From 85d7c9d3a65cec4723591879c647f3fdd3497120 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 3 Oct 2024 18:09:36 +0000 Subject: [PATCH] Publish Advisories GHSA-9q6v-rxmw-g3gh GHSA-rrvf-5w4r-3x7v GHSA-qc4v-xq2m-65wc --- .../03/GHSA-9q6v-rxmw-g3gh/GHSA-9q6v-rxmw-g3gh.json | 11 +++++++++-- .../04/GHSA-rrvf-5w4r-3x7v/GHSA-rrvf-5w4r-3x7v.json | 10 +++++++++- .../10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json | 4 ++-- 3 files changed, 20 insertions(+), 5 deletions(-) diff --git a/advisories/github-reviewed/2024/03/GHSA-9q6v-rxmw-g3gh/GHSA-9q6v-rxmw-g3gh.json b/advisories/github-reviewed/2024/03/GHSA-9q6v-rxmw-g3gh/GHSA-9q6v-rxmw-g3gh.json index 6c3a0057afb..23c080da048 100644 --- a/advisories/github-reviewed/2024/03/GHSA-9q6v-rxmw-g3gh/GHSA-9q6v-rxmw-g3gh.json +++ b/advisories/github-reviewed/2024/03/GHSA-9q6v-rxmw-g3gh/GHSA-9q6v-rxmw-g3gh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9q6v-rxmw-g3gh", - "modified": "2024-05-02T13:16:51Z", + "modified": "2024-10-03T18:07:30Z", "published": "2024-03-01T15:31:38Z", "aliases": [ "CVE-2023-50378" @@ -9,7 +9,14 @@ "summary": "Apache Ambari: Various Cross site scripting problems", "details": "Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8  \n\n Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. \n\nUsers are recommended to upgrade to version 2.7.8 which fixes this issue.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/04/GHSA-rrvf-5w4r-3x7v/GHSA-rrvf-5w4r-3x7v.json b/advisories/github-reviewed/2024/04/GHSA-rrvf-5w4r-3x7v/GHSA-rrvf-5w4r-3x7v.json index afb6ad807f4..5071c219200 100644 --- a/advisories/github-reviewed/2024/04/GHSA-rrvf-5w4r-3x7v/GHSA-rrvf-5w4r-3x7v.json +++ b/advisories/github-reviewed/2024/04/GHSA-rrvf-5w4r-3x7v/GHSA-rrvf-5w4r-3x7v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rrvf-5w4r-3x7v", - "modified": "2024-05-01T20:14:42Z", + "modified": "2024-10-03T18:08:07Z", "published": "2024-04-09T18:30:22Z", "aliases": [ "CVE-2024-31868" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" } ], "affected": [ @@ -44,6 +48,10 @@ "type": "WEB", "url": "https://github.com/apache/zeppelin/pull/4728" }, + { + "type": "WEB", + "url": "https://github.com/apache/zeppelin/commit/83685795e0ec8d3059fd7a3dbcae5c0532b63b79" + }, { "type": "PACKAGE", "url": "https://github.com/apache/zeppelin" diff --git a/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json b/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json index 41a48f3d37b..3d3dea42780 100644 --- a/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json +++ b/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-qc4v-xq2m-65wc", - "modified": "2024-10-03T16:51:25Z", + "modified": "2024-10-03T18:08:15Z", "published": "2024-10-03T16:51:24Z", "aliases": [ - + "CVE-2024-47762" ], "summary": "Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend", "details": "### Impact\n\nConfiguration supplied through `APP_CONFIG_*` environment variables, for example `APP_CONFIG_backend_listen_port=7007`, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret visibility. This was an intended feature of the `APP_CONFIG_*` way of supplying configuration, but now clearly goes against the expected behavior of the configuration system. This behavior leads to a risk of potentially exposing sensitive configuration details intended to remain private or restricted to backend processes.\n\n### Patches\n\nThe issue has been resolved in version `0.3.75` of the `@backstage/plugin-app-backend` package. Users are encouraged to upgrade to this version to mitigate the vulnerability.\n\n### Workarounds\n\nAs a temporary measure, avoid supplying secrets using the `APP_CONFIG_` configuration pattern. Consider alternative methods for setting secrets, such as the [environment substitution](https://backstage.io/docs/conf/writing#environment-variable-substitution) available for Backstage configuration.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)\n",