From 634a78636eff5ffc590eb16832d7f0fa54692feb Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 7 Feb 2025 20:47:08 +0000 Subject: [PATCH] Publish Advisories GHSA-x5rv-w9pm-8qp8 GHSA-rggv-cv7r-mw98 GHSA-8p25-3q46-8q2p --- .../2023/03/GHSA-x5rv-w9pm-8qp8/GHSA-x5rv-w9pm-8qp8.json | 9 +++++++-- .../2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json | 7 ++++--- .../2024/03/GHSA-8p25-3q46-8q2p/GHSA-8p25-3q46-8q2p.json | 4 ++-- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/advisories/github-reviewed/2023/03/GHSA-x5rv-w9pm-8qp8/GHSA-x5rv-w9pm-8qp8.json b/advisories/github-reviewed/2023/03/GHSA-x5rv-w9pm-8qp8/GHSA-x5rv-w9pm-8qp8.json index 43c467721b9..fc42f2a176b 100644 --- a/advisories/github-reviewed/2023/03/GHSA-x5rv-w9pm-8qp8/GHSA-x5rv-w9pm-8qp8.json +++ b/advisories/github-reviewed/2023/03/GHSA-x5rv-w9pm-8qp8/GHSA-x5rv-w9pm-8qp8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-x5rv-w9pm-8qp8", - "modified": "2025-01-31T14:21:39Z", + "modified": "2025-02-07T20:45:09Z", "published": "2023-03-01T19:17:17Z", "aliases": [ "CVE-2023-0092" ], "summary": "Juju controller - Arbitrary file reading vulnerability", - "details": "### Impact\nAn authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.\n\n### Patches\nPatched in juju 2.9.38 and juju 3.0.3\n[juju/juju#ef803e2](https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556)\n\n### Workarounds\nLimit read access to the controller model to only trusted users.\n", + "details": "### Impact\nAn authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.\n\n### Patches\nPatched in juju 2.9.38 and juju 3.0.3\n[juju/juju#ef803e2](https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556)\n\n### Workarounds\nLimit read access to the controller model to only trusted users.", "severity": [ { "type": "CVSS_V3", @@ -71,6 +71,10 @@ "type": "WEB", "url": "https://bugs.launchpad.net/juju/+bug/1999622" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-x5rv-w9pm-8qp8" + }, { "type": "PACKAGE", "url": "https://github.com/juju/juju" @@ -78,6 +82,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-22", "CWE-73" ], "severity": "MODERATE", diff --git a/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json b/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json index 0c82ffec009..0930c5179a4 100644 --- a/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json +++ b/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-rggv-cv7r-mw98", - "modified": "2024-05-02T18:38:17Z", + "modified": "2025-02-07T20:44:34Z", "published": "2024-02-26T20:13:46Z", "aliases": [ "CVE-2024-22201" ], "summary": "Connection leaking on idle timeout when TCP congested", - "details": "### Impact\nIf an HTTP/2 connection gets TCP congested, when an idle timeout occurs the HTTP/2 session is marked as closed, and then a GOAWAY frame is queued to be written.\nHowever it is not written because the connection is TCP congested.\nWhen another idle timeout period elapses, it is then supposed to hard close the connection, but it delegates to the HTTP/2 session which reports that it has already been closed so it does not attempt to hard close the connection.\n\nThis leaves the connection in ESTABLISHED state (i.e. not closed), TCP congested, and idle.\n\nAn attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients.\n\nThe client may also be impacted (if the server does not read causing a TCP congestion), but the issue is more severe for servers.\n\n### Patches\nPatched versions:\n* 9.4.54\n* 10.0.20\n* 11.0.20\n* 12.0.6\n\n### Workarounds\nDisable HTTP/2 and HTTP/3 support until you can upgrade to a patched version of Jetty.\nHTTP/1.x is not affected.\n\n### References\n* https://github.com/jetty/jetty.project/issues/11256.\n", + "details": "### Impact\nIf an HTTP/2 connection gets TCP congested, when an idle timeout occurs the HTTP/2 session is marked as closed, and then a GOAWAY frame is queued to be written.\nHowever it is not written because the connection is TCP congested.\nWhen another idle timeout period elapses, it is then supposed to hard close the connection, but it delegates to the HTTP/2 session which reports that it has already been closed so it does not attempt to hard close the connection.\n\nThis leaves the connection in ESTABLISHED state (i.e. not closed), TCP congested, and idle.\n\nAn attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients.\n\nThe client may also be impacted (if the server does not read causing a TCP congestion), but the issue is more severe for servers.\n\n### Patches\nPatched versions:\n* 9.4.54\n* 10.0.20\n* 11.0.20\n* 12.0.6\n\n### Workarounds\nDisable HTTP/2 and HTTP/3 support until you can upgrade to a patched version of Jetty.\nHTTP/1.x is not affected.\n\n### References\n* https://github.com/jetty/jetty.project/issues/11256.", "severity": [ { "type": "CVSS_V3", @@ -214,7 +214,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-770" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/03/GHSA-8p25-3q46-8q2p/GHSA-8p25-3q46-8q2p.json b/advisories/github-reviewed/2024/03/GHSA-8p25-3q46-8q2p/GHSA-8p25-3q46-8q2p.json index 4ea430da45a..9ac2b8bbccf 100644 --- a/advisories/github-reviewed/2024/03/GHSA-8p25-3q46-8q2p/GHSA-8p25-3q46-8q2p.json +++ b/advisories/github-reviewed/2024/03/GHSA-8p25-3q46-8q2p/GHSA-8p25-3q46-8q2p.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8p25-3q46-8q2p", - "modified": "2024-03-01T20:09:19Z", + "modified": "2025-02-07T20:44:54Z", "published": "2024-03-01T20:09:19Z", "aliases": [ "CVE-2024-27081" ], "summary": "ESPHome vulnerable to remote code execution via arbitrary file write", - "details": "### Summary\nSecurity misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.\n\n### Details\nIt is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory. \n\nThe vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.\n\n### PoC\n\"/edit?configuration=/config/.esphome/esphome.json\"\n
\n\n\"/edit?configuration=/config/.esphome/build/test01/src/main.cpp\n
\n\n\"RCE\n
\n\n\"Arbitrary\n\n\n### Impact\nThe issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards. \n\nIf chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.\n\nIt also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.\n\n### Credits\nSpike Reply Cybersecurity Team\n", + "details": "### Summary\nSecurity misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.\n\n### Details\nIt is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory. \n\nThe vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.\n\n### PoC\n\"/edit?configuration=/config/.esphome/esphome.json\"\n
\n\n\"/edit?configuration=/config/.esphome/build/test01/src/main.cpp\n
\n\n\"RCE\n
\n\n\"Arbitrary\n\n\n### Impact\nThe issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards. \n\nIf chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.\n\nIt also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.\n\n### Credits\nSpike Reply Cybersecurity Team", "severity": [ { "type": "CVSS_V3",