From 6de762260fc24a7f778aa1e15a0a68cf351b2348 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 5 Jan 2024 15:29:08 +0000 Subject: [PATCH] Publish Advisories GHSA-x2xw-hw8g-6773 GHSA-hjp3-5g2q-7jww GHSA-4mvm-xh8j-fv27 GHSA-v444-jggx-6v7f GHSA-4mvm-xh8j-fv27 --- .../GHSA-x2xw-hw8g-6773.json | 8 ++- .../GHSA-hjp3-5g2q-7jww.json | 8 ++- .../GHSA-4mvm-xh8j-fv27.json | 71 +++++++++++++++++++ .../GHSA-v444-jggx-6v7f.json | 32 +++++++-- .../GHSA-4mvm-xh8j-fv27.json | 51 ------------- 5 files changed, 109 insertions(+), 61 deletions(-) create mode 100644 advisories/github-reviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json (54%) delete mode 100644 advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json diff --git a/advisories/github-reviewed/2023/04/GHSA-x2xw-hw8g-6773/GHSA-x2xw-hw8g-6773.json b/advisories/github-reviewed/2023/04/GHSA-x2xw-hw8g-6773/GHSA-x2xw-hw8g-6773.json index 273aa183615..906e7aa3c77 100644 --- a/advisories/github-reviewed/2023/04/GHSA-x2xw-hw8g-6773/GHSA-x2xw-hw8g-6773.json +++ b/advisories/github-reviewed/2023/04/GHSA-x2xw-hw8g-6773/GHSA-x2xw-hw8g-6773.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-x2xw-hw8g-6773", - "modified": "2023-04-11T15:41:30Z", + "modified": "2024-01-05T15:28:23Z", "published": "2023-04-11T15:41:30Z", "aliases": [ - + "CVE-2024-22048" ], "summary": "govuk_tech_docs vulnerable to unescaped HTML on search results page", "details": "### Impact\n\nPages that are indexed in search results have their entire contents indexed, including any HTML code snippets. These HTML snippets would appear in the search results unsanitised, so it was possible to render arbitrary HTML or run arbitrary scripts.\n\nThis is a low risk security issue; to exploit it, an attacker would need to find a way of committing malicious code to a page indexed by a site that uses tech-docs-gem (which are typically not editable by untrusted users). Their code would also be limited by the relatively short length that's rendered in the corresponding search result. Nevertheless, the XSS would then be triggerable by visiting a pre-constructed URL (/search/index.html?q=some+search+term), which users could be tricked into clicking on through social engineering.\n\n### Patches\n\nThis has been fixed in v3.3.1. HTML is now sanitised in search results.", @@ -37,6 +37,10 @@ "type": "WEB", "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048" + }, { "type": "WEB", "url": "https://github.com/alphagov/tech-docs-gem/pull/323" diff --git a/advisories/github-reviewed/2023/05/GHSA-hjp3-5g2q-7jww/GHSA-hjp3-5g2q-7jww.json b/advisories/github-reviewed/2023/05/GHSA-hjp3-5g2q-7jww/GHSA-hjp3-5g2q-7jww.json index f785f69f40d..b0594e0b898 100644 --- a/advisories/github-reviewed/2023/05/GHSA-hjp3-5g2q-7jww/GHSA-hjp3-5g2q-7jww.json +++ b/advisories/github-reviewed/2023/05/GHSA-hjp3-5g2q-7jww/GHSA-hjp3-5g2q-7jww.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-hjp3-5g2q-7jww", - "modified": "2023-05-01T14:00:47Z", + "modified": "2024-01-05T15:27:28Z", "published": "2023-05-01T14:00:47Z", "aliases": [ - + "CVE-2024-22047" ], "summary": "Race Condition leading to logging errors", "details": "In certain setups with threaded web servers, Audited's use of `Thread.current` can incorrectly attributed audits to the wrong user. \n\nFixed in 5.3.3. \n\nIn March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.\n\n- The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601 \n- So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669 \n- And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671\n", @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22047" + }, { "type": "WEB", "url": "https://github.com/collectiveidea/audited/issues/601" diff --git a/advisories/github-reviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json b/advisories/github-reviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json new file mode 100644 index 00000000000..8afedbed562 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json @@ -0,0 +1,71 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4mvm-xh8j-fv27", + "modified": "2024-01-05T15:28:17Z", + "published": "2024-01-04T21:30:24Z", + "withdrawn": "2024-01-05T15:28:17Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page", + "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-x2xw-hw8g-6773. This link is maintained to preserve external references.\n\n### Original Description\n versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "govuk_tech_docs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 3.3.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048" + }, + { + "type": "WEB", + "url": "https://github.com/alphagov/tech-docs-gem/pull/323" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773" + }, + { + "type": "WEB", + "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-01-05T15:28:17Z", + "nvd_published_at": "2024-01-04T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json b/advisories/github-reviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json similarity index 54% rename from advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json rename to advisories/github-reviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json index 5fe246e99bc..40a7196ff66 100644 --- a/advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json +++ b/advisories/github-reviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json @@ -1,12 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-v444-jggx-6v7f", - "modified": "2024-01-04T21:30:24Z", + "modified": "2024-01-05T15:27:09Z", "published": "2024-01-04T21:30:24Z", + "withdrawn": "2024-01-05T15:27:09Z", "aliases": [ - "CVE-2024-22047" + ], - "details": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n", + "summary": "Duplicate Advisory: Race Condition leading to logging errors", + "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-hjp3-5g2q-7jww. This link is maintained to preserve external references.\n\n### Original Description\nA race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n", "severity": [ { "type": "CVSS_V3", @@ -14,7 +16,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "RubyGems", + "name": "audited" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 5.3.3" + } + } ], "references": [ { @@ -51,8 +71,8 @@ "CWE-362" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-05T15:27:09Z", "nvd_published_at": "2024-01-04T21:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json b/advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json deleted file mode 100644 index 69f886afd0c..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4mvm-xh8j-fv27", - "modified": "2024-01-04T21:30:24Z", - "published": "2024-01-04T21:30:24Z", - "aliases": [ - "CVE-2024-22048" - ], - "details": "govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048" - }, - { - "type": "WEB", - "url": "https://github.com/alphagov/tech-docs-gem/pull/323" - }, - { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773" - }, - { - "type": "WEB", - "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1" - }, - { - "type": "WEB", - "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-04T21:15:09Z" - } -} \ No newline at end of file