From 72d1d255bcbcd7f28b166d4f53ed7d581e91842f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 1 Mar 2024 14:37:01 +0000 Subject: [PATCH] Publish Advisories GHSA-2c28-m2m7-mf55 GHSA-wpmx-564x-h2mh --- .../2023/10/GHSA-2c28-m2m7-mf55/GHSA-2c28-m2m7-mf55.json | 6 +++--- .../2023/12/GHSA-wpmx-564x-h2mh/GHSA-wpmx-564x-h2mh.json | 9 ++++++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2023/10/GHSA-2c28-m2m7-mf55/GHSA-2c28-m2m7-mf55.json b/advisories/github-reviewed/2023/10/GHSA-2c28-m2m7-mf55/GHSA-2c28-m2m7-mf55.json index bce9743ec13..335b2055f94 100644 --- a/advisories/github-reviewed/2023/10/GHSA-2c28-m2m7-mf55/GHSA-2c28-m2m7-mf55.json +++ b/advisories/github-reviewed/2023/10/GHSA-2c28-m2m7-mf55/GHSA-2c28-m2m7-mf55.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-2c28-m2m7-mf55", - "modified": "2023-10-19T20:01:32Z", + "modified": "2024-03-01T14:35:04Z", "published": "2023-10-16T00:30:26Z", "aliases": [ "CVE-2023-5588" ], "summary": "Pleroma Path Traversal vulnerability", - "details": "A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c795094535537a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.", + "details": "A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function `Pleroma.Emoji.Pack` of the file `lib/pleroma/emoji/pack.ex`. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c795094535537a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.", "severity": [ { "type": "CVSS_V3", @@ -49,7 +49,7 @@ "url": "https://github.com/kphrx/pleroma/commit/2c795094535537a8607cc0d3b7f076a609636f40" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/kphrx/pleroma" }, { diff --git a/advisories/github-reviewed/2023/12/GHSA-wpmx-564x-h2mh/GHSA-wpmx-564x-h2mh.json b/advisories/github-reviewed/2023/12/GHSA-wpmx-564x-h2mh/GHSA-wpmx-564x-h2mh.json index fa2e7de610e..ea46d9a56cb 100644 --- a/advisories/github-reviewed/2023/12/GHSA-wpmx-564x-h2mh/GHSA-wpmx-564x-h2mh.json +++ b/advisories/github-reviewed/2023/12/GHSA-wpmx-564x-h2mh/GHSA-wpmx-564x-h2mh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wpmx-564x-h2mh", - "modified": "2024-01-05T19:30:19Z", + "modified": "2024-03-01T14:35:42Z", "published": "2023-12-28T21:16:57Z", "aliases": [ "CVE-2023-52081" @@ -9,7 +9,10 @@ "summary": "ewen-lbh/ffcss Late-Unicode normalization vulnerability", "details": "### Summary\nThe function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. \n\n```go\n// lookupPreprocess applies transformations to s so that it can be compared\n// to search for something.\n// For example, it is used by (ThemeStore).Lookup\nfunc lookupPreprocess(s string) string {\n\treturn strings.ToLower(norm.NFKD.String(regexp.MustCompile(`[-_ .]`).ReplaceAllString(s, \"\")))\n}\n``` \n\nTake the following equivalent Unicode character U+2024 (․). Initially, the `lookupPreprocess()` function would compile the regex and replace the regular dot (.). However, the U+2024 (․) would bypass the `ReplaceAllString()`. When the normalization operation is applied to U+2024 (․), the resulting character will be U+002E (.). Thus, the dot was reintroduced back.\n\n### Impact\n\nThe `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (_), for instance. It should be noted here that the variable `s` is user-controlled data coming from [/cmd/ffcss/commands.go#L22-L28](https://github.com/ewen-lbh/ffcss/blob/master/cmd/ffcss/commands.go#L22-L28) the command args. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low.\n\n### Remediation\n\nA simple fix would be to initially perform the Unicode normalization and then the rest of validations.\n\n### References\n\n - https://sim4n6.beehiiv.com/p/unicode-characters-bypass-security-checks\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } ], "affected": [ { @@ -55,7 +58,7 @@ "CWE-176", "CWE-74" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-12-28T21:16:57Z", "nvd_published_at": "2023-12-28T16:16:02Z"