From 6f14e04c52b29e06c096e2d7092f159a19d7783c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 2 Feb 2024 16:56:38 +0000 Subject: [PATCH] Publish Advisories GHSA-34q3-p352-c7q8 GHSA-qfv2-3p2f-vg48 GHSA-qfv2-3p2f-vg48 --- .../GHSA-34q3-p352-c7q8.json | 65 +++++++++++++++++++ .../GHSA-qfv2-3p2f-vg48.json | 55 ++++++++++++++++ .../GHSA-qfv2-3p2f-vg48.json | 35 ---------- 3 files changed, 120 insertions(+), 35 deletions(-) create mode 100644 advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json create mode 100644 advisories/github-reviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json diff --git a/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json b/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json new file mode 100644 index 00000000000..a402ada15bc --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-34q3-p352-c7q8/GHSA-34q3-p352-c7q8.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-34q3-p352-c7q8", + "modified": "2024-02-02T16:55:25Z", + "published": "2024-02-02T16:55:25Z", + "aliases": [ + "CVE-2024-1143" + ], + "summary": "Central Dogma Authentication Bypass Vulnerability via Session Leakage", + "details": "### Vulnerability Overview\nA vulnerability has been identified in Central Dogma versions prior to 0.64.0, allowing for the leakage of user sessions and subsequent authentication bypass. The issue stems from a Cross-Site Scripting (XSS) attack vector that targets the RelayState of Security Assertion Markup Language (SAML).\n\n### Impact\nSuccessful exploitation of this vulnerability enables malicious actors to leak user sessions, leading to the compromise of authentication mechanisms. This, in turn, can facilitate unauthorized access to sensitive resources.\n\n### Patches\nThis vulnerability is addressed and resolved in Central Dogma version 0.64.0. Users are strongly encouraged to upgrade to this version or later to mitigate the risk associated with the authentication bypass.\n\n### Workarounds\nNo viable workarounds are currently available for this vulnerability. It is recommended to apply the provided patch promptly.\n\n### References\n- [OASIS SAML v2.0 Errata 05](https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8196_1983180497)\n- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#xss-defense-philosophy)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.linecorp.centraldogma:centraldogma-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.64.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1143" + }, + { + "type": "WEB", + "url": "https://github.com/line/centraldogma/commit/8edcf913b88101aff70008156b0881850e005783" + }, + { + "type": "PACKAGE", + "url": "https://github.com/line/centraldogma" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-02-02T16:55:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json b/advisories/github-reviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json new file mode 100644 index 00000000000..b437bca470f --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qfv2-3p2f-vg48", + "modified": "2024-02-02T16:55:20Z", + "published": "2024-02-02T06:30:32Z", + "withdrawn": "2024-02-02T16:55:20Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references.\n\n## Original Description\nCentral Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.linecorp.centraldogma:centraldogma-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.64.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1143" + }, + { + "type": "WEB", + "url": "https://github.com/line/centraldogma/commit/8edcf913b88101aff70008156b0881850e005783" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-02T16:55:20Z", + "nvd_published_at": "2024-02-02T06:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json b/advisories/unreviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json deleted file mode 100644 index f3854198701..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-qfv2-3p2f-vg48/GHSA-qfv2-3p2f-vg48.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qfv2-3p2f-vg48", - "modified": "2024-02-02T06:30:32Z", - "published": "2024-02-02T06:30:32Z", - "aliases": [ - "CVE-2024-1143" - ], - "details": "Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1143" - }, - { - "type": "WEB", - "url": "https://github.com/line/centraldogma/commit/8edcf913b88101aff70008156b0881850e005783" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-02T06:15:45Z" - } -} \ No newline at end of file