Publish Advisories

GHSA-593m-55hh-j8gv GHSA-5gc2-7c65-8fq8
2026-05-22 18:04:22 -07:00 · 2024-10-03 18:29:23 +00:00
parent 565565efc7
commit 62e2365f93
2 changed files with 142 additions and 0 deletions
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-593m-55hh-j8gv",
+  "modified": "2024-10-03T18:26:53Z",
+  "published": "2024-10-03T18:26:53Z",
+  "aliases": [
+
+  ],
+  "summary": "Sentry SDK Prototype Pollution gadget in JavaScript SDKs",
+  "details": "### Impact\nIn case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.\n\n> [!NOTE]\n> This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.\n\n### Patches\nThe issue was patched in all Sentry JavaScript SDKs starting from the [8.33.0](https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0) version.\n\n### References\n* [Prototype Pollution](https://portswigger.net/web-security/prototype-pollution)\n* [Prototype Pollution gadgets](https://portswigger.net/web-security/prototype-pollution#prototype-pollution-gadgets)\n* [sentry-javascript#13838](https://github.com/getsentry/sentry-javascript/pull/13838)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@sentry/browser"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "8.33.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-593m-55hh-j8gv"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/getsentry/sentry-javascript/pull/13838"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/getsentry/sentry-javascript/commit/35bdc87dee3498794e34c1ad35dd9927950c8766"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/getsentry/sentry-javascript"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/getsentry/sentry-javascript/releases/tag/8.33.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-913"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-03T18:26:53Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5gc2-7c65-8fq8",
+  "modified": "2024-10-03T18:27:11Z",
+  "published": "2024-10-03T18:27:11Z",
+  "aliases": [
+    "CVE-2024-47614"
+  ],
+  "summary": "async-graphql Directive Overload",
+  "details": "### Impact\n\n- Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime.\n- Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure.\n- User Experience Degradation: Users may experience delays or failures when accessing the service, which could lead to frustration and loss of trust in the service.\n\n### Patches\n\n1. Upgrade to v7.0.10\n2. Use [SchemaBuilder.limit_directives](https://docs.rs/async-graphql/latest/async_graphql/struct.SchemaBuilder.html#method.limit_directives) to limit the maximum number of directives for a single field.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "async-graphql"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "7.0.10"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/async-graphql/async-graphql/security/advisories/GHSA-5gc2-7c65-8fq8"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47614"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/async-graphql/async-graphql/commit/7f1791488463d4e9c5adcd543962173e2f6cbd34"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/async-graphql/async-graphql"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-03T18:27:11Z",
+    "nvd_published_at": "2024-10-03T15:15:14Z"
+  }
+}