From 443a98d7fa3807c45449c4970f7371b460fb0304 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 20 Dec 2023 20:33:21 +0000 Subject: [PATCH] Publish Advisories GHSA-83q5-whqp-r8jr GHSA-hh8p-p8mp-gqhm GHSA-mhpq-9638-x6pw GHSA-83q5-whqp-r8jr --- .../GHSA-83q5-whqp-r8jr.json | 115 ++++++++++++++++++ .../GHSA-hh8p-p8mp-gqhm.json | 31 ++++- .../GHSA-mhpq-9638-x6pw.json | 65 ++++++++++ .../GHSA-83q5-whqp-r8jr.json | 42 ------- 4 files changed, 207 insertions(+), 46 deletions(-) create mode 100644 advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json rename advisories/{unreviewed => github-reviewed}/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json (61%) create mode 100644 advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json delete mode 100644 advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json diff --git a/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json b/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json new file mode 100644 index 00000000000..137edfe9231 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json @@ -0,0 +1,115 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-83q5-whqp-r8jr", + "modified": "2023-12-20T20:32:13Z", + "published": "2023-12-20T09:30:26Z", + "aliases": [ + "CVE-2023-37544" + ], + "summary": "Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability", + "details": "Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.\n\nThis issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.\n\nThe known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.\n\n2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.\n2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.\n3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.\n3.1 Pulsar WebSocket Proxy users are unaffected.\nAny users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.pulsar:pulsar-websocket" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.pulsar:pulsar-websocket" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.11.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.pulsar:pulsar-websocket" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37544" + }, + { + "type": "WEB", + "url": "https://github.com/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358" + }, + { + "type": "WEB", + "url": "https://github.com/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a" + }, + { + "type": "WEB", + "url": "https://github.com/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/pulsar" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/12/20/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:32:13Z", + "nvd_published_at": "2023-12-20T09:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json b/advisories/github-reviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json similarity index 61% rename from advisories/unreviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json rename to advisories/github-reviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json index 05f74f4eb12..a80f8357c1c 100644 --- a/advisories/unreviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json +++ b/advisories/github-reviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hh8p-p8mp-gqhm", - "modified": "2023-12-20T06:30:25Z", + "modified": "2023-12-20T20:32:39Z", "published": "2023-12-20T06:30:25Z", "aliases": [ "CVE-2023-6975" ], + "summary": "MLFlow Path Traversal Vulnerability", "details": "A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mlflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee" }, + { + "type": "PACKAGE", + "url": "https://github.com/mlflow/mlflow" + }, { "type": "WEB", "url": "https://huntr.com/bounties/029a3824-cee3-4cf1-b260-7138aa539b85" @@ -35,8 +58,8 @@ "CWE-29" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:32:39Z", "nvd_published_at": "2023-12-20T06:15:45Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json b/advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json new file mode 100644 index 00000000000..5b868eb730d --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mhpq-9638-x6pw", + "modified": "2023-12-20T20:31:57Z", + "published": "2023-12-20T20:31:57Z", + "aliases": [ + + ], + "summary": "Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go", + "details": "An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/dvsekhvalnov/jose2go" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.1-0.20231206184617-48ba0b76bc88" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dvsekhvalnov/jose2go/issues/31" + }, + { + "type": "WEB", + "url": "https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dvsekhvalnov/jose2go" + }, + { + "type": "WEB", + "url": "https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:31:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json b/advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json deleted file mode 100644 index 6807defa0c1..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-83q5-whqp-r8jr", - "modified": "2023-12-20T09:30:26Z", - "published": "2023-12-20T09:30:26Z", - "aliases": [ - "CVE-2023-37544" - ], - "details": "Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.\n\nThis issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.\n\nThe known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.\n\n2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.\n2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.\n3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.\n3.1 Pulsar WebSocket Proxy users are unaffected.\nAny users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37544" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2023/12/20/2" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-287" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-20T09:15:07Z" - } -} \ No newline at end of file