Publish Advisories

GHSA-2c47-m757-32g6
GHSA-9pp5-9c7g-4r83

advisories/github-reviewed/2025/05/GHSA-2c47-m757-32g6/GHSA-2c47-m757-32g6.json

@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2c47-m757-32g6",
+  "modified": "2025-05-21T18:32:37Z",
+  "published": "2025-05-21T18:32:37Z",
+  "aliases": [
+    "CVE-2025-48069"
+  ],
+  "summary": "Insufficient input sanitization in ejson2env ",
+  "details": "### Summary\nThe `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection vulnerabilities, allowing an attacker to execute arbitrary commands on the host system.\n\n### Details\nThe vulnerability exists because environment variables are not properly sanitized during the decryption phase, which enables malicious keys or encrypted values to inject commands.\n\n### Impact\nAn attacker with control over  `.ejson` files can inject commands in the environment where `source $(ejson2env)`  or `eval ejson2env` are executed.\n\n\n### Mitigation\n- Update to a version of `ejson2env` that sanitizes the output during decryption or\n- Do not use `ejson2env` to decrypt untrusted user secrets or\n- Do not evaluate or execute the direct output from `ejson2env` without removing nonprintable characters.\n\n### Credit\nThanks to security researcher [Demonia](https://hackerone.com/demonia?type=user) for reporting this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/Shopify/ejson2env/v2"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.0.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "ejson2env"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.0.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/Shopify/ejson2env"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 2.0.8"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Shopify/ejson2env"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-21T18:32:37Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/05/GHSA-9pp5-9c7g-4r83/GHSA-9pp5-9c7g-4r83.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9pp5-9c7g-4r83",
-  "modified": "2025-05-21T15:30:33Z",
+  "modified": "2025-05-21T18:31:29Z",
   "published": "2025-05-21T15:30:33Z",
   "aliases": [
     "CVE-2025-41232"
   ],
+  "summary": "Spring Security authorization bypass for method security annotations on private methods",
   "details": "Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.\n\nYour application may be affected by this if the following are true:\n\n  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and\n  *  You have Spring Security method annotations on a private method\nIn that case, the target method may be able to be invoked without proper authorization.\n\nYou are not affected if:\n\n  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or\n  *  You have no Spring Security-annotated private methods",
   "severity": [
     {
@@ -13,12 +14,36 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework.security:spring-security-aspects"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.4.0"
+            },
+            {
+              "fixed": "6.4.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41232"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/spring-projects/spring-security"
+    },
     {
       "type": "WEB",
       "url": "http://spring.io/security/cve-2025-41232"
@@ -29,8 +54,8 @@
       "CWE-693"
     ],
     "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-21T18:31:29Z",
     "nvd_published_at": "2025-05-21T12:16:21Z"
   }
 }