From 6efa929b5e006ef2a89b63c9018a4ef710b6cbc6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 29 Aug 2024 17:56:55 +0000 Subject: [PATCH] Publish Advisories GHSA-9q39-rmj3-p4r2 GHSA-jm9m-rqr3-wfmh --- .../GHSA-9q39-rmj3-p4r2.json | 120 ++++++++++ .../GHSA-jm9m-rqr3-wfmh.json | 222 ++++++++++++++++++ 2 files changed, 342 insertions(+) create mode 100644 advisories/github-reviewed/2024/08/GHSA-9q39-rmj3-p4r2/GHSA-9q39-rmj3-p4r2.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-jm9m-rqr3-wfmh/GHSA-jm9m-rqr3-wfmh.json diff --git a/advisories/github-reviewed/2024/08/GHSA-9q39-rmj3-p4r2/GHSA-9q39-rmj3-p4r2.json b/advisories/github-reviewed/2024/08/GHSA-9q39-rmj3-p4r2/GHSA-9q39-rmj3-p4r2.json new file mode 100644 index 00000000000..e940daa7bc9 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-9q39-rmj3-p4r2/GHSA-9q39-rmj3-p4r2.json @@ -0,0 +1,120 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9q39-rmj3-p4r2", + "modified": "2024-08-29T17:55:53Z", + "published": "2024-08-29T17:55:53Z", + "aliases": [ + "CVE-2024-43805" + ], + "summary": "HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering", + "details": "### Impact\n\nThe vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.\n\nA malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user.\n\n### Patches\n\nJupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 were patched.\n\n### Workarounds\n\nThere is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are:\n- `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations \n- `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews\n- `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x\n\nTo disable these extensions run:\n\n```bash\njupyter labextension disable @jupyterlab/markdownviewer-extension:plugin\njupyter labextension disable @jupyterlab/mathjax-extension:plugin\njupyter labextension disable @jupyterlab/mathjax2-extension:plugin\n```\n\nTo confirm that the plugins were disabled run:\n\n```bash\njupyter labextension list\n```\n\n### References\n\nNone\n\n### Notes\n\nThis change has a potential to break rendering of some markdown. There is a setting in Sanitizer which allows to revert to the previous sanitizer settings (`allowNamedProperties`).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "jupyterlab" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.8" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.6.7" + } + }, + { + "package": { + "ecosystem": "PyPI", + "name": "notebook" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.2.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 7.2.1" + } + }, + { + "package": { + "ecosystem": "PyPI", + "name": "jupyterlab" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.2.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.2.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-9q39-rmj3-p4r2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43805" + }, + { + "type": "WEB", + "url": "https://github.com/jupyterlab/jupyterlab/commit/06ad9de836f155add7d3d651ef936cc4c5ea8093" + }, + { + "type": "WEB", + "url": "https://github.com/jupyterlab/jupyterlab/commit/88e24baac551196f9cb3de16bd060a7ab1597674" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jupyterlab/jupyterlab" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-29T17:55:53Z", + "nvd_published_at": "2024-08-28T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-jm9m-rqr3-wfmh/GHSA-jm9m-rqr3-wfmh.json b/advisories/github-reviewed/2024/08/GHSA-jm9m-rqr3-wfmh/GHSA-jm9m-rqr3-wfmh.json new file mode 100644 index 00000000000..f6c0b97e2ed --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-jm9m-rqr3-wfmh/GHSA-jm9m-rqr3-wfmh.json @@ -0,0 +1,222 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm9m-rqr3-wfmh", + "modified": "2024-08-29T17:55:30Z", + "published": "2024-08-29T17:55:30Z", + "aliases": [ + "CVE-2024-41964" + ], + "summary": "Kirby has insufficient permission checks in the language settings", + "details": "### TL;DR\n\nThis vulnerability affects all Kirby sites with enabled `languages` option that might have potential attackers in the group of authenticated Panel users.\n\nIf you have disabled the `languages` and/or `api` option and don't call any methods in your code that cause a write access to languages (language creation, update or deletion), your site is *not* affected.\n\n----\n\n### Introduction\n\nKirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.\n\nPermissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's frontend or backend code.\n\nA permission for updating existing languages has not existed before the patched versions. So disabling the `languages.*` wildcard permission for a role could not have prohibited updates to existing language definitions.\n\n### Impact\n\nThe missing permission checks allowed attackers with Panel access to manipulate the language definitions.\n\nThe language definitions are at the core of multi-language content in Kirby. Unauthorized modifications with malicious intent can cause significant damage, for example:\n\n- If the `languages` option was enabled but no language exists, creating the first language will switch Kirby to multi-language mode.\n- Deleting an existing language will lead to content loss of all translated content in that language. Deleting the last language will switch Kirby to single-language mode.\n- Updating a language allows to change the metadata including the language slug (used in page URLs) and language variables. It also allows to change the default language, which will cause Kirby to use the new default language's content as a fallback for non-existing translations.\n\nDepending on the site code, the result of such actions can cause loss of site availability (e.g. error messages in the site frontend) or integrity (due to changed URLs or removed translations).\n\n### Patches\n\nThe problem has been patched in [Kirby 3.6.6.6](https://github.com/getkirby/kirby/releases/tag/3.6.6.6), [Kirby 3.7.5.5](https://github.com/getkirby/kirby/releases/tag/3.7.5.5), [Kirby 3.8.4.4](https://github.com/getkirby/kirby/releases/tag/3.8.4.4), [Kirby 3.9.8.2](https://github.com/getkirby/kirby/releases/tag/3.9.8.2), [Kirby 3.10.1.1](https://github.com/getkirby/kirby/releases/tag/3.10.1.1), and [Kirby 4.3.1](https://github.com/getkirby/kirby/releases/tag/4.3.1). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, we have added checks for the `languages.create` and `languages.delete` permissions that ensure that users without those permissions cannot perform the respective actions. We have also added a new `languages.update` permission.\n\n### Credits\n\nThanks to Sebastian Eberlein of JUNO (@SebastianEberlein-JUNO) for reporting the identified issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.6.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.6.6.5" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7.0" + }, + { + "fixed": "3.7.5.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.7.5.4" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.4.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.8.4.3" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9.0" + }, + { + "fixed": "3.9.8.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.9.8.1" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.10.0" + }, + { + "fixed": "3.10.1.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.10.1" + } + }, + { + "package": { + "ecosystem": "Packagist", + "name": "getkirby/cms" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.3.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 4.3.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-jm9m-rqr3-wfmh" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/1dbc9215c97a5c22dc7f34a4e3a64d19e1eac151" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/38636655b054e820f66c3b717c55a9d60fe6400a" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/83fce501759782cf843b6f1d9293a7c7167e69af" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/ab95d172667c3cd529917c2bc94d3c7969706d23" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/af9b0a58dea63effab85525ae217faa1f5ded423" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/commit/e647a177c75636ef4824662b2ce00d8e5c3a8406" + }, + { + "type": "PACKAGE", + "url": "https://github.com/getkirby/kirby" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/3.10.1.1" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/3.6.6.6" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/3.7.5.5" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/3.8.4.4" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/3.9.8.2" + }, + { + "type": "WEB", + "url": "https://github.com/getkirby/kirby/releases/tag/4.3.1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-29T17:55:30Z", + "nvd_published_at": null + } +} \ No newline at end of file