools to retrieve it (known as a [Server Side Request Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)).\n\n### Patches and Workarounds\n\nUsers wanting to protect against these kinds of attacks can use one or a combination of the following approaches:\n\n* Use a separate HTTP proxy like [Squid](https://www.squid-cache.org/) that can be used to allow / disallow IPs, domains etc as needed, and make CKAN extensions aware of this setting via the [`ckan.download_proxy`](https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-download-proxy) config option. \n* Implement custom firewall rules to prevent access to restricted resources.\n* Use custom validators on the resource `url` field to block/allow certain domains or IPs.\n\nAll latest versions of the plugins linked above support the `ckan.download_proxy` settings. Support for this setting in the Resource Proxy plugin was included in CKAN 2.10.5 and 2.11.0\n\n### References\n\n* [Blog post](https://feeding.cloud.geek.nz/posts/restricting-outgoing-webapp-requests-using-squid-proxy/) provides more details on how to configure a Squid proxy to prevent these issues\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ckan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/security/advisories/GHSA-g9ph-j5vj-f8wm" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43371" + }, + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/commit/382beaec98cb331f2a030459ef043c50eaf5ad53" + }, + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/commit/8601183cc2fc87277ea5b33ff75c3a5610812ab5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ckan/ckan" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T18:27:11Z", + "nvd_published_at": "2024-08-21T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-r3jc-vhf4-6v32/GHSA-r3jc-vhf4-6v32.json b/advisories/github-reviewed/2024/08/GHSA-r3jc-vhf4-6v32/GHSA-r3jc-vhf4-6v32.json new file mode 100644 index 00000000000..66011e2cb9b --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-r3jc-vhf4-6v32/GHSA-r3jc-vhf4-6v32.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r3jc-vhf4-6v32", + "modified": "2024-08-21T18:26:29Z", + "published": "2024-08-21T18:26:29Z", + "aliases": [ + "CVE-2024-41675" + ], + "summary": "CKAN has Cross-site Scripting vector in the Datatables view plugin", + "details": "The [Datatables view plugin](https://docs.ckan.org/en/2.10/maintaining/data-viewer.html#datatables-view) did not properly escape record data coming from the DataStore, leading to a potential XSS vector.\n\n\n### Impact\nSites running CKAN >= 2.7.0 with the `datatables_view` plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data.\n\n### Patches\nThis vulnerability has been fixed in CKAN 2.10.5 and 2.11.0\n\n### Workarounds\nPrevent importing of tabular files to the DataStore via DataPusher, XLoader,etc, at least those published from untrusted sources.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ckan" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7.0" + }, + { + "fixed": "2.10.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/security/advisories/GHSA-r3jc-vhf4-6v32" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41675" + }, + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/commit/9e89ce8220ab1445e0bd85a67994a51d9d3d2688" + }, + { + "type": "WEB", + "url": "https://github.com/ckan/ckan/commit/d7dfe8c427b1c63c75d788a609f3b7d7620a25a1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ckan/ckan" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T18:26:29Z", + "nvd_published_at": "2024-08-21T15:15:08Z" + } +} \ No newline at end of file