Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-28 05:13:08 +00:00
parent 254e6f2ac1
commit 424700cfd8
918 changed files with 1810 additions and 5426 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Moderate severity vulnerability that affects rails",
  "details": "Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "High severity vulnerability that affects rails.",
  "details": "Unspecified vulnerability in the \"dependency resolution mechanism\" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or \"data loss,\" a different vulnerability than CVE-2006-4111.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -95,9 +93,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:29:44Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Moderate severity vulnerability that affects rails",
  "details": "Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Moderate severity vulnerability that affects rails",
  "details": "Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "High severity vulnerability that affects thin",
  "details": "lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "rails is vulnerable to CRLF injection",
  "details": "CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Session fixation vulnerability in Rails ",
  "details": "Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to \"URL-based sessions.\"",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "session fixation protection mechanism in cgi_process.rb in Rails",
  "details": "The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks.  NOTE: this is due to an incomplete fix for CVE-2007-5380.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Ruby on Rails vulnerable to code injection",
  "details": "Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with \"severe\" or \"serious\" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-3fg9-hcq5-vxrc",
  "modified": "2022-08-30T19:55:41Z",
  "published": "2022-08-30T19:55:41Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "iana-time-zone vulnerable to use after free in MacOS / iOS implementation",
  "details": "In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.\n\nThe copied system time zone was released before its name was copied.\nIf the system time zone was changed between the call of `CFRelease` and `str::to_owned()`,\nrandom memory would be copied.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-8mgq-6r2q-82w9",
  "modified": "2022-08-30T20:54:12Z",
  "published": "2022-08-30T20:54:12Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Captcha Bypass in strapi-plugin-ezforms",
  "details": "### Impact\nUsers using any captcha providers\n\n### Patches\n>0.1.0\n\n### References\n[Issue](https://github.com/excl-networks/strapi-plugin-ezforms/issues/15)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -51,9 +47,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-30T20:54:12Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-jwh2-vrr9-vcp2",
  "modified": "2022-08-30T19:53:54Z",
  "published": "2022-08-30T19:53:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "mz-avro's incorrect use of `set_len` allows for un-initialized memory",
  "details": "Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` \nimplementation.\n\nArbitrary `Read` implementations can read from the uninitialized buffer (memory exposure)\nand also can return incorrect number of bytes written to the buffer.\nReading from uninitialized memory produces undefined values that can quickly invoke\nundefined behavior.\n\nNote: there is only UB in the case where a user provides a struct whose `Read`\nimplementation inspects the buffer passed to `read_exact` before writing to it.\nThis is an unidiomatic (albeit possible) `Read` implementation.\n\nSee https://github.com/MaterializeInc/materialize/issues/8669 for details.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-30T19:53:54Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-pfhr-pccp-hwmh",
  "modified": "2022-08-30T20:06:02Z",
  "published": "2022-08-30T20:06:02Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels",
  "details": "### Impact\n\nIf a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies matching on namespace labels, then it is possible for an attacker with Kubernetes pod deploy rights (either directly or indirectly via higher-level APIs such as Deployment, Daemonset etc) to craft additional pod labels such that the pod is selected by another policy that exists rather than the expected policy. \n\n### Patches\n\nThe problem has been fixed and is available on versions >=1.10.14, >=1.11.8, >=1.12.1\n\n### Workarounds\n\nThere are no workarounds available.\n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to Sander Mathijssen for not only highlighting the issue but also proposing a resolution. \n\n### For more information\n\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nAs usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.\n",
  "severity": [
@@ -105,9 +103,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-30T20:06:02Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-v78c-4p63-2j6c",
  "modified": "2022-08-30T20:28:43Z",
  "published": "2022-08-30T20:28:43Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cleartext Transmission of Sensitive Information in moment-timezone",
  "details": "### Impact\n\n* if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website\n* and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata pipeline, or potentially produce a tainted version of moment-timezone (practicality of such attacks is not proved)\n\n### Patches\nProblem has been patched in version 0.5.35, patch should be applicable with minor modifications to all affected versions. The patch includes changing the FTP endpoint with an HTTPS endpoint.\n\n### Workarounds\nSpecify the exact version of tzdata (like `2014d`, full command being `grunt data:2014d`, then run the rest of the release tasks by hand), or just apply the patch before issuing the grunt command.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,9 +4,7 @@
  "modified": "2022-09-19T20:19:08Z",
  "published": "2022-09-15T00:00:19Z",
  "withdrawn": "2022-09-16T20:59:09Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate of GHSA-m77f-652q-wwp4",
  "details": "## Duplicate advisory\nThis advisory is a duplicate of [GHSA-m77f-652q-wwp4](https://github.com/advisories/GHSA-m77f-652q-wwp4). This link is maintained to preserve external references.\n\n## Original Description\n<bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String",
  "severity": [
@@ -4,14 +4,10 @@
  "modified": "2022-09-19T14:25:17Z",
  "published": "2022-09-16T21:03:19Z",
  "withdrawn": "2022-09-19T14:25:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ansi_term is Unmaintained",
  "details": "## Withdrawn Advisory\nThis advisory has been withdrawn because it does not discuss a particular vulnerability in the code of `ansi_term`.\n\n## Original Description\nThe maintainer has adviced this crate is deprecated and will not receive any maintenance.\n\nThe crate does not seem to have much dependencies and may or may not be ok to use as-is.\n\nLast release seems to have been three years ago.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -45,9 +41,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T21:03:19Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "TensorFlow vulnerable to `CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs`",
  "details": "### Impact\nWhen [`tensorflow::full_type::SubstituteFromAttrs`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/math_ops.cc) receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status.\n```cpp\nStatus SubstituteForEach(AttrMap& attrs, FullTypeDef& t) {\n  DCHECK_EQ(t.args_size(), 3);\n\n  const auto& cont = t.args(0);\n  const auto& tmpl = t.args(1);\n  const auto& t_var = t.args(2);\n```\n\n### Patches\nWe have patched the issue in GitHub commit [6104f0d4091c260ce9352f9155f7e9b725eab012](https://github.com/tensorflow/tensorflow/commit/6104f0d4091c260ce9352f9155f7e9b725eab012).\nThe fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.\n\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "TensorFlow vulnerable to integer overflow in math ops",
  "details": "### Impact\nWhen [`RangeSize`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/math_ops.cc) receives values that do not fit into an `int64_t`, it crashes.\n```cpp\n  auto size = (std::is_integral<T>::value\n                   ? ((Eigen::numext::abs(limit - start) +\n                       Eigen::numext::abs(delta) - T(1)) /\n                      Eigen::numext::abs(delta))\n                   : (Eigen::numext::ceil(\n                         Eigen::numext::abs((limit - start) / delta))));\n\n  // This check does not cover all cases.\n  if (size > std::numeric_limits<int64_t>::max()) {\n    return errors::InvalidArgument(\"Requires ((limit - start) / delta) <= \",\n                                   std::numeric_limits<int64_t>::max());\n  }\n\n  c->set_output(0, c->Vector(static_cast<int64_t>(size)));\n  return Status::OK();\n}\n```\n\n### Patches\nWe have patched the issue in GitHub commit [37e64539cd29fcfb814c4451152a60f5d107b0f0](https://github.com/tensorflow/tensorflow/commit/37e64539cd29fcfb814c4451152a60f5d107b0f0).\nThe fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.\n\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
--- a/Show More
+++ b/Show More