diff --git a/advisories/unreviewed/2022/05/GHSA-4mh5-jj5w-3f9q/GHSA-4mh5-jj5w-3f9q.json b/advisories/github-reviewed/2022/05/GHSA-4mh5-jj5w-3f9q/GHSA-4mh5-jj5w-3f9q.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-4mh5-jj5w-3f9q/GHSA-4mh5-jj5w-3f9q.json rename to advisories/github-reviewed/2022/05/GHSA-4mh5-jj5w-3f9q/GHSA-4mh5-jj5w-3f9q.json index ebc10fbab31..5411c919c3d 100644 --- a/advisories/unreviewed/2022/05/GHSA-4mh5-jj5w-3f9q/GHSA-4mh5-jj5w-3f9q.json +++ b/advisories/github-reviewed/2022/05/GHSA-4mh5-jj5w-3f9q/GHSA-4mh5-jj5w-3f9q.json @@ -1,19 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-4mh5-jj5w-3f9q", - "modified": "2025-04-20T03:50:38Z", + "modified": "2025-04-21T16:18:22Z", "published": "2022-05-13T01:31:04Z", "aliases": [ "CVE-2013-7400" ], + "summary": "The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information", "details": "The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.", "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "directmailteam/direct-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.2" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -23,9 +44,13 @@ "type": "WEB", "url": "https://extensions.typo3.org/extension/direct_mail" }, + { + "type": "PACKAGE", + "url": "https://github.com/kartolo/direct_mail" + }, { "type": "WEB", - "url": "https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2013-014" + "url": "https://typo3.org/security/advisory/typo3-ext-sa-2013-014" }, { "type": "WEB", @@ -37,8 +62,8 @@ "CWE-200" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-21T16:18:22Z", "nvd_published_at": "2017-12-29T15:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-5vxx-c285-pcq4/GHSA-5vxx-c285-pcq4.json b/advisories/github-reviewed/2025/04/GHSA-5vxx-c285-pcq4/GHSA-5vxx-c285-pcq4.json new file mode 100644 index 00000000000..ee15bf322ce --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-5vxx-c285-pcq4/GHSA-5vxx-c285-pcq4.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5vxx-c285-pcq4", + "modified": "2025-04-21T16:17:49Z", + "published": "2025-04-21T16:17:49Z", + "aliases": [ + "CVE-2025-32793" + ], + "summary": "In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters", + "details": "### Impact\n\nWhen using [Wireguard transparent encryption](https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg) in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.\n\n### Patches\n\nThis issue has been patched in https://github.com/cilium/cilium/pull/38592.\n\nThis issue affects:\n\n- Cilium v1.15 between v1.15.0 and v1.15.15 inclusive\n- Cilium v1.16 between v1.16.0 and v1.16.8 inclusive\n- Cilium v1.17 between v1.17.0 and v1.17.2 inclusive\n\nThis issue is fixed in:\n\n- Cilium v1.15.16\n- Cilium v1.16.9\n- Cilium v1.17.3\n\n### Workarounds\n\nThere is no workaround to this issue.\n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch.\n\n### For more information\n\nIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cilium/cilium" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "1.15.16" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cilium/cilium" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.16.0" + }, + { + "fixed": "1.16.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cilium/cilium" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.17.0" + }, + { + "fixed": "1.17.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4" + }, + { + "type": "WEB", + "url": "https://github.com/cilium/cilium/pull/38592" + }, + { + "type": "WEB", + "url": "https://github.com/cilium/cilium/commit/e8543eef05126e9ba8a845dc74e96f4e30f6dba9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cilium/cilium" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319", + "CWE-362" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-21T16:17:49Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-6p68-w45g-48j7/GHSA-6p68-w45g-48j7.json b/advisories/github-reviewed/2025/04/GHSA-6p68-w45g-48j7/GHSA-6p68-w45g-48j7.json new file mode 100644 index 00000000000..5f1e43a93c2 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-6p68-w45g-48j7/GHSA-6p68-w45g-48j7.json @@ -0,0 +1,129 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6p68-w45g-48j7", + "modified": "2025-04-21T16:17:38Z", + "published": "2025-04-21T16:17:38Z", + "aliases": [ + "CVE-2025-32431" + ], + "summary": "Traefik has a possible vulnerability with the path matchers", + "details": "## Impact\n\nThere is a potential vulnerability in Traefik managing the requests using a `PathPrefix`, `Path` or `PathRegex` matcher.\n\nWhen Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a `/../` in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.\n\n## Example\n\n```yaml\napiVersion: traefik.io/v1alpha1\nkind: IngressRoute\nmetadata:\n name: my-service\nspec:\n routes:\n - match: PathPrefix(‘/service’)\n kind: Rule\n services:\n - name: service-a\n port: 8080\n middlewares:\n - name: my-middleware-a\n - match: PathPrefix(‘/service/sub-path’)\n kind: Rule\n services:\n - name: service-a\n port: 8080\n```\n\nIn such a case, the request `http://mydomain.example.com/service/sub-path/../other-path` will reach the backend `my-service-a` without operating the middleware `my-middleware-a` unless the computed path is `http://mydomain.example.com/service/other-path` and should be computes by the first router (operating `my-middleware-a`).\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.24\n- https://github.com/traefik/traefik/releases/tag/v3.3.6\n- https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2\n\n## Workaround\n\nAdd a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.\n\nExample: \n\n```yaml\nmatch: PathPrefix(`/service`) && !PathRegexp(`(?:(/\\.\\./)+.*)`)\n```\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [[open an issue](https://github.com/traefik/traefik/issues)](https://github.com/traefik/traefik/issues).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.7.34" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.11.23" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/traefik/traefik/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.4.0-rc1" + }, + { + "fixed": "3.4.0-rc2" + } + ] + } + ], + "versions": [ + "3.4.0-rc1" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/security/advisories/GHSA-6p68-w45g-48j7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/traefik/traefik" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v2.11.24" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.3.6" + }, + { + "type": "WEB", + "url": "https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-21T16:17:38Z", + "nvd_published_at": null + } +} \ No newline at end of file