From 5773a47a26ec21776f060cfde0dbfdae81e743e1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 26 Feb 2025 22:18:27 +0000 Subject: [PATCH] Publish Advisories GHSA-3x8x-79m2-3w2w GHSA-jhjm-5xjg-mpqp GHSA-fvcq-4x64-hqxr GHSA-c6gw-w398-hv78 --- .../GHSA-3x8x-79m2-3w2w.json | 6 ++- .../GHSA-jhjm-5xjg-mpqp.json | 6 ++- .../GHSA-fvcq-4x64-hqxr.json | 4 +- .../GHSA-c6gw-w398-hv78.json | 40 ++++++++++++++++++- 4 files changed, 49 insertions(+), 7 deletions(-) diff --git a/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json b/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json index 11934a3a304..351e02adf25 100644 --- a/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json +++ b/advisories/github-reviewed/2023/03/GHSA-3x8x-79m2-3w2w/GHSA-3x8x-79m2-3w2w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3x8x-79m2-3w2w", - "modified": "2023-03-23T18:23:19Z", + "modified": "2025-02-26T22:17:21Z", "published": "2023-03-19T00:30:25Z", "aliases": [ "CVE-2021-46877" @@ -85,7 +85,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-770" + ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-03-20T21:14:14Z", diff --git a/advisories/github-reviewed/2023/03/GHSA-jhjm-5xjg-mpqp/GHSA-jhjm-5xjg-mpqp.json b/advisories/github-reviewed/2023/03/GHSA-jhjm-5xjg-mpqp/GHSA-jhjm-5xjg-mpqp.json index 3e65ecf6f82..34bc6c0c3fa 100644 --- a/advisories/github-reviewed/2023/03/GHSA-jhjm-5xjg-mpqp/GHSA-jhjm-5xjg-mpqp.json +++ b/advisories/github-reviewed/2023/03/GHSA-jhjm-5xjg-mpqp/GHSA-jhjm-5xjg-mpqp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jhjm-5xjg-mpqp", - "modified": "2023-03-24T22:20:38Z", + "modified": "2025-02-26T22:17:31Z", "published": "2023-03-21T21:30:19Z", "aliases": [ "CVE-2023-27087" @@ -50,7 +50,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-280" + ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-03-21T22:41:55Z", diff --git a/advisories/github-reviewed/2024/06/GHSA-fvcq-4x64-hqxr/GHSA-fvcq-4x64-hqxr.json b/advisories/github-reviewed/2024/06/GHSA-fvcq-4x64-hqxr/GHSA-fvcq-4x64-hqxr.json index 99749e3d322..f4fd8d6032c 100644 --- a/advisories/github-reviewed/2024/06/GHSA-fvcq-4x64-hqxr/GHSA-fvcq-4x64-hqxr.json +++ b/advisories/github-reviewed/2024/06/GHSA-fvcq-4x64-hqxr/GHSA-fvcq-4x64-hqxr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-fvcq-4x64-hqxr", - "modified": "2024-06-12T19:18:36Z", + "modified": "2025-02-26T22:17:49Z", "published": "2024-06-11T21:12:47Z", "aliases": [ "CVE-2024-35225" ], "summary": "Jupyter Server Proxy has a reflected XSS issue in host parameter", - "details": "### Impact\n\nThere is a reflected cross-site scripting (XSS) issue in `jupyter-server-proxy`[1]. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/`, which runs the custom JavaScript contained in `host` set by the actor.\nAs any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. This issue exists in the latest release of `jupyter-server-proxy`, currently `v4.1.2`.\n**Impacted versions:** `>=3.0.0,<=4.1.2`\n\n### Patches\n\nThe patches are included in `==4.2.0` and `==3.2.4`.\n\n### Workarounds\n\nServer operators who are unable to upgrade can disable the `jupyter-server-proxy` extension with:\n\n```\njupyter server extension disable jupyter-server-proxy\n```\n\n### References\n\n[1] : https://github.com/jupyterhub/jupyter-server-proxy/\n[2] : https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328\n", + "details": "### Impact\n\nThere is a reflected cross-site scripting (XSS) issue in `jupyter-server-proxy`[1]. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/`, which runs the custom JavaScript contained in `host` set by the actor.\nAs any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. This issue exists in the latest release of `jupyter-server-proxy`, currently `v4.1.2`.\n**Impacted versions:** `>=3.0.0,<=4.1.2`\n\n### Patches\n\nThe patches are included in `==4.2.0` and `==3.2.4`.\n\n### Workarounds\n\nServer operators who are unable to upgrade can disable the `jupyter-server-proxy` extension with:\n\n```\njupyter server extension disable jupyter-server-proxy\n```\n\n### References\n\n[1] : https://github.com/jupyterhub/jupyter-server-proxy/\n[2] : https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json b/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json index 8ad396f1956..70a70af606f 100644 --- a/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json +++ b/advisories/github-reviewed/2025/02/GHSA-c6gw-w398-hv78/GHSA-c6gw-w398-hv78.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c6gw-w398-hv78", - "modified": "2025-02-25T18:38:50Z", + "modified": "2025-02-26T22:16:36Z", "published": "2025-02-24T22:49:19Z", "aliases": [ "CVE-2025-27144" @@ -33,6 +33,44 @@ ] } ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/go-jose/go-jose/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/go-jose/go-jose" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.4" + } + ] + } + ] } ], "references": [