diff --git a/advisories/github-reviewed/2023/10/GHSA-rr4x-crhf-8886/GHSA-rr4x-crhf-8886.json b/advisories/github-reviewed/2023/10/GHSA-rr4x-crhf-8886/GHSA-rr4x-crhf-8886.json index 438ae5ce849..e9b9760eb33 100644 --- a/advisories/github-reviewed/2023/10/GHSA-rr4x-crhf-8886/GHSA-rr4x-crhf-8886.json +++ b/advisories/github-reviewed/2023/10/GHSA-rr4x-crhf-8886/GHSA-rr4x-crhf-8886.json @@ -63,7 +63,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-401" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2025/02/GHSA-jg6f-48ff-5xrw/GHSA-jg6f-48ff-5xrw.json b/advisories/github-reviewed/2025/02/GHSA-jg6f-48ff-5xrw/GHSA-jg6f-48ff-5xrw.json new file mode 100644 index 00000000000..c53644b6741 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-jg6f-48ff-5xrw/GHSA-jg6f-48ff-5xrw.json @@ -0,0 +1,196 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jg6f-48ff-5xrw", + "modified": "2025-02-28T17:46:04Z", + "published": "2025-02-28T17:46:04Z", + "aliases": [], + "summary": "IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement", + "details": "Name: ASA-2025-004: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt\nComponent: IBC-Go\nCriticality: Critical (Considerable Impact; Almost Certain Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: IBC-Go >= v7; Earlier IBC-Go versions may also be affected.\nAffected users: Validators, Full nodes, IBC Middleware authors\n\n### Description\n\nAn issue was discovered in IBC-Go's deserialization of acknowledgements that results in non-deterministic behavior which can halt a chain. Any user that can open an IBC channel can introduce this state to the chain\n\n### Patches\n\nThe new IBC-Go releases below address this issue:\n\n* [v7.9.2](https://github.com/cosmos/ibc-go/releases/tag/v7.9.2)\n* [v8.6.1](https://github.com/cosmos/ibc-go/releases/tag/v8.6.1)\n\n### Workarounds\n\nTo prevent this state from being introduced to a chain, it is possible to permission Channel Opening as a workaround.\n\n### Notes on Re-Release\n\n#### Is this state breaking? Probably not but it depends on your transfer middlewares\n\nThis patch is not state breaking unless you depend on transfer middlewares that deserialize and serialize acknowledgement packets before passing them to the transfer handler. As far as we can tell, these middlewares are rare. For example, packet-forward-middleware and ibc-hooks, do not serialize ack packets in this way and therefore aren't broken by this patch. So if these are the only transfer middlewares you depend on, you can safely apply this patch in a rolling manner (and we've already cut new versions of these for you).\n\n#### What to do if you do depend on ack-serializing middleware\n\nIn the unlikely case that you depend on middlewares that serialize ack packets and you do not update them when you apply this patch, all transfers that are handled by the middleware will fail (or experience other unexpected behavior) if the serialization approach differs from the transfer app's. If you have such dependencies and do not update them, validators who apply the patch in a rolling manner will halt when they upgrade, and transfers processed by the middleware will just fail once everyone has upgraded.\n\nTo update these middlewares and avoid failing transfers or a chain halt, you will simply need to change the serialization approach in the middleware to use ibc-go's codec: `transfertypes.ModuleCdc.[Must]MarshalJSON`, rather than whatever you're doing today. For example:\n\n```\nimport transfertypes \"github.com/cosmos/ibc-go/v10/modules/apps/transfer/types\"\ntransfertypes.ModuleCdc.[Must]MarshalJSON\nfunc MarshalAsIBCDoes(ack channeltypes.Acknowledgement) ([]byte, error) {\n\treturn transfertypes.ModuleCdc.MarshalJSON(&ack)\n}\n```\nWhen you do make a change to the serialization approach, this will make the patch state breaking and you will need a coordinated upgrade. So for absolute clarity: chains with these ack-serializing middlewares must do coordinated upgrades\n\n#### Why we retracted the earlier patch in favor of this approach\nWe retracted the releases of ibc-go we cut earlier today because these broke all transfer middlewares that deserialized then re-serialized receive packets differently than the transfer app. It turned out that this was a common pattern (unlike serializing/deserializing ack packets), so widely used middlewares, including packet-forward-middleware, broke unexpectedly.\n\nIn the new set of patches, we removed this constraint on how middlewares serialize receive packets, preventing this breakage. Only the serialization requirement on acknowledgement packets remains. This is convenient because this is the only constraint we had to add to fix the vulnerability, and middlewares that deserialize and serialize ack packets are much less common than ones that do so for receive packets. The constraint on receive packets was added for defense in depth.\n\n#### Testing we have done to gain more confidence in this release\n* In addition to testing ibc-go, we also did the following:\n* Tested pfm v7 and v8 after bumping dependencies\n* Tested ibc-hooks v7 and v8 after bumping dependencies\n* Ran a patched node on mainnet on the cosmos hub and triggered failing and successful transactions that used PFM\n* Ran a patched node on osmosis and triggered failing and successful transactions that used ibc-hooks\nThis is a more thorough process than before, so we have higher confidence.\n\n### Timeline\n\n* February 18, 2025, 4:54am PST: Issue reported to the Cosmos Bug Bounty program\n* February 18, 2025, 6:56am PST: Issue triaged by Amulet on-call, and distributed to Core team\n* February 18, 2025, 8:15am PST: Core team completes validation of issue\n* February 25, 2025, 8:00am PST / 17:00 CET: Pre-notification delivered\n* February 27, 2025, 8:00am PST / 17:00 CET: Patch made available\n* February 27, 2025, 1:00pm PST: Patch re-release made available\n\nThis issue was reported to the Cosmos Bug Bounty Program by swelf19 on HackerOne on February 18, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. \n\nA Github Security Advisory for this issue is available in the IBC-Go [repository](https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 7.9.2" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 7.9.2" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 7.9.2" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 7.9.2" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 7.9.2" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 7.9.2" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v7" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-go/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.6.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/ibc-go/security/advisories/GHSA-jg6f-48ff-5xrw" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/ibc-go/commit/59987d52d959dc5876ffd4f307c9b33a52a43748" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/ibc-go/commit/9869b3c6f7eb05a935b1eb33611c5406f68438a5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/ibc-go" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-02-28T17:46:04Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-v83q-83hj-rw38/GHSA-v83q-83hj-rw38.json b/advisories/github-reviewed/2025/02/GHSA-v83q-83hj-rw38/GHSA-v83q-83hj-rw38.json new file mode 100644 index 00000000000..c836764a71c --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-v83q-83hj-rw38/GHSA-v83q-83hj-rw38.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v83q-83hj-rw38", + "modified": "2025-02-28T17:46:36Z", + "published": "2025-02-28T17:46:36Z", + "aliases": [], + "summary": "ntpd NTS client denial of service via wrongly sized cookies", + "details": "Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs would crash. Only configured NTS sources can abuse these vulnerabilities. NTP sources or third parties that are not configured cannot make use of these vulnerabilities.\n\nFor zero-sized cookies: a division by zero would force an exit when the number of new cookies that would need to be requested is calculated. In ntpd-rs 1.5.0 a check was added to prevent the division by zero.\n\nFor large cookies: while trying to send a NTP request with the cookie included, the buffer is too small to handle the cookie and an exit of ntpd-rs is forced once a write to the buffer is attempted. The memory outside the buffer would not be written to in this case. In ntpd-rs 1.5.0 a check was added that prevents accepting cookies larger than 350 bytes.\n\nUsers of older versions of ntpd-rs are recommended to update to the latest version. If an update is impossible, it is recommended to only add NTS sources to ntpd-rs that are trusted to not abuse this bug.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "ntpd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-v83q-83hj-rw38" + }, + { + "type": "WEB", + "url": "https://github.com/pendulum-project/ntpd-rs/commit/10a103b471dae25ac598140df0c195b6531bf716" + }, + { + "type": "WEB", + "url": "https://github.com/pendulum-project/ntpd-rs/commit/37dd8d9a0faa03e7dfe3a4bf64953010f075c3e2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pendulum-project/ntpd-rs" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-369", + "CWE-703" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-28T17:46:36Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-wfxg-v3j4-7qmj/GHSA-wfxg-v3j4-7qmj.json b/advisories/github-reviewed/2025/02/GHSA-wfxg-v3j4-7qmj/GHSA-wfxg-v3j4-7qmj.json new file mode 100644 index 00000000000..ba961c517dc --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-wfxg-v3j4-7qmj/GHSA-wfxg-v3j4-7qmj.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wfxg-v3j4-7qmj", + "modified": "2025-02-28T17:46:22Z", + "published": "2025-02-27T21:32:17Z", + "aliases": [ + "CVE-2025-22952" + ], + "summary": "Memos Server-Side Request Forgery (SSRF)", + "details": "elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/usememos/memos" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.24.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22952" + }, + { + "type": "WEB", + "url": "https://github.com/usememos/memos/issues/4413" + }, + { + "type": "WEB", + "url": "https://github.com/usememos/memos/pull/4421" + }, + { + "type": "WEB", + "url": "https://github.com/usememos/memos/pull/4428" + }, + { + "type": "WEB", + "url": "https://github.com/usememos/memos/commit/f17774cb3b9612495d89576a91ab3480018cb0b6" + }, + { + "type": "WEB", + "url": "https://github.com/usememos/memos/commit/f8c973c938742827baaf6665cfe66805dc8e8d02" + }, + { + "type": "WEB", + "url": "https://elest.io/open-source/memos" + }, + { + "type": "PACKAGE", + "url": "https://github.com/usememos/memos" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-28T17:46:22Z", + "nvd_published_at": "2025-02-27T20:16:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-wfxg-v3j4-7qmj/GHSA-wfxg-v3j4-7qmj.json b/advisories/unreviewed/2025/02/GHSA-wfxg-v3j4-7qmj/GHSA-wfxg-v3j4-7qmj.json deleted file mode 100644 index 17b3c3d4de7..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-wfxg-v3j4-7qmj/GHSA-wfxg-v3j4-7qmj.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wfxg-v3j4-7qmj", - "modified": "2025-02-27T21:32:17Z", - "published": "2025-02-27T21:32:17Z", - "aliases": [ - "CVE-2025-22952" - ], - "details": "elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22952" - }, - { - "type": "WEB", - "url": "https://github.com/usememos/memos/issues/4413" - }, - { - "type": "WEB", - "url": "https://github.com/usememos/memos/pull/4428" - }, - { - "type": "WEB", - "url": "https://elest.io/open-source/memos" - }, - { - "type": "WEB", - "url": "https://github.com/usememos/memos" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-27T20:16:04Z" - } -} \ No newline at end of file