From 64cb0e7741e7619bca2df193561bd91588091101 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 30 Jun 2023 20:27:39 +0000 Subject: [PATCH] Publish Advisories GHSA-cr8c-972v-rmp3 GHSA-74j8-w7f9-pp62 GHSA-7vr7-cghh-ch63 GHSA-9766-v29c-4vm7 GHSA-m54h-5x5f-5m6r GHSA-q57w-826p-46jr GHSA-q57w-826p-46jr --- .../GHSA-cr8c-972v-rmp3.json | 35 +++++++- .../GHSA-74j8-w7f9-pp62.json | 65 ++++++++++++++ .../GHSA-7vr7-cghh-ch63.json | 3 +- .../GHSA-9766-v29c-4vm7.json | 37 ++++++-- .../GHSA-m54h-5x5f-5m6r.json | 4 +- .../GHSA-q57w-826p-46jr.json | 90 +++++++++++++++++++ .../GHSA-q57w-826p-46jr.json | 39 -------- 7 files changed, 222 insertions(+), 51 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json (64%) create mode 100644 advisories/github-reviewed/2023/06/GHSA-74j8-w7f9-pp62/GHSA-74j8-w7f9-pp62.json rename advisories/{unreviewed => github-reviewed}/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json (58%) create mode 100644 advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json delete mode 100644 advisories/unreviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json diff --git a/advisories/unreviewed/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json b/advisories/github-reviewed/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json similarity index 64% rename from advisories/unreviewed/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json rename to advisories/github-reviewed/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json index 4478a413f09..ae54cde8937 100644 --- a/advisories/unreviewed/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json +++ b/advisories/github-reviewed/2022/03/GHSA-cr8c-972v-rmp3/GHSA-cr8c-972v-rmp3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cr8c-972v-rmp3", - "modified": "2022-03-29T00:01:39Z", + "modified": "2023-06-30T20:26:42Z", "published": "2022-03-17T00:00:24Z", "aliases": [ "CVE-2022-0959" ], + "summary": "pgAdmin 4 Path Traversal vulnerability", "details": "When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques being used to store files outside of the storage directory. A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.", "severity": [ { @@ -14,16 +15,42 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "pgadmin4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.7" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0959" }, + { + "type": "WEB", + "url": "https://github.com/pgadmin-org/pgadmin4/commit/dccd4f0bbaafa783d9f0360c7592b128d5cc3928" + }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2063759" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgadmin-org/pgadmin4" } ], "database_specific": { @@ -32,8 +59,8 @@ "CWE-434" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-06-30T20:26:42Z", "nvd_published_at": "2022-03-16T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-74j8-w7f9-pp62/GHSA-74j8-w7f9-pp62.json b/advisories/github-reviewed/2023/06/GHSA-74j8-w7f9-pp62/GHSA-74j8-w7f9-pp62.json new file mode 100644 index 00000000000..715eed1926d --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-74j8-w7f9-pp62/GHSA-74j8-w7f9-pp62.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-74j8-w7f9-pp62", + "modified": "2023-06-30T20:25:52Z", + "published": "2023-06-30T20:25:52Z", + "aliases": [ + "CVE-2023-33190" + ], + "summary": "Improper configuration of RBAC permissions obtaining cluster control permissions", + "details": "### Summary\nImproper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster.\n\n### Details\ndetail's is disable by publish.\n\n### PoC\ndetail's is disable by publish.\n\n### Impact\n+ sealos public cloud user\n+ CWE-287 Improper Authentication\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/labring/sealos" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.2.1-rc4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33190" + }, + { + "type": "WEB", + "url": "https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/labring/sealos" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2023-06-30T20:25:52Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-7vr7-cghh-ch63/GHSA-7vr7-cghh-ch63.json b/advisories/github-reviewed/2023/06/GHSA-7vr7-cghh-ch63/GHSA-7vr7-cghh-ch63.json index 970828dc824..79207188256 100644 --- a/advisories/github-reviewed/2023/06/GHSA-7vr7-cghh-ch63/GHSA-7vr7-cghh-ch63.json +++ b/advisories/github-reviewed/2023/06/GHSA-7vr7-cghh-ch63/GHSA-7vr7-cghh-ch63.json @@ -78,7 +78,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-402" + "CWE-402", + "CWE-668" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/unreviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json b/advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json similarity index 58% rename from advisories/unreviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json rename to advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json index 04e13e16f71..f6bad5a8328 100644 --- a/advisories/unreviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json +++ b/advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-9766-v29c-4vm7", - "modified": "2023-06-27T12:30:42Z", + "modified": "2023-06-30T20:26:04Z", "published": "2023-06-27T12:30:42Z", "aliases": [ "CVE-2023-34395" ], + "summary": "Apache Airflow ODBC Provider Argument Injection vulnerability", "details": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.\nIn OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.\nStarting version 4.0.0 driver can be set only from the hook constructor.\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0.\n\n", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow-providers-odbc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/31713" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd" @@ -31,9 +58,9 @@ "cwe_ids": [ "CWE-88" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-06-30T20:26:04Z", "nvd_published_at": null } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-m54h-5x5f-5m6r/GHSA-m54h-5x5f-5m6r.json b/advisories/github-reviewed/2023/06/GHSA-m54h-5x5f-5m6r/GHSA-m54h-5x5f-5m6r.json index 743154caebd..6a7cde3d9cd 100644 --- a/advisories/github-reviewed/2023/06/GHSA-m54h-5x5f-5m6r/GHSA-m54h-5x5f-5m6r.json +++ b/advisories/github-reviewed/2023/06/GHSA-m54h-5x5f-5m6r/GHSA-m54h-5x5f-5m6r.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-m54h-5x5f-5m6r", - "modified": "2023-06-28T22:48:50Z", + "modified": "2023-06-30T20:25:41Z", "published": "2023-06-28T22:48:50Z", "aliases": [ "CVE-2023-35930" ], "summary": "SpiceDB's LookupResources may return partial results", - "details": "### Impact\nAny user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.\n\nFor example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may.\n\nGenerally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.\n\n### Workarounds\nAvoid using `LookupResources` for negative authorization decisions if using `1.22.0`. \n\n### Patches\nThe only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag).\n\n### References\n- https://github.com/authzed/spicedb/pull/1397\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)\n* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)\n", + "details": "### Impact\nAny user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.\n\nFor example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may.\n\nGenerally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.\n\n### Workarounds\nAvoid using `LookupResources` for negative authorization decisions if using `1.22.0`. \n\n### Patches\nThe only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag).\n\n### References\n- https://github.com/authzed/spicedb/pull/1397\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)\n* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json b/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json new file mode 100644 index 00000000000..39803ea21e7 --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json @@ -0,0 +1,90 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q57w-826p-46jr", + "modified": "2023-06-30T20:26:33Z", + "published": "2023-06-27T12:30:42Z", + "aliases": [ + "CVE-2023-35798" + ], + "summary": "Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability", + "details": "Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.\n\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.\n\nIt is recommended to upgrade to a version that is not affected\n\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow-providers-odbc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow-providers-microsoft-mssql" + }, + "ecosystem_specific": { + "affected_functions": [ + "airflow.providers.microsoft.mssql.hooks.mssql.MsSqlHook.get_sqlalchemy_connection" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.4.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35798" + }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/pull/31984" + }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/b6836986846058e9e5fa271fb7b22ae721020787" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-06-30T20:26:33Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json b/advisories/unreviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json deleted file mode 100644 index 9be583deca0..00000000000 --- a/advisories/unreviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q57w-826p-46jr", - "modified": "2023-06-27T12:30:42Z", - "published": "2023-06-27T12:30:42Z", - "aliases": [ - "CVE-2023-35798" - ], - "details": "Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.\n\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.\n\nIt is recommended to upgrade to a version that is not affected\n\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35798" - }, - { - "type": "WEB", - "url": "https://github.com/apache/airflow/pull/31984" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file