From 574cf006283c2060edbfecb630b5f4b1a8912d41 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 3 Jan 2024 21:46:14 +0000 Subject: [PATCH] Publish Advisories GHSA-7c44-7j7v-w554 GHSA-q7rx-w656-fwmv GHSA-r6r4-5pr8-gjcp GHSA-q7rx-w656-fwmv --- .../GHSA-7c44-7j7v-w554.json | 35 +++++++- .../GHSA-q7rx-w656-fwmv.json | 90 +++++++++++++++++++ .../GHSA-r6r4-5pr8-gjcp.json | 68 ++++++++++++++ .../GHSA-q7rx-w656-fwmv.json | 38 -------- 4 files changed, 189 insertions(+), 42 deletions(-) rename advisories/{unreviewed => github-reviewed}/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json (53%) create mode 100644 advisories/github-reviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json create mode 100644 advisories/github-reviewed/2024/01/GHSA-r6r4-5pr8-gjcp/GHSA-r6r4-5pr8-gjcp.json delete mode 100644 advisories/unreviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json diff --git a/advisories/unreviewed/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json b/advisories/github-reviewed/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json similarity index 53% rename from advisories/unreviewed/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json rename to advisories/github-reviewed/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json index b5a1ba792b4..c746841b3c4 100644 --- a/advisories/unreviewed/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json +++ b/advisories/github-reviewed/2023/12/GHSA-7c44-7j7v-w554/GHSA-7c44-7j7v-w554.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7c44-7j7v-w554", - "modified": "2024-01-03T03:30:32Z", + "modified": "2024-01-03T21:45:42Z", "published": "2023-12-22T12:31:50Z", "aliases": [ "CVE-2023-43116" ], + "summary": "Buildkite Elastic CI for AWS symbolic link following vulnerability", "details": "A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.", "severity": [ { @@ -14,16 +15,42 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/buildkite/elastic-ci-stack-for-aws/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.7.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43116" }, + { + "type": "WEB", + "url": "https://github.com/buildkite/elastic-ci-stack-for-aws/commit/8f79882b6aa18fb8fc61f10c7047d2907b7a2f69" + }, { "type": "WEB", "url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md" + }, + { + "type": "PACKAGE", + "url": "https://github.com/buildkite/elastic-ci-stack-for-aws" } ], "database_specific": { @@ -31,8 +58,8 @@ "CWE-59" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:45:42Z", "nvd_published_at": "2023-12-22T10:15:11Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json b/advisories/github-reviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json new file mode 100644 index 00000000000..c344499ea1d --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7rx-w656-fwmv", + "modified": "2024-01-03T21:44:56Z", + "published": "2024-01-02T12:30:18Z", + "aliases": [ + "CVE-2023-48732" + ], + "summary": "Mattermost notified all users in the channel when using WebSockets to respond individually", + "details": "Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.1.6" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.7" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 8.1.6" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48732" + }, + { + "type": "WEB", + "url": "https://github.com/mattermost/mattermost/commit/851515be222160bee0a495c0d411056b19ed4111" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:44:56Z", + "nvd_published_at": "2024-01-02T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-r6r4-5pr8-gjcp/GHSA-r6r4-5pr8-gjcp.json b/advisories/github-reviewed/2024/01/GHSA-r6r4-5pr8-gjcp/GHSA-r6r4-5pr8-gjcp.json new file mode 100644 index 00000000000..ee4c981b200 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-r6r4-5pr8-gjcp/GHSA-r6r4-5pr8-gjcp.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r6r4-5pr8-gjcp", + "modified": "2024-01-03T21:44:35Z", + "published": "2024-01-03T21:44:35Z", + "aliases": [ + "CVE-2024-21631" + ], + "summary": "Vapor contains an integer overflow in URI leading to potential host spoofing", + "details": "Vapor's `vapor_urlparser_parse` function uses `uint16_t` indexes when parsing a URI's components, which may cause integer overflows when parsing untrusted inputs.\n\nThis vulnerability does not affect Vapor directly but could impact applications relying on the URI type for validating user input. \n\nThe URI type is used in several places in Vapor. A developer may decide to use URI to represent a URL in their application (especially if that URL is then passed to the HTTP Client) and rely on its public properties and methods. However, URI may fail to properly parse a valid (albeit abnormally long) URL, due to string ranges being converted to 16-bit integers. An attacker may use this behaviour to trick the application into accepting a URL to an untrusted destination.\n\nBy padding the port number with zeros, an attacker can cause an integer overflow to occur when the URL authority is parsed and, as a result, spoof the host.\n\n### Impact\nUsers attempting to treat untrusted input as a URI are vulnerable to a host spoofing attack due to an integer overflow.\n\n### Workarounds\nValidate user input before parsing as a URI or, if possible, use Foundation's `URL` and `URLComponents` utilities.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "SwiftURL", + "name": "https://github.com/vapor/vapor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.90.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.89.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vapor/vapor/security/advisories/GHSA-r6r4-5pr8-gjcp" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21631" + }, + { + "type": "WEB", + "url": "https://github.com/vapor/vapor/commit/6db3d917b5ce5024a84eb265ef65691383305d70" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vapor/vapor" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1104" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T21:44:35Z", + "nvd_published_at": "2024-01-03T17:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json b/advisories/unreviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json deleted file mode 100644 index 4bf957cdac3..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-q7rx-w656-fwmv/GHSA-q7rx-w656-fwmv.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q7rx-w656-fwmv", - "modified": "2024-01-02T12:30:18Z", - "published": "2024-01-02T12:30:18Z", - "aliases": [ - "CVE-2023-48732" - ], - "details": "Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48732" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-02T10:15:08Z" - } -} \ No newline at end of file