mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-22c5-cpvr-cfvq GHSA-4ff6-858j-r822 GHSA-w6xh-c82w-h997 GHSA-w6xh-c82w-h997
This commit is contained in:
advisory-database[bot]
@@ -1,13 +1,14 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-22c5-cpvr-cfvq",
|
||||
"modified": "2024-12-19T18:31:36Z",
|
||||
"modified": "2025-01-16T23:09:01Z",
|
||||
"published": "2024-12-12T09:31:36Z",
|
||||
"withdrawn": "2025-01-16T23:09:01Z",
|
||||
"aliases": [
|
||||
"CVE-2024-4109"
|
||||
],
|
||||
"summary": "undertow: information leakage via HTTP/2 request header reuse",
|
||||
"details": "A flaw was found in Undertow. An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection. This issue can potentially lead to information leakage between requests.",
|
||||
"summary": "Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse",
|
||||
"details": "# Withdrawn Advisory\nThis advisory has been withdrawn because it was determined to not be a valid vulnerability. This link is maintained to preserve external references. For more information, see https://nvd.nist.gov/vuln/detail/CVE-2024-4109.\n\n# Original Description\nA flaw was found in Undertow. An HTTP request header value from a previous stream may be incorrectly reused for a request associated with a subsequent stream on the same HTTP/2 connection. This issue can potentially lead to information leakage between requests.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4ff6-858j-r822",
|
||||
"modified": "2025-01-16T23:08:32Z",
|
||||
"published": "2025-01-16T23:08:32Z",
|
||||
"aliases": [
|
||||
"CVE-2024-52594"
|
||||
],
|
||||
"summary": "Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation",
|
||||
"details": "### Impact\nGomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions.\n\n### Patches\n\nc4f1e01eab0dd435709ad15463ed38a079ad6128 fixes this issue.\n\n\n### Workarounds\nUse a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.\n\n### References\nN/A\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/matrix-org/gomatrixserverlib"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.0.0-20250116181547-c4f1e01eab0d"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 0.0.0-20250106190028-bf86bc98b879"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52594"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/matrix-org/gomatrixserverlib"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-918"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-01-16T23:08:32Z",
|
||||
"nvd_published_at": "2025-01-16T19:15:28Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,146 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w6xh-c82w-h997",
|
||||
"modified": "2025-01-16T23:09:09Z",
|
||||
"published": "2025-01-16T21:30:58Z",
|
||||
"aliases": [
|
||||
"CVE-2025-20621"
|
||||
],
|
||||
"summary": "Mattermost webapp crash via a crafted post",
|
||||
"details": "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/mattermost/mattermost/server/v8"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "10.2.0"
|
||||
},
|
||||
{
|
||||
"fixed": "10.2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/mattermost/mattermost/server/v8"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "10.1.0"
|
||||
},
|
||||
{
|
||||
"fixed": "10.1.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 10.1.3"
|
||||
}
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/mattermost/mattermost/server/v8"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "10.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "10.0.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 10.0.3"
|
||||
}
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/mattermost/mattermost/server/v8"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "9.11.0"
|
||||
},
|
||||
{
|
||||
"fixed": "9.11.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 9.11.5"
|
||||
}
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Go",
|
||||
"name": "github.com/mattermost/mattermost/server/v8"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "8.0.0-20241127161322-25ff7a3779a5"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20621"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/mattermost/mattermost"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://mattermost.com/security-updates"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-1287"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2025-01-16T23:09:09Z",
|
||||
"nvd_published_at": "2025-01-16T19:15:29Z"
|
||||
}
|
||||
}
|
||||
@@ -1,36 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w6xh-c82w-h997",
|
||||
"modified": "2025-01-16T21:30:58Z",
|
||||
"published": "2025-01-16T21:30:58Z",
|
||||
"aliases": [
|
||||
"CVE-2025-20621"
|
||||
],
|
||||
"details": "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20621"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://mattermost.com/security-updates"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-1287"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2025-01-16T19:15:29Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user