Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:15:44 +00:00
parent 262c53145c
commit 71feb077fc
871 changed files with 1685 additions and 5055 deletions
@@ -3,14 +3,10 @@
  "id": "GHSA-3wxm-m9m4-cprj",
  "modified": "2021-05-20T20:24:22Z",
  "published": "2021-05-21T16:24:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Import of incorrectly embargoed keys could cause early publication",
  "details": "### Impact\n\nIf your installation is using the `export-importer` service, there is potential impact.\nIf your installation is not importing keys via the `export-importer` services, your installation is not impacted.\n\nIn versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.\n\nThis could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.\n\n### Patches\n\nThis is patched in `v0.18.3` and all versions `0.19.2` and later.\n\n### Workarounds\n\nEnsure that the servers you are importing export zip files from are not publishing keys too early. \n\n### References\n\nn/a\n\n### For more information\n\nIf you have any questions or comments about this advisory\n* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)\n* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -58,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T20:24:22Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-4g53-vp7q-gfjv",
  "modified": "2021-05-27T22:24:49Z",
  "published": "2021-05-28T19:18:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "constructEvent does not verify header",
  "details": "### Impact\nAnyone verifying a Stripe webhook request via this library's `constructEvent` function.\n\n### Patches\nUpgrade to 1.1.4. \n\n### Workarounds\nUse `await verifyHeader(...)` directly instead of `constructEvent`.\n\n### References\nhttps://github.com/worker-tools/stripe-webhook/issues/1\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -39,9 +35,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-27T22:24:49Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-5684-g483-2249",
  "modified": "2021-10-05T17:07:09Z",
  "published": "2021-05-24T16:59:47Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Signature Validation Bypass",
  "details": "### Impact\nGiven a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one.\n\nThis enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the identity provider, or full authentication bypass if an external attacker can obtain an expired, signed SAML Response.\n\n### Patches\nA patch is available, users of gosaml2 should upgrade to v0.5.0 or higher.\n\n### References\nSee the [underlying advisory on goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) for more details.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-6w87-g839-9wv7",
  "modified": "2021-10-05T16:35:57Z",
  "published": "2021-05-21T14:31:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Helm OCI credentials leaked into Argo CD logs",
  "details": "### Impact\n\nWhen Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged.\n\nAnyone with access to the pod logs - either via access with appropriate permissions to the Kubernetes control plane or a third party log management system where the logs from Argo CD were aggregated - could have potentially obtained the credentials to the Helm OCI repository.\n\nIf you are using Helm OCI repositories with Argo CD, it is strongly recommended to upgrade Argo CD to the latest patch version and to change the credentials used to access the repositories.\n\n### Patches\n\nA patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD.\n\n### Workarounds\n\nNo workaround available\n\n### References\n\nN/A\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`\n\n### Credits\n\nThis vulnerability was found and reported by a third-party who wishes to stay anonymous. We want to thank this third-party for disclosing this vulnerability to us in a responsible manner.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-g636-q5fc-4pr7",
  "modified": "2021-05-21T22:11:53Z",
  "published": "2021-05-24T17:00:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "accounts: Hash account number using Salt",
  "details": "@alovak found that currently when we build hash of account number we do not \"salt\" it. Which makes it vulnerable to rainbow table attack.\n\n**What did you expect to see?**\nI expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)\n\nI would generate salt per tenant at least (maybe per organization).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -39,9 +35,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T22:11:53Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-gmq2-39ff-f5qg",
  "modified": "2021-05-21T14:40:36Z",
  "published": "2021-05-21T16:25:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "A failed upgrade may lead to hung goroutines",
  "details": "### Impact\nProcesses using tableflip may encounter hung goroutines in the parent process, after a failed upgrade.\n\nThe Go runtime has annoying behaviour around setting and clearing\nO_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any\nfile in exec.Cmd.ExtraFiles. os.File.Fd() disables both the use\nof the runtime poller for the file and clears O_NONBLOCK from\nthe underlying open file descriptor.\n\nThis can lead to goroutines hanging in a parent process, after at least\none failed upgrade. The bug manifests in goroutines which rely on\neither a deadline or interruption via Close() to be unblocked being stuck\nin read or accept like syscalls. As far as I can tell we've not experienced\nthis problem in production, so it's most likely quite rare.\n\n### Patches\nThe problem has been fixed in v1.2.2.\n\n### Workarounds\nNone.\n\n### References\n* https://github.com/cloudflare/tableflip/commit/cae714b289e199db5da5f08af861ea65be6232c0",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -46,9 +42,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T14:40:36Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-gwj5-3vfq-q992",
  "modified": "2021-05-20T21:07:16Z",
  "published": "2021-05-21T16:22:16Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Import loops in account imports, nats-server DoS",
  "details": "(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2020-28466.txt>)\n\n## Problem Description\n\nAn export/import cycle between accounts could crash the nats-server, after consuming CPU and memory.\n\nThis issue was fixed publicly in <https://github.com/nats-io/nats-server/pull/1731> in November 2020.\n\nThe need to call this out as a security issue was highlighted by `snyk.io` and we are grateful for their assistance in doing so.\n\nOrganizations which run a NATS service providing access to accounts run by untrusted third parties are affected.\nSee below for an important caveat if running such a service.\n\n\n## Affected versions\n\n#### NATS Server\n\n * Version 2 prior to 2.2.0\n   + 2.0.0 through and including 2.1.9 are vulnerable.\n * fixed with nats-io/nats-server PR 1731, commit 2e3c226729\n\n\n## Impact\n\nThe nats-server could be killed, after consuming resources.\n\n\n## Workaround\n\nThe import cycle requires at least two accounts to work; if you have open account sign-up, then restricting new account sign-up might hinder an attacker.\n\n\n## Solution\n\nUpgrade the nats-server.\n\n\n## Caveat on NATS with untrusted users\n\nRunning a NATS service which is exposed to untrusted users presents a heightened risk.\n\nAny remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers.\n\nFixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention.\n\nThose who are running such services are encouraged to build regularly from git.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-jcgr-9698-82jx",
  "modified": "2021-05-27T21:05:29Z",
  "published": "2021-05-28T15:53:40Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build",
  "details": "### Impact\nIf you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project.\n\n### Patches\nThe problem has been patched in v1.0.0 as it uses a proper method to pass configs to esbuild/estrella.\n\n### Workarounds\nThere is no work around. You should update asap.\n\n### Notes\nThis notice is mainly just to make sure people update to the latest version. This isn't that bad, but should encourage you to update.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-qmfx-75ff-8mw6",
  "modified": "2021-05-24T21:22:08Z",
  "published": "2021-05-27T18:41:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Listing of upload directory contents possible",
  "details": "There's an security issue in prosody-filer versions **< 1.0.1** which leads to unwanted directory listings of download directories. \n\nAn attacker is able to list previous uploads of a certain user by shortening the URL and accessing a URL subdirectors other than `/upload/` (or the corresponding user defined root dir)\n\nVersion 1.0.1 and later fix this problem and allow only direct file access if the full path is known. Directory listings are blocked entirely.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -39,9 +35,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-24T21:22:08Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-rrfw-hg9m-j47h",
  "modified": "2021-10-08T21:25:26Z",
  "published": "2021-05-24T16:59:42Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Signature Validation Bypass",
  "details": "### Impact\n\nAn authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.\n\n### Patches\n\nVersion 0.4.2 bumps the dependency which should fix the issue.\n\n### For more information\n\nPlease see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)\n\n## Credits\n\nThe original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-rrqv-vjrw-hrcr",
  "modified": "2021-05-26T19:57:10Z",
  "published": "2021-05-26T19:59:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Arbitrary Code Execution in json-ptr",
  "details": "There is a security vulnerability in `json-ptr` versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-x5c7-x7m2-rhmf",
  "modified": "2021-05-20T16:50:13Z",
  "published": "2021-05-20T16:50:34Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Local directory executable lookup in sops (Windows-only)",
  "details": "### Impact\nWindows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`\n\nThis attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.\n\n**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** \n\n**As well, if you have `.` within your default $PATH, please upgrade immediately.**\n\nMore information can be found on the official Go blog: https://blog.golang.org/path-security\n\n### Patches\nThe problem has been resolved in v3.7.1\n\nNow, if Windows users using cmd.exe run into this issue, a warning message will be printed:\n`vim resolves to executable in current directory (.\\vim.exe)`\n\n### References\n* https://blog.golang.org/path-security\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -39,9 +35,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T16:50:13Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-433w-mm6h-rv9p",
  "modified": "2021-05-21T20:47:30Z",
  "published": "2021-06-23T17:29:06Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Auth bypass in SAML provider",
  "details": "### Impact\n\nThe following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:\n\n- [`goxmldsig` - Signature Validation Bypass](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)\n- [`gosaml2` - Authentication Bypass](https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg)\n\n### Patches\n\n[Patch available](https://github.com/netlify/gotrue/pull/274)\n\nPlease upgrade to v1.0.0 or commit hash `a2b4dd6bc4ef7562d1df044098b303f564eefa90`\n\n### Workarounds\n\nNo known workarounds.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [gotrue](https://github.com/netlify/gotrue/issues)\n* Email us at [security@netlify.com](mailto:security@netlify.com)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -39,9 +35,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T20:47:30Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Temporary urls leaked via logging",
  "details": "In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-site Scripting in Gogs",
  "details": "Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
--- a/Show More
+++ b/Show More