Publish Advisories

GHSA-mh55-gqvf-xfwm
GHSA-rrqr-7w59-637v

advisories/github-reviewed/2024/07/GHSA-mh55-gqvf-xfwm/GHSA-mh55-gqvf-xfwm.json

@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mh55-gqvf-xfwm",
+  "modified": "2024-07-05T19:42:48Z",
+  "published": "2024-07-05T19:42:48Z",
+  "aliases": [
+
+  ],
+  "summary": "Denial of service via malicious preflight requests in github.com/rs/cors",
+  "details": "Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/rs/cors"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.9.0"
+            },
+            {
+              "fixed": "1.11.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rs/cors/issues/170"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rs/cors/pull/171"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rs/cors"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-05T19:42:48Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/07/GHSA-rrqr-7w59-637v/GHSA-rrqr-7w59-637v.json

@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rrqr-7w59-637v",
+  "modified": "2024-07-05T19:42:11Z",
+  "published": "2024-07-05T19:42:11Z",
+  "aliases": [
+    "CVE-2024-39315"
+  ],
+  "summary": "Pomerium exposed OAuth2 access and ID tokens in user info endpoint response",
+  "details": "### Impact\n\nThe Pomerium user info page (at `/.pomerium`) unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users.\n\nThis issue may be more severe in the presence of an XSS vulnerability in an upstream application proxied through Pomerium. If an attacker could insert a malicious script onto a web page proxied through Pomerium, that script could access these tokens by making a request to the `/.pomerium` endpoint.\n\nUpstream applications that authenticate only the ID token may be vulnerable to user impersonation using a token obtained in this manner.\n\nNote that an OAuth2 access token or ID token by itself is not sufficient to hijack a user's Pomerium session. Upstream applications should not be vulnerable to user impersonation via these tokens provided:\n- the application verifies the [Pomerium JWT](https://www.pomerium.com/docs/capabilities/getting-users-identity) for each request,\n- the connection between Pomerium and the application is secured by mTLS,\n- or the connection between Pomerium and the application is otherwise secured at the network layer.\n\n### Patches\nPatched in Pomerium v0.26.1.\n\n### Workarounds\nNone\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)\n- Email us at [security@pomerium.com](mailto:security@pomerium.com)\n\nCredit to Vadim Sheydaev, aka Enr1g for reporting this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/pomerium/pomerium"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.26.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/pomerium/pomerium/security/advisories/GHSA-rrqr-7w59-637v"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39315"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pomerium/pomerium/commit/4c7c4320afb2ced70ba19b46de1ac4383f3daa48"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pomerium/pomerium"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-201"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-05T19:42:11Z",
+    "nvd_published_at": "2024-07-02T20:15:06Z"
+  }
+}