diff --git a/advisories/unreviewed/2023/12/GHSA-625p-jwcp-r2r5/GHSA-625p-jwcp-r2r5.json b/advisories/github-reviewed/2023/12/GHSA-625p-jwcp-r2r5/GHSA-625p-jwcp-r2r5.json similarity index 70% rename from advisories/unreviewed/2023/12/GHSA-625p-jwcp-r2r5/GHSA-625p-jwcp-r2r5.json rename to advisories/github-reviewed/2023/12/GHSA-625p-jwcp-r2r5/GHSA-625p-jwcp-r2r5.json index 28eaf73d4d8..8b0325d2a67 100644 --- a/advisories/unreviewed/2023/12/GHSA-625p-jwcp-r2r5/GHSA-625p-jwcp-r2r5.json +++ b/advisories/github-reviewed/2023/12/GHSA-625p-jwcp-r2r5/GHSA-625p-jwcp-r2r5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-625p-jwcp-r2r5", - "modified": "2023-12-19T03:30:17Z", + "modified": "2024-01-03T21:28:13Z", "published": "2023-12-19T03:30:17Z", "aliases": [ "CVE-2014-125107" ], + "summary": "Corveda PHPSandbox Protection Mechanism Failure vulnerability", "details": "A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String Handler. The manipulation leads to protection mechanism failure. The attack may be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The patch is identified as 48fde5ffa4d76014bad260a3cbab7ada3744a4cc. It is recommended to upgrade the affected component. VDB-248270 is the identifier assigned to this vulnerability.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "corveda/phpsandbox" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.5" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Corveda/PHPSandbox/commit/48fde5ffa4d76014bad260a3cbab7ada3744a4cc" }, + { + "type": "PACKAGE", + "url": "https://github.com/Corveda/PHPSandbox" + }, { "type": "WEB", "url": "https://github.com/Corveda/PHPSandbox/releases/tag/v1.3.5" @@ -43,8 +66,8 @@ "CWE-693" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:28:13Z", "nvd_published_at": "2023-12-19T03:15:07Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-76cc-p55w-63g3/GHSA-76cc-p55w-63g3.json b/advisories/github-reviewed/2024/01/GHSA-76cc-p55w-63g3/GHSA-76cc-p55w-63g3.json new file mode 100644 index 00000000000..d924091bab2 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-76cc-p55w-63g3/GHSA-76cc-p55w-63g3.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-76cc-p55w-63g3", + "modified": "2024-01-03T21:29:09Z", + "published": "2024-01-03T21:29:09Z", + "aliases": [ + + ], + "summary": "Teleport Access List owners can escalate their privileges", + "details": "### Impact\nAccess Lists are a new feature introduced in Teleport 14 and currently under preview. An issue was discovered that allows an Access List Owner to assign arbitrary permissions, including permissions to themselves which could result in privilege escalation.\n\n### Patches\nFixed in version 14.2.4 and 13.4.13", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.0" + }, + { + "fixed": "14.2.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.0.0" + }, + { + "fixed": "13.4.13" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/security/advisories/GHSA-76cc-p55w-63g3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/gravitational/teleport" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:29:09Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-c9v7-wmwj-vf6x/GHSA-c9v7-wmwj-vf6x.json b/advisories/github-reviewed/2024/01/GHSA-c9v7-wmwj-vf6x/GHSA-c9v7-wmwj-vf6x.json new file mode 100644 index 00000000000..7b9fcad9eb5 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-c9v7-wmwj-vf6x/GHSA-c9v7-wmwj-vf6x.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c9v7-wmwj-vf6x", + "modified": "2024-01-03T21:29:33Z", + "published": "2024-01-03T21:29:33Z", + "aliases": [ + + ], + "summary": "SFTP is possible on the Proxy server for any user with SFTP access", + "details": "### Impact\nAn attacker that has access to nodes within the cluster may be able to SFTP to the Proxy Service. The user's permissions on the Proxy server are still respected, so files can only be read or modified on the Proxy if the user has system access to read or write to them.\n\n### Patches\nFixed in versions 14.2.4, 13.4.13 and 12.4.31.\n\n### Workarounds\nThis issue can be mitigated by ensuring that regular users do not have a valid principal on the proxy server. To be exploitable, the user's login must exist on a proxy server and the Teleport binary must have permissions to start a session with this user.\n\n### References\n* Fix PR: https://github.com/gravitational/teleport/pull/36136\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.0" + }, + { + "fixed": "14.2.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.0.0" + }, + { + "fixed": "13.4.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.4.31" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/security/advisories/GHSA-c9v7-wmwj-vf6x" + }, + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/pull/36136" + }, + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/commit/1c77fc49944ebcded32bbdd77c3e1f4f8a1c130d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/gravitational/teleport" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:29:33Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-hw4x-mcx5-9q36/GHSA-hw4x-mcx5-9q36.json b/advisories/github-reviewed/2024/01/GHSA-hw4x-mcx5-9q36/GHSA-hw4x-mcx5-9q36.json new file mode 100644 index 00000000000..e601d0bcc4c --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-hw4x-mcx5-9q36/GHSA-hw4x-mcx5-9q36.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hw4x-mcx5-9q36", + "modified": "2024-01-03T21:28:37Z", + "published": "2024-01-03T21:28:37Z", + "aliases": [ + + ], + "summary": "Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users", + "details": "### Impact\nAn authenticated attacker with valid credentials (user or host) can make non-blind Server-Side Request Forgery (SSRF) through the proxy and/or agents to arbitrary hosts.\n\nDuring investigation of this functionality, it was discovered that there are several permutations where this SSRF is possible. This release addresses all but one: a root proxy administrator with access to the root proxy credentials can make requests through leaf proxies in Trusted Clusters. This behavior will be restricted in future releases. For customers using Teleport in a Trusted Cluster configuration, we encourage leaf clusters to have network restrictions in place to mitigate SSRF. For example, we recommend restricting outbound network connections to only the Auth Service, your SSO provider, and any agents, databases or applications needed to be accessed from the proxy. If running in a cloud environment pay careful attention to what cloud resources are accessible from the proxy.\n\n### Patches\nFixed in versions 14.2.4, 13.4.13 and 12.4.31.\n\n### Workarounds\nStrict network controls from the Teleport Proxy and Teleport Agents reduce the potential exposure from this issue.\n\n### References\n* Fixed in PR: https://github.com/gravitational/teleport/pull/36127\n* https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html#network-layer\n* https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/network-hardening/implementing-network-segmentation-and-segregation\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.0" + }, + { + "fixed": "14.2.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.0.0" + }, + { + "fixed": "13.4.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/gravitational/teleport" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.4.31" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/security/advisories/GHSA-hw4x-mcx5-9q36" + }, + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/pull/36127" + }, + { + "type": "WEB", + "url": "https://github.com/gravitational/teleport/commit/bb2d67d357e868254a21ed7cb132030d7bf9fcbc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/gravitational/teleport" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:28:37Z", + "nvd_published_at": null + } +} \ No newline at end of file