netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5938-79hg-xh3q
GHSA-6m9r-7wrx-xmr6
GHSA-8f57-wcmg-4jmh
GHSA-pxch-wr7m-rwxj
GHSA-r24f-hg58-vfrw
This commit is contained in:
advisory-database[bot]
2023-12-21 18:15:51 +00:00
parent 1ffcc09872
commit 799c75c83b
5 changed files with 198 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json → advisories/github-reviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json
+33 -6
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5938-79hg-xh3q",
"modified": "2023-12-21T12:30:28Z",
"modified": "2023-12-21T18:13:42Z",
"published": "2023-12-21T12:30:28Z",
"aliases": [
"CVE-2023-50783"
],
"details": "Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.\nThis flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.\nUsers are recommended to upgrade to 2.8.0, which fixes this issue",
"summary": "Apache Airflow Improper Access Control vulnerability",
"details": "Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.\nThis flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.\nUsers are recommended to upgrade to 2.8.0, which fixes this issue.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/33932"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn"
@@ -35,9 +62,9 @@
"cwe_ids": [
"CWE-284"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-21T18:13:42Z",
"nvd_published_at": "2023-12-21T10:15:36Z"
}
}
advisories/unreviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json → advisories/github-reviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json
+32 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6m9r-7wrx-xmr6",
"modified": "2023-12-21T15:30:31Z",
"modified": "2023-12-21T18:13:50Z",
"published": "2023-12-21T12:30:28Z",
"aliases": [
"CVE-2023-49920"
],
"summary": "Apache Airflow Cross-Site Request Forgery vulnerability",
"details": "Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent.\nUsers are advised to upgrade to version 2.8.0 or later which is not affected",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.8.0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/36026"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/f5d802791fa5f6b13b635f06a1ea2eccc22a9ba7"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq"
@@ -35,9 +62,9 @@
"cwe_ids": [
"CWE-352"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-21T18:13:50Z",
"nvd_published_at": "2023-12-21T10:15:36Z"
}
}
advisories/unreviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json → advisories/github-reviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json
+32 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8f57-wcmg-4jmh",
"modified": "2023-12-21T15:30:31Z",
"modified": "2023-12-21T18:13:58Z",
"published": "2023-12-21T12:30:27Z",
"aliases": [
"CVE-2023-48291"
],
"summary": "Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere",
"details": "Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.\n\nThis is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 \n\nUsers of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/34366"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/4f1b500c47813c54349b7d3e48df0a444fb4826c"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3"
@@ -35,9 +62,9 @@
"cwe_ids": [
"CWE-668"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-21T18:13:58Z",
"nvd_published_at": "2023-12-21T10:15:36Z"
}
}
advisories/unreviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json → advisories/github-reviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json
+39 -6
View File
@@ -1,17 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pxch-wr7m-rwxj",
"modified": "2023-12-21T15:30:31Z",
"modified": "2023-12-21T18:14:16Z",
"published": "2023-12-21T12:30:27Z",
"aliases": [
"CVE-2023-47265"
],
"summary": "Apache Airflow has a stored cross-site scripting vulnerability",
"details": "Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.8.0b1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.7.3"
}
}
],
"references": [
{
@@ -22,6 +47,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/35460"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/0b995602e6e5894ee31625a4dd0e6aa255d2a651"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr"
@@ -35,9 +68,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-21T18:14:16Z",
"nvd_published_at": "2023-12-21T10:15:35Z"
}
}
advisories/github-reviewed/2023/12/GHSA-r24f-hg58-vfrw/GHSA-r24f-hg58-vfrw.json
+62
View File
@@ -0,0 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r24f-hg58-vfrw",
"modified": "2023-12-21T18:14:34Z",
"published": "2023-12-21T18:14:34Z",
"aliases": [
],
"summary": "unsafe-libyaml unaligned write of u64 on 32-bit and 16-bit platforms",
"details": "Affected versions allocate memory using the alignment of `usize` and write data to it of type `u64`, without using `core::ptr::write_unaligned`. In platforms with sub-64bit alignment for `usize` (including wasm32 and x86) these writes are insufficiently aligned some of the time.\n\nIf using an ordinary optimized standard library, the bug exhibits Undefined Behavior so may or may not behave in any sensible way, depending on optimization settings and hardware and other things. If using a Rust standard library built with debug assertions enabled, the bug manifests deterministically in a crash (non-unwinding panic) saying _\"ptr::write requires that the pointer argument is aligned and non-null\"_.\n\nNo 64-bit platform is impacted by the bug.\n\nThe flaw was corrected by allocating with adequately high alignment on all\nplatforms.\n",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "unsafe-libyaml"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.10"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/dtolnay/unsafe-libyaml/issues/21"
},
{
"type": "WEB",
"url": "https://github.com/dtolnay/unsafe-libyaml/commit/7755559145c9cf5573639bfecc557893d4a46b0d"
},
{
"type": "PACKAGE",
"url": "https://github.com/dtolnay/unsafe-libyaml"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2023-0075.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-21T18:14:34Z",
"nvd_published_at": null
}
}