Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-05 05:09:58 +00:00
parent f6b0e16688
commit 86412da07f
895 changed files with 1156 additions and 3468 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of service in ruby-openid",
  "details": "The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -79,9 +77,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:18:51Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "insecure temporary directory usage in passenger",
  "details": "ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "redcarpet Buffer Overflow vulnerability",
  "details": "Stack-based buffer overflow in the `header_anchor` function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Sails before 0.12.7 vulnerable to Broken CORS",
  "details": "Affected versions of `sails` have an issue with the CORS configuration where the value of the origin header is reflected as the value for the `Access-Control-Allow-Origin` header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. \n\n## Mitigating Factors\n\nThis is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. \n\nThe problem can be compounded when the cors `credentials` setting is not provided, because at that point authenticated cross domain requests are possible.\n\n\n## Recommendation\n\nUpdate to version 0.12.7 or later.\n\nAs this vulnerability is primarily a user error, the patch for the vulnerability will simply cause the application to write an error message to the console when a vulnerable configuration is used in a production environment.\n\nWriting a proper CORS configuration is still the responsibility of the user, so it is necessary to check for the error message after installing the patch. Be sure you are not using `allRoutes: true` with `origin:'*'`, and that you uncomment `origin` and set it to a reasonable value. Ensure that if `origin` is set to `*` that you truly mean for all other websites to be able to make cross-domain requests to your API.\n\nLikewise, ensure `credentials` is uncommented out and set to the appropriate value. Make sure to explicitly set which origins may request resources via CORS.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file",
  "details": "Versions of `grunt-gh-pages` prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.\n\nIn the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.\n\n\n## Recommendation\n\nUpdate to version 0.10.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -63,9 +63,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2019-08-19T23:45:21Z",
@@ -50,9 +50,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-02-04T21:49:59Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "fuelux vulnerable to Cross-Site Scripting in Pillbox feature",
  "details": "Affected versions of `fuelux` contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.\n\n## Recommendation\n\nUpdate to version 3.15.7 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-c27r-x354-4m68",
  "modified": "2022-08-02T20:03:05Z",
  "published": "2020-10-27T20:39:46Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion",
  "details": "### Impact\nAn attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.\n\n### Patches\nVersion 2.0.0 has the fix.\n\n### Workarounds\nThe recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-227w-wv4j-67h4",
  "modified": "2022-02-09T22:30:30Z",
  "published": "2022-02-09T22:30:30Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Class Loading Vulnerability in Artemis",
  "details": "### Impact\nThis affects all Artemis users who test Java assignments. **Ares is not required.**\nStudents code that gets automatically tested can run arbitrary code in the container,\nor arbitrary code on the machine of an assessor in case of manual correction.\n\n### Patches\nThe problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:\n\n```xml\n<plugin>\n    <groupId>org.apache.maven.plugins</groupId>\n    <artifactId>maven-enforcer-plugin</artifactId>\n    <version>3.0.0</version>\n    <executions>\n        <execution>\n            <id>enforce-no-student-code-in-trusted-packages</id>\n            <phase>process-classes</phase>\n            <goals>\n                <goal>enforce</goal>\n            </goals>\n        </execution>\n    </executions>\n    <configuration>\n        <rules>\n            <requireFilesDontExist>\n                <files>\n                    <!-- ADD HERE THE RULES ARES TELLS YOU ARE MISSING -->\n                </files>\n            </requireFilesDontExist>\n        </rules>\n    </configuration>\n</plugin>\n```\n\nThis fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using `@AddTrustedPackage` should be added as well.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion https://github.com/ls1intum/Ares/discussions\n* Open an issue in https://github.com/ls1intum/Ares/issues\n* Email us, see https://github.com/ls1intum/Ares/security/policy\n\n### References\nSee the assignment of Julius that passes the tests in TUM Artemis course: \"Test - Praktikum: Grundlagen der Programmierung (Testkurs für Tutoren) - Security Tests\" (if that still exists in 2022).\n\nAlso see #15 for almost the same problem.\n",
  "severity": [
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-07T22:25:00Z",
@@ -46,9 +46,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-07T23:07:32Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Path Traversal in Apache James Server",
  "details": "Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-wpfr-6297-9v57",
  "modified": "2022-02-09T22:29:01Z",
  "published": "2022-02-09T22:29:01Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "User object created with invalid provider data in GoTrue",
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nUnder certain circumstances a valid user object would have been created with invalid provider metadata.\n\nThis vulnerability affects everyone running an instance of GoTrue as a service. We advise you to update especially if you are using the provider metadata from the user object to secure other resources.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nA patch is available with the release of version [1.0.1 on Github](https://github.com/netlify/gotrue/releases/tag/v1.0.1).\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf you don't rely on the provider metadata in the user object, you might not be affected. We still strongly recommend upgrading.\n\n### References\n_Are there any links users can visit to find out more?_\n\nThis problem was initially found and reported by the team at Supabase: https://github.com/supabase/gotrue/security/advisories/GHSA-5hvv-9cqv-894r. We want to thank them for the cooperation around this report.\n\nIn contrast to their advisory, we decided to set the severity to \"Moderate\" since the provider metadata is not an inherent security feature of this GoTrue codebase or the Netlify ecosystem.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@netlify.com](mailto:security@netlify.com)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -55,9 +51,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-09T22:29:01Z",
@@ -73,9 +73,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T21:22:51Z",
@@ -89,9 +89,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-07T16:15:55Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-74fp-r6jw-h4mp",
  "modified": "2024-05-20T21:45:20Z",
  "published": "2023-02-08T00:35:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing",
  "details": "CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. \n\nWhen creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a \"Billion Laughs\" attack which is quite well known as an XML parsing issue.\n\nApplying this manifest to a cluster causes the client to hang for some time with considerable CPU usage.\n\n```yaml\napiVersion: v1\ndata:\n  a: &a [\"web\",\"web\",\"web\",\"web\",\"web\",\"web\",\"web\",\"web\",\"web\"]\n  b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]\n  c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]\n  d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]\n  e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]\n  f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]\n  g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]\n  h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]\n  i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]\nkind: ConfigMap\nmetadata:\n  name: yaml-bomb\n  namespace: default\n```\n### Specific Go Packages Affected\n- k8s.io/apimachinery/pkg/runtime/serializer/json\n- k8s.io/apimachinery/pkg/util/json\n",
  "severity": [
@@ -4,14 +4,10 @@
  "modified": "2023-03-28T23:17:20Z",
  "published": "2023-03-27T03:30:16Z",
  "withdrawn": "2023-03-28T23:17:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: pullit Command Injection vulnerability",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-8px5-63x9-5c7p](https://github.com/advisories/GHSA-8px5-63x9-5c7p). This link is maintained to preserve external references.\n\n## Original Description\nThe pullit package before 1.4.0 for Node.js allows OS Command Injection because `eval()` is used on an attacker-supplied Git branch name.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -52,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-27T21:20:41Z",
@@ -4,9 +4,7 @@
  "modified": "2023-03-27T22:32:19Z",
  "published": "2023-03-23T09:30:25Z",
  "withdrawn": "2023-03-23T20:10:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Grafana Stored Cross-site Scripting vulnerability",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-qrrg-gw7w-vp76](https://github.com/advisories/GHSA-qrrg-gw7w-vp76). This link is maintained to preserve external references.\n\n## Original Description\nGrafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-xxmq-4vph-956w",
  "modified": "2023-03-28T14:44:04Z",
  "published": "2023-03-28T14:44:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)",
  "details": "### Impact\n\ncomrak is vulnerable to the upstream cmark issue, [\"Issue revealed by fuzzer\"](https://github.com/commonmark/cmark/issues/354). A large number of references in a markdown document can trigger an overly large response.\n\n### Patches\n\n0.17.0 contains https://github.com/kivikakk/comrak/commit/70f97f3ea4eae30ffbd1b94c764a3de2f1c41d2a, which limits reference output to a 100Kb maximum.\n\n### Workarounds\n\nn/a\n\n### References\n\n* https://github.com/commonmark/cmark/issues/354",
  "severity": [
@@ -58,9 +56,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-28T14:44:04Z",
--- a/Show More
+++ b/Show More