Publish Advisories

GHSA-3x8x-79m2-3w2w
GHSA-jhjm-5xjg-mpqp
GHSA-fvcq-4x64-hqxr
GHSA-c6gw-w398-hv78

advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3x8x-79m2-3w2w",
-  "modified": "2023-03-23T18:23:19Z",
+  "modified": "2025-02-26T22:17:21Z",
   "published": "2023-03-19T00:30:25Z",
   "aliases": [
     "CVE-2021-46877"
@@ -85,7 +85,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-770"
+    ],
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-03-20T21:14:14Z",

advisories/github-reviewed/2023/03/GHSA-jhjm-5xjg-mpqp/GHSA-jhjm-5xjg-mpqp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jhjm-5xjg-mpqp",
-  "modified": "2023-03-24T22:20:38Z",
+  "modified": "2025-02-26T22:17:31Z",
   "published": "2023-03-21T21:30:19Z",
   "aliases": [
     "CVE-2023-27087"
@@ -50,7 +50,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-280"
+    ],
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-03-21T22:41:55Z",

advisories/github-reviewed/2024/06/GHSA-fvcq-4x64-hqxr/GHSA-fvcq-4x64-hqxr.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fvcq-4x64-hqxr",
-  "modified": "2024-06-12T19:18:36Z",
+  "modified": "2025-02-26T22:17:49Z",
   "published": "2024-06-11T21:12:47Z",
   "aliases": [
     "CVE-2024-35225"
   ],
   "summary": "Jupyter Server Proxy has a reflected XSS issue in host parameter",
-  "details": "### Impact\n\nThere is a reflected cross-site scripting (XSS) issue in `jupyter-server-proxy`[1]. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor.\nAs any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. This issue exists in the latest release of `jupyter-server-proxy`, currently `v4.1.2`.\n**Impacted versions:** `>=3.0.0,<=4.1.2`\n\n### Patches\n\nThe patches are included in `==4.2.0` and `==3.2.4`.\n\n### Workarounds\n\nServer operators who are unable to upgrade can disable the `jupyter-server-proxy` extension with:\n\n```\njupyter server extension disable jupyter-server-proxy\n```\n\n### References\n\n[1] : https://github.com/jupyterhub/jupyter-server-proxy/\n[2] : https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328\n",
+  "details": "### Impact\n\nThere is a reflected cross-site scripting (XSS) issue in `jupyter-server-proxy`[1]. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor.\nAs any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. This issue exists in the latest release of `jupyter-server-proxy`, currently `v4.1.2`.\n**Impacted versions:** `>=3.0.0,<=4.1.2`\n\n### Patches\n\nThe patches are included in `==4.2.0` and `==3.2.4`.\n\n### Workarounds\n\nServer operators who are unable to upgrade can disable the `jupyter-server-proxy` extension with:\n\n```\njupyter server extension disable jupyter-server-proxy\n```\n\n### References\n\n[1] : https://github.com/jupyterhub/jupyter-server-proxy/\n[2] : https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c6gw-w398-hv78",
-  "modified": "2025-02-25T18:38:50Z",
+  "modified": "2025-02-26T22:16:36Z",
   "published": "2025-02-24T22:49:19Z",
   "aliases": [
     "CVE-2025-27144"
@@ -33,6 +33,44 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/go-jose/go-jose/v3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/go-jose/go-jose"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0.4"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [