From 48d42a85c177856fc11795ccd17e86408b3d3993 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 7 Feb 2024 17:29:16 +0000 Subject: [PATCH] Publish Advisories GHSA-52xq-j7v9-v4v2 GHSA-r3jc-3qmm-w3pw --- .../GHSA-52xq-j7v9-v4v2.json | 65 +++++++++++++++++++ .../GHSA-r3jc-3qmm-w3pw.json | 65 +++++++++++++++++++ 2 files changed, 130 insertions(+) create mode 100644 advisories/github-reviewed/2024/02/GHSA-52xq-j7v9-v4v2/GHSA-52xq-j7v9-v4v2.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-r3jc-3qmm-w3pw/GHSA-r3jc-3qmm-w3pw.json diff --git a/advisories/github-reviewed/2024/02/GHSA-52xq-j7v9-v4v2/GHSA-52xq-j7v9-v4v2.json b/advisories/github-reviewed/2024/02/GHSA-52xq-j7v9-v4v2/GHSA-52xq-j7v9-v4v2.json new file mode 100644 index 00000000000..0bf37fdf17d --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-52xq-j7v9-v4v2/GHSA-52xq-j7v9-v4v2.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-52xq-j7v9-v4v2", + "modified": "2024-02-07T17:27:58Z", + "published": "2024-02-07T17:27:58Z", + "aliases": [ + "CVE-2024-24563" + ], + "summary": "Vyper array negative index vulnerability", + "details": "### Summary\nArrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. Typically, negative integers are filtered out at runtime by the bounds checker, but small enough (i.e. large in magnitude, ex. `-2**255 + 5`) quantities combined with large enough arrays (at least `2**255` in length) can pass the bounds checker, resulting in unexpected behavior.\n\nA contract search was performed, and no production contracts were found to be impacted.\n\n### Details\nThe typechecker allows the usage of signed integers to be used as indexes to arrays. The vulnerability is present in different forms in all versions. Here is an example from `0.3.10`:\nhttps://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/semantics/types/subscriptable.py#L127-L137\n\nAs can be seen, the validation is performed against `IntegerT.any()`.\n\n### PoC\nIf the array is sufficiently large, it can be indexed with a negative value:\n```python\narr: public(uint256[MAX_UINT256])\n\n@external\ndef set(idx: int256, num: uint256):\n self.arr[idx] = num\n```\nFor signed integers, the 2's complement representation is used. Because the array was declared very large, the bounds checking will pass (negative values will simply be represented as very large numbers):\nhttps://github.com/vyperlang/vyper/blob/a1fd228cb9936c3e4bbca6f3ee3fb4426ef45490/vyper/codegen/core.py#L534-L541\n\n\n### Impact\nThere are two potential vulnerability classes: unpredictable behavior and accessing inaccessible elements.\n\n1. If it is possible to index an array with a negative integer without reverting, this is most likely not anticipated by the developer and such accesses can cause unpredictable behavior for the contract.\n\n2. If a contract has an invariant in the form `assert index < x` where both `index` and `x` are signed integers, the developer might suppose that no elements on indexes `y | y >= x` are accessible. However, by using negative indexes this can be bypassed.\n\nThe contract search found no production contracts impacted by these two classes of issues.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vyper" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.3.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-52xq-j7v9-v4v2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vyperlang/vyper" + }, + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/blob/a1fd228cb9936c3e4bbca6f3ee3fb4426ef45490/vyper/codegen/core.py#L534-L541" + }, + { + "type": "WEB", + "url": "https://github.com/vyperlang/vyper/blob/c150fc49ee9375a930d177044559b83cb95f7963/vyper/semantics/types/subscriptable.py#L127-L137" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-129" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-02-07T17:27:58Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-r3jc-3qmm-w3pw/GHSA-r3jc-3qmm-w3pw.json b/advisories/github-reviewed/2024/02/GHSA-r3jc-3qmm-w3pw/GHSA-r3jc-3qmm-w3pw.json new file mode 100644 index 00000000000..5159fb2410f --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-r3jc-3qmm-w3pw/GHSA-r3jc-3qmm-w3pw.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r3jc-3qmm-w3pw", + "modified": "2024-02-07T17:28:26Z", + "published": "2024-02-07T17:28:26Z", + "aliases": [ + "CVE-2024-24811" + ], + "summary": "SQLAlchemyDA unauthenticated arbitrary SQL query execution", + "details": "### Impact\nThe vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.\n\n### Patches\nThe problem has been patched in version 2.2.\n\n### Workarounds\nThere is no workaround. All users are urged to upgrade to version 2.2\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "Products.SQLAlchemyDA" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24811" + }, + { + "type": "WEB", + "url": "https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/zopefoundation/Products.SQLAlchemyDA" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-02-07T17:28:26Z", + "nvd_published_at": "2024-02-07T15:15:08Z" + } +} \ No newline at end of file