Publish Advisories

GHSA-gprj-3p75-f996
GHSA-vqwr-q6cc-c242

advisories/github-reviewed/2024/06/GHSA-gprj-3p75-f996/GHSA-gprj-3p75-f996.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gprj-3p75-f996",
+  "modified": "2024-06-12T17:13:07Z",
+  "published": "2024-06-12T17:13:07Z",
+  "aliases": [
+    "CVE-2024-37300"
+  ],
+  "summary": "Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0",
+  "details": "### Impact\n\nJupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. The configuration for this would look like:\n\n```python\n# Require users to be using the \"foo.horse\" identity provider, often an institution or university\nc.GlobusAuthenticator.identity_provider = \"foo.horse\"\n# Allow everyone who has that identity provider to log in\nc.GlobusAuthenticator.allow_all = True\n```\n\nThis worked fine prior to JupyterHub 5.0, because `allow_all` *did not* take precedence over `identity_provider`.\n\nSince JupyterHub 5.0, `allow_all` *does* take precedence over `identity_provider`. On a hub with the same config, now **all** users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored.\n\nThis is a [documented change](https://jupyterhub.readthedocs.io/en/stable/howto/upgrading-v5.html#authenticator-allow-all-and-allow-existing-users) in JupyterHub 5.0,\nbut is likely to catch many users by surprise.\n\n### Patches\n\nOAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions.\n\n### Workarounds\n\nDo not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "oauthenticator"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "16.3.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-gprj-3p75-f996"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jupyterhub/oauthenticator/commit/d1aea05fa89f2beae15ab0fa0b0d071030f79654"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jupyterhub/oauthenticator"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-863"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-12T17:13:07Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/06/GHSA-vqwr-q6cc-c242/GHSA-vqwr-q6cc-c242.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vqwr-q6cc-c242",
-  "modified": "2024-06-12T03:31:15Z",
+  "modified": "2024-06-12T17:12:45Z",
   "published": "2024-06-12T03:31:15Z",
   "aliases": [
     "CVE-2024-4315"
   ],
+  "summary": "parisneo/lollms Local File Inclusion (LFI) attack",
   "details": "parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\\`), allowing attackers to perform directory traversal attacks on Windows systems. This vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete any file on the Windows filesystem, compromising the system's availability.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "lollms"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "9.5.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/parisneo/lollms/commit/95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/ParisNeo/lollms"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.com/bounties/8a1b0197-2c36-4276-b92b-630a2a9bb09c"
@@ -32,11 +55,11 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-98"
+      "CWE-22"
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-12T17:12:45Z",
     "nvd_published_at": "2024-06-12T01:15:49Z"
   }
 }