netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-x2xw-hw8g-6773
GHSA-hjp3-5g2q-7jww
GHSA-4mvm-xh8j-fv27
GHSA-v444-jggx-6v7f
GHSA-4mvm-xh8j-fv27
This commit is contained in:
advisory-database[bot]
2024-01-05 15:29:08 +00:00
parent 7faf244f18
commit 6de762260f
5 changed files with 109 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/04/GHSA-x2xw-hw8g-6773/GHSA-x2xw-hw8g-6773.json
+6 -2
View File
@@ -1,10 +1,10 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x2xw-hw8g-6773",
"modified": "2023-04-11T15:41:30Z",
"modified": "2024-01-05T15:28:23Z",
"published": "2023-04-11T15:41:30Z",
"aliases": [
"CVE-2024-22048"
],
"summary": "govuk_tech_docs vulnerable to unescaped HTML on search results page",
"details": "### Impact\n\nPages that are indexed in search results have their entire contents indexed, including any HTML code snippets. These HTML snippets would appear in the search results unsanitised, so it was possible to render arbitrary HTML or run arbitrary scripts.\n\nThis is a low risk security issue; to exploit it, an attacker would need to find a way of committing malicious code to a page indexed by a site that uses tech-docs-gem (which are typically not editable by untrusted users). Their code would also be limited by the relatively short length that's rendered in the corresponding search result. Nevertheless, the XSS would then be triggerable by visiting a pre-constructed URL (/search/index.html?q=some+search+term), which users could be tricked into clicking on through social engineering.\n\n### Patches\n\nThis has been fixed in v3.3.1. HTML is now sanitised in search results.",
@@ -37,6 +37,10 @@
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048"
},
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/pull/323"
advisories/github-reviewed/2023/05/GHSA-hjp3-5g2q-7jww/GHSA-hjp3-5g2q-7jww.json
+6 -2
View File
@@ -1,10 +1,10 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hjp3-5g2q-7jww",
"modified": "2023-05-01T14:00:47Z",
"modified": "2024-01-05T15:27:28Z",
"published": "2023-05-01T14:00:47Z",
"aliases": [
"CVE-2024-22047"
],
"summary": "Race Condition leading to logging errors",
"details": "In certain setups with threaded web servers, Audited's use of `Thread.current` can incorrectly attributed audits to the wrong user. \n\nFixed in 5.3.3. \n\nIn March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.\n\n- The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601 \n- So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669 \n- And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671\n",
@@ -40,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22047"
},
{
"type": "WEB",
"url": "https://github.com/collectiveidea/audited/issues/601"
advisories/github-reviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json
+71
View File
@@ -0,0 +1,71 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mvm-xh8j-fv27",
"modified": "2024-01-05T15:28:17Z",
"published": "2024-01-04T21:30:24Z",
"withdrawn": "2024-01-05T15:28:17Z",
"aliases": [
],
"summary": "Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page",
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-x2xw-hw8g-6773. This link is maintained to preserve external references.\n\n### Original Description\n versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "govuk_tech_docs"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "< 3.3.1"
}
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048"
},
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/pull/323"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773"
},
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-01-05T15:28:17Z",
"nvd_published_at": "2024-01-04T21:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json → advisories/github-reviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json
+26 -6
View File
@@ -1,12 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v444-jggx-6v7f",
"modified": "2024-01-04T21:30:24Z",
"modified": "2024-01-05T15:27:09Z",
"published": "2024-01-04T21:30:24Z",
"withdrawn": "2024-01-05T15:27:09Z",
"aliases": [
"CVE-2024-22047"
],
"details": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n",
"summary": "Duplicate Advisory: Race Condition leading to logging errors",
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-hjp3-5g2q-7jww. This link is maintained to preserve external references.\n\n### Original Description\nA race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +16,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "audited"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "< 5.3.3"
}
}
],
"references": [
{
@@ -51,8 +71,8 @@
"CWE-362"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-01-05T15:27:09Z",
"nvd_published_at": "2024-01-04T21:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json
-51
View File
@@ -1,51 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mvm-xh8j-fv27",
"modified": "2024-01-04T21:30:24Z",
"published": "2024-01-04T21:30:24Z",
"aliases": [
"CVE-2024-22048"
],
"details": "govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048"
},
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/pull/323"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773"
},
{
"type": "WEB",
"url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-04T21:15:09Z"
}
}