From 4d3e4d3e2d3073c44bcc24fc5c01fe0a11b14075 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 7 Apr 2025 21:14:59 +0000 Subject: [PATCH] Publish Advisories GHSA-75m2-jhh5-j5g2 GHSA-c995-4fw3-j39m GHSA-rr8g-9fpq-6wmg --- .../GHSA-75m2-jhh5-j5g2.json | 6 +- .../GHSA-c995-4fw3-j39m.json | 38 ++++++-- .../GHSA-rr8g-9fpq-6wmg.json | 97 +++++++++++++++++++ 3 files changed, 133 insertions(+), 8 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json (52%) create mode 100644 advisories/github-reviewed/2025/04/GHSA-rr8g-9fpq-6wmg/GHSA-rr8g-9fpq-6wmg.json diff --git a/advisories/github-reviewed/2025/04/GHSA-75m2-jhh5-j5g2/GHSA-75m2-jhh5-j5g2.json b/advisories/github-reviewed/2025/04/GHSA-75m2-jhh5-j5g2/GHSA-75m2-jhh5-j5g2.json index 83e9e78f28d..a1d3dc1c2fd 100644 --- a/advisories/github-reviewed/2025/04/GHSA-75m2-jhh5-j5g2/GHSA-75m2-jhh5-j5g2.json +++ b/advisories/github-reviewed/2025/04/GHSA-75m2-jhh5-j5g2/GHSA-75m2-jhh5-j5g2.json @@ -1,9 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-75m2-jhh5-j5g2", - "modified": "2025-04-07T18:57:57Z", + "modified": "2025-04-07T21:11:45Z", "published": "2025-04-07T18:57:56Z", - "aliases": [], + "aliases": [ + "CVE-2025-32034" + ], "summary": "Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion", "details": "# Impact\n\n## Summary\n\nA vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service.\n\n## Details\n\nNamed fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved.\n\n## Fix/Mitigation\n\nA new **Query Fragment Expansion Limit** metric has been introduced:\n - This metric computes the number of selections a query would have if its fragment spreads were fully expanded.\n - The metric is checked against a limit to prevent excessive computation.\n\n# Patches\n\nThis has been remediated in `apollo-router` versions 1.61.2 and 2.1.1.\n\n# Workarounds\n\nThe only known workaround is \"Safelisting\" or \"Safelisting with IDs only\" per [Safelisting with Persisted Queries - Apollo GraphQL Docs](https://www.apollographql.com/docs/graphos/routing/security/persisted-queries#router-security-levels).\n\n# References\n\n[Query Planning Documentation](https://www.apollographql.com/docs/graphos/reference/federation/query-plans)\n\n## Acknowledgements\n\nWe appreciate the efforts of the security community in identifying and improving the performance and security of query planning mechanisms.", "severity": [ diff --git a/advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json b/advisories/github-reviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json similarity index 52% rename from advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json rename to advisories/github-reviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json index 47d966182e3..26afdc6c115 100644 --- a/advisories/unreviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json +++ b/advisories/github-reviewed/2025/04/GHSA-c995-4fw3-j39m/GHSA-c995-4fw3-j39m.json @@ -1,19 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-c995-4fw3-j39m", - "modified": "2025-04-07T15:31:22Z", + "modified": "2025-04-07T21:13:20Z", "published": "2025-04-07T15:31:22Z", "aliases": [ "CVE-2025-3248" ], - "details": "Langflow versions prior to 1.3.0 are susceptible to code injection in \nthe /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary\ncode.", + "summary": "Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint", + "details": "Langflow versions prior to 1.3.0 are susceptible to code injection in the `/api/v1/validate/code` endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "langflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/langflow-ai/langflow/pull/6911" }, + { + "type": "PACKAGE", + "url": "https://github.com/langflow-ai/langflow" + }, { "type": "WEB", "url": "https://github.com/langflow-ai/langflow/releases/tag/1.3.0" @@ -30,11 +55,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-306" + "CWE-306", + "CWE-94" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T21:13:20Z", "nvd_published_at": "2025-04-07T15:15:44Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-rr8g-9fpq-6wmg/GHSA-rr8g-9fpq-6wmg.json b/advisories/github-reviewed/2025/04/GHSA-rr8g-9fpq-6wmg/GHSA-rr8g-9fpq-6wmg.json new file mode 100644 index 00000000000..bcf48aa673e --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-rr8g-9fpq-6wmg/GHSA-rr8g-9fpq-6wmg.json @@ -0,0 +1,97 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rr8g-9fpq-6wmg", + "modified": "2025-04-07T21:12:50Z", + "published": "2025-04-07T21:12:50Z", + "aliases": [], + "summary": "Tokio broadcast channel calls clone in parallel, but does not require `Sync`", + "details": "The broadcast channel internally calls `clone` on the stored value when receiving it, and only requires `T:Send`. This means that using the broadcast channel with values that are `Send` but not `Sync` can trigger unsoundness if the `clone` implementation makes use of the value being `!Sync`.\n\nThank you to Austin Bonander for finding and reporting this issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "tokio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.44.0" + }, + { + "fixed": "1.44.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "tokio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.2.5" + }, + { + "fixed": "1.38.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "tokio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.39.0" + }, + { + "fixed": "1.43.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/tokio-rs/tokio/pull/7232" + }, + { + "type": "PACKAGE", + "url": "https://github.com/tokio-rs/tokio" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2025-0023.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-664" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-07T21:12:50Z", + "nvd_published_at": null + } +} \ No newline at end of file