Publish Advisories

GHSA-75m2-jhh5-j5g2
GHSA-c995-4fw3-j39m
GHSA-rr8g-9fpq-6wmg

advisories/github-reviewed/2025/04/GHSA-75m2-jhh5-j5g2/GHSA-75m2-jhh5-j5g2.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-75m2-jhh5-j5g2",
-  "modified": "2025-04-07T18:57:57Z",
+  "modified": "2025-04-07T21:11:45Z",
   "published": "2025-04-07T18:57:56Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-32034"
+  ],
   "summary": "Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion",
   "details": "# Impact\n\n## Summary\n\nA vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service.\n\n## Details\n\nNamed fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved.\n\n## Fix/Mitigation\n\nA new **Query Fragment Expansion Limit** metric has been introduced:\n  - This metric computes the number of selections a query would have if its fragment spreads were fully expanded.\n  - The metric is checked against a limit to prevent excessive computation.\n\n# Patches\n\nThis has been remediated in `apollo-router` versions 1.61.2 and 2.1.1.\n\n# Workarounds\n\nThe only known workaround is \"Safelisting\" or \"Safelisting with IDs only\" per [Safelisting with Persisted Queries - Apollo GraphQL Docs](https://www.apollographql.com/docs/graphos/routing/security/persisted-queries#router-security-levels).\n\n# References\n\n[Query Planning Documentation](https://www.apollographql.com/docs/graphos/reference/federation/query-plans)\n\n## Acknowledgements\n\nWe appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.",
   "severity": [

advisories/github-reviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json

@@ -1,19 +1,40 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c995-4fw3-j39m",
-  "modified": "2025-04-07T15:31:22Z",
+  "modified": "2025-04-07T21:13:20Z",
   "published": "2025-04-07T15:31:22Z",
   "aliases": [
     "CVE-2025-3248"
   ],
-  "details": "Langflow versions prior to 1.3.0 are susceptible to code injection in \nthe /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary\ncode.",
+  "summary": "Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint",
+  "details": "Langflow versions prior to 1.3.0 are susceptible to code injection in the `/api/v1/validate/code` endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "langflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.3.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -23,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/langflow-ai/langflow/pull/6911"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/langflow-ai/langflow"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/langflow-ai/langflow/releases/tag/1.3.0"
@@ -30,11 +55,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-306"
+      "CWE-306",
+      "CWE-94"
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-07T21:13:20Z",
     "nvd_published_at": "2025-04-07T15:15:44Z"
   }
 }

advisories/github-reviewed/2025/04/GHSA-rr8g-9fpq-6wmg/GHSA-rr8g-9fpq-6wmg.json

@@ -0,0 +1,97 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rr8g-9fpq-6wmg",
+  "modified": "2025-04-07T21:12:50Z",
+  "published": "2025-04-07T21:12:50Z",
+  "aliases": [],
+  "summary": "Tokio broadcast channel calls clone in parallel, but does not require `Sync`",
+  "details": "The broadcast channel internally calls `clone` on the stored value when receiving it, and only requires `T:Send`. This means that using the broadcast channel with values that are `Send` but not `Sync` can trigger unsoundness if the `clone` implementation makes use of the value being `!Sync`.\n\nThank you to Austin Bonander for finding and reporting this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "tokio"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.44.0"
+            },
+            {
+              "fixed": "1.44.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "tokio"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.2.5"
+            },
+            {
+              "fixed": "1.38.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "tokio"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.39.0"
+            },
+            {
+              "fixed": "1.43.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/tokio-rs/tokio/pull/7232"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/tokio-rs/tokio"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0023.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-664"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-07T21:12:50Z",
+    "nvd_published_at": null
+  }
+}