diff --git a/advisories/github-reviewed/2024/09/GHSA-635v-pc42-fr74/GHSA-635v-pc42-fr74.json b/advisories/github-reviewed/2024/09/GHSA-635v-pc42-fr74/GHSA-635v-pc42-fr74.json new file mode 100644 index 00000000000..a09e24cce64 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-635v-pc42-fr74/GHSA-635v-pc42-fr74.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-635v-pc42-fr74", + "modified": "2024-09-11T19:20:42Z", + "published": "2024-09-11T19:20:42Z", + "aliases": [ + + ], + "summary": "AWS SageMaker Training Toolkit logs CodeArtifact Authorization token", + "details": "## Description\nFor SageMaker Training Toolkit[1] versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact (temporary token with an expiration of 12 hours) were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their CloudWatch Log streams, anyone having access to cloudwatch logs within their AWS account, may be abe to see the authorization token. If the token is not expired, they may use the authorization token to publish or consume CodeArtifact package versions.\n\nThis issue was addressed in version 4.8.0. We recommend users upgrade to version 4.8.0 or higher. \n\nPlease note that users can add SageMaker Training Toolkit to any Docker container[2] used for SageMaker training[3]. It also comes pre-packaged with the prebuilt SageMaker Docker image[4] for SageMaker training. \n\n## Patches\nThis issue has been addressed in version 4.8.0 and higher.\n\n## Workarounds\nN/A\n\n## References\nN/A\n\nIf you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page[5] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://github.com/aws/sagemaker-training-toolkit\n[2] https://www.docker.com/resources/what-container/\n[3] https://aws.amazon.com/sagemaker/train/\n[4] https://docs.aws.amazon.com/sagemaker/latest/dg/pre-built-containers-frameworks-deep-learning.html\n[5] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "sagemaker-training" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.7.0" + }, + { + "fixed": "4.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aws/sagemaker-training-toolkit/security/advisories/GHSA-635v-pc42-fr74" + }, + { + "type": "WEB", + "url": "https://github.com/aws/sagemaker-training-toolkit/commit/d8e56c90fa7fcc7421c0f7193bf9650fc2967213" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aws/sagemaker-training-toolkit" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-11T19:20:42Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-64f8-pjgr-9wmr/GHSA-64f8-pjgr-9wmr.json b/advisories/github-reviewed/2024/09/GHSA-64f8-pjgr-9wmr/GHSA-64f8-pjgr-9wmr.json new file mode 100644 index 00000000000..768167f6ebd --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-64f8-pjgr-9wmr/GHSA-64f8-pjgr-9wmr.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-64f8-pjgr-9wmr", + "modified": "2024-09-11T19:20:08Z", + "published": "2024-09-11T19:20:07Z", + "aliases": [ + + ], + "summary": "Untrusted Query Object Evaluation in RPC API", + "details": "During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object representing a subquery. For this to materialize, this object would need to be encoded using the bincode serialization format instead of the default JSON serialization format or the additionally supported CBOR serialization format.\n\nIf a binary object containing a subquery were to be provided in this way, that subquery would be computed while executing the `SIGNIN` and `SIGNUP` queries defined by the database owner while defining a record access method. Since those queries are executed under a system user session with the editor role, an unauthenticated attacker may be able to leverage this behavior to select, create, update and delete non-IAM resources with permissions of a system user with the editor role.\n\n### Impact\n\nIf a record access method was defined with a `SIGNIN` or a `SIGNUP` query and the SurrealDB RPC API was exposed to untrusted users, an attacker could be able to craft a binary object containing a subquery to provide in place of valid credentials when calling the `signin` and `signup` operations via the RPC API with the bincode serialization format. The attacker could use that subquery to select, create, update and delete resources in SurrealDB, but they would not be able to _directly_ view the results of the query. This method cannot be used to create, update or delete IAM resources, as access to those kind of resources requires the owner role.\n\n### Patches\n\nObjects provided as variables to the sign in and sign up methods are now recursively validated to ensure that they do not contain any non-computed values, which include subqueries and other data types that could potentially result in query execution.\n\n- Version 1.5.5 and later are not affected by this issue.\n- Version 2.0.0-beta.3 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to update may want to disallow access to the SurrealDB RPC API using the affected binary serialization formats by conservatively allowing only requests to the `/rpc` endpoint of the SurrealDB HTTP server with the `application/json` content type. If the RPC API is not used at all or only used by trusted clients, disallowing or restricting access to the `/rpc` endpoint of the SurrealDB HTTP server will also prevent exploitation. Alternatively, if filtering HTTP requests is not possible, record access methods that define `SIGNIN` and `SIGNUP` clauses may be temporarily removed to completely prevent potential attacks leveraging this issue.\n\n### References\n\n- [SurrealDB Documentation - Authentication (Record Users)](https://surrealdb.com/docs/surrealdb/security/authentication#record-users)\n- [SurrealDB Documentation - RPC Protocol (Signup)](https://surrealdb.com/docs/surrealdb/integration/rpc#signup)\n- [SurrealDB Documentation - RPC Protocol (Signin)](https://surrealdb.com/docs/surrealdb/integration/rpc#signin)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0-beta.1" + }, + { + "fixed": "2.0.0-beta.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/commit/b7583a653a2c495a60630dffd663f506426db330" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/commit/eab7ef5354168d4039f7f7b77042c99a52f770a6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/surrealdb/surrealdb" + }, + { + "type": "WEB", + "url": "https://surrealdb.com/docs/surrealdb/integration/rpc#signin" + }, + { + "type": "WEB", + "url": "https://surrealdb.com/docs/surrealdb/integration/rpc#signup" + }, + { + "type": "WEB", + "url": "https://surrealdb.com/docs/surrealdb/security/authentication#record-users" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-75" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-11T19:20:07Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-rjc6-vm4h-85cg/GHSA-rjc6-vm4h-85cg.json b/advisories/github-reviewed/2024/09/GHSA-rjc6-vm4h-85cg/GHSA-rjc6-vm4h-85cg.json new file mode 100644 index 00000000000..782a58a546c --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-rjc6-vm4h-85cg/GHSA-rjc6-vm4h-85cg.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rjc6-vm4h-85cg", + "modified": "2024-09-11T19:20:57Z", + "published": "2024-09-11T19:20:57Z", + "aliases": [ + + ], + "summary": "Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs", + "details": "### Summary\nThe AWS Serverless Application Model (SAM) CLI is an open source tool that allows customers to build, deploy and test their serverless applications built on AWS. AWS SAM CLI can build container (Docker) images and customers can specify arguments in the SAM template that are passed to the Docker engine during build [1].\n\n### Impact\nIf customers specify sensitive data in the DockerBuildArgs parameter of their template, the sensitive data will be shown in clear text in the AWS SAM CLI output via STDERR when running the sam build command.\n\n### Patches\nA patch is included in aws-sam-cli>=1.122.0.\n\nWe strongly recommend customers install AWS SAM CLI v1.122.0 or above. Please review logs produced by your SAM CLI runs if you have used the DockerBuildArgs parameter and consider rotating the secrets if you believe they were exposed.\n\n### References\nIf you have any questions or comments about this issue, we ask that you contact AWS/Amazon Security via our vulnerability reporting page [2] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n[1] https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-using-build.html#build-container-image \n\n[2] https://aws.amazon.com/security/vulnerability-reporting\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "aws-sam-cli" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.122.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aws/aws-sam-cli/security/advisories/GHSA-rjc6-vm4h-85cg" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aws/aws-sam-cli" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-11T19:20:57Z", + "nvd_published_at": null + } +} \ No newline at end of file