From 730077d4a48768308ceb289455289bb123c0e277 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Mar 2024 22:33:16 +0000 Subject: [PATCH] Publish Advisories GHSA-3wc5-fcw2-2329 GHSA-48vw-jpf8-hwqh GHSA-5jpm-x58v-624v GHSA-64fm-8hw2-v72w GHSA-cvr6-37gx-v8wc GHSA-f98w-7cxr-ff2h GHSA-hm8r-95g3-5hj9 --- .../03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json | 8 ++++++-- .../03/GHSA-48vw-jpf8-hwqh/GHSA-48vw-jpf8-hwqh.json | 8 ++++++-- .../03/GHSA-5jpm-x58v-624v/GHSA-5jpm-x58v-624v.json | 13 ++++++++++--- .../03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json | 11 ++++++++--- .../03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json | 11 ++++++++--- .../03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json | 8 ++++++-- .../03/GHSA-hm8r-95g3-5hj9/GHSA-hm8r-95g3-5hj9.json | 8 ++++++-- 7 files changed, 50 insertions(+), 17 deletions(-) diff --git a/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json b/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json index 43a42af0056..d63aa464fd1 100644 --- a/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json +++ b/advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3wc5-fcw2-2329", - "modified": "2024-03-25T19:38:37Z", + "modified": "2024-03-25T22:32:09Z", "published": "2024-03-25T19:38:37Z", "aliases": [ "CVE-2024-28246" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28246" + }, { "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de" @@ -56,6 +60,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:38:37Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T20:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-48vw-jpf8-hwqh/GHSA-48vw-jpf8-hwqh.json b/advisories/github-reviewed/2024/03/GHSA-48vw-jpf8-hwqh/GHSA-48vw-jpf8-hwqh.json index 055e6899a14..ad174b5fa2e 100644 --- a/advisories/github-reviewed/2024/03/GHSA-48vw-jpf8-hwqh/GHSA-48vw-jpf8-hwqh.json +++ b/advisories/github-reviewed/2024/03/GHSA-48vw-jpf8-hwqh/GHSA-48vw-jpf8-hwqh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-48vw-jpf8-hwqh", - "modified": "2024-03-25T19:45:24Z", + "modified": "2024-03-25T22:31:35Z", "published": "2024-03-25T19:45:23Z", "aliases": [ "CVE-2024-28108" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-48vw-jpf8-hwqh" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28108" + }, { "type": "WEB", "url": "https://github.com/thorsten/phpMyFAQ/commit/4fed1d9602f0635260f789fe85995789d94d6634" @@ -60,6 +64,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:45:23Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T19:15:58Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-5jpm-x58v-624v/GHSA-5jpm-x58v-624v.json b/advisories/github-reviewed/2024/03/GHSA-5jpm-x58v-624v/GHSA-5jpm-x58v-624v.json index 23d46192a6e..8ef637ad92e 100644 --- a/advisories/github-reviewed/2024/03/GHSA-5jpm-x58v-624v/GHSA-5jpm-x58v-624v.json +++ b/advisories/github-reviewed/2024/03/GHSA-5jpm-x58v-624v/GHSA-5jpm-x58v-624v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5jpm-x58v-624v", - "modified": "2024-03-25T19:40:50Z", + "modified": "2024-03-25T22:31:40Z", "published": "2024-03-25T19:40:50Z", "aliases": [ "CVE-2024-29025" @@ -9,7 +9,10 @@ "summary": "Netty's HttpPostRequestDecoder can OOM", "details": "### Summary\nThe `HttpPostRequestDecoder` can be tricked to accumulate data. I have spotted currently two attack vectors \n\n### Details\n1. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list.\n2. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits\n\n### PoC\n\nHere is a Netty branch that provides a fix + tests : https://github.com/vietj/netty/tree/post-request-decoder\n\n\nHere is a reproducer with Vert.x (which uses this decoder) https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3\n\n### Impact\nAny Netty based HTTP server that uses the `HttpPostRequestDecoder` to decode a form.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } ], "affected": [ { @@ -37,6 +40,10 @@ "type": "WEB", "url": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025" + }, { "type": "WEB", "url": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c" @@ -61,6 +68,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:40:50Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T20:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json b/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json index 1389fa59597..db3ea251f9e 100644 --- a/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json +++ b/advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-64fm-8hw2-v72w", - "modified": "2024-03-25T19:38:18Z", + "modified": "2024-03-25T22:31:55Z", "published": "2024-03-25T19:38:18Z", "aliases": [ "CVE-2024-28243" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28243" + }, { "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34" @@ -51,11 +55,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-606" + "CWE-606", + "CWE-674" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:38:18Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T20:15:07Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json b/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json index 6eb478c7bf1..6a33d6d510c 100644 --- a/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json +++ b/advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cvr6-37gx-v8wc", - "modified": "2024-03-25T19:38:29Z", + "modified": "2024-03-25T22:32:01Z", "published": "2024-03-25T19:38:29Z", "aliases": [ "CVE-2024-28244" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28244" + }, { "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2" @@ -51,11 +55,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-606" + "CWE-606", + "CWE-674" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:38:29Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T20:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json b/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json index 087bb4813df..c6cb3e3021a 100644 --- a/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json +++ b/advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f98w-7cxr-ff2h", - "modified": "2024-03-25T19:38:34Z", + "modified": "2024-03-25T22:32:05Z", "published": "2024-03-25T19:38:34Z", "aliases": [ "CVE-2024-28245" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28245" + }, { "type": "WEB", "url": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770" @@ -56,6 +60,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:38:34Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T20:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-hm8r-95g3-5hj9/GHSA-hm8r-95g3-5hj9.json b/advisories/github-reviewed/2024/03/GHSA-hm8r-95g3-5hj9/GHSA-hm8r-95g3-5hj9.json index 47d3e6f2330..a96413332e5 100644 --- a/advisories/github-reviewed/2024/03/GHSA-hm8r-95g3-5hj9/GHSA-hm8r-95g3-5hj9.json +++ b/advisories/github-reviewed/2024/03/GHSA-hm8r-95g3-5hj9/GHSA-hm8r-95g3-5hj9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hm8r-95g3-5hj9", - "modified": "2024-03-25T19:45:12Z", + "modified": "2024-03-25T22:31:44Z", "published": "2024-03-25T19:45:12Z", "aliases": [ "CVE-2024-29179" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29179" + }, { "type": "PACKAGE", "url": "https://github.com/thorsten/phpMyFAQ" @@ -55,6 +59,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-25T19:45:12Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-25T21:15:47Z" } } \ No newline at end of file