From 8a26dc119a162a57d5830c86473934c0e5e1db48 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 10 Sep 2024 19:42:32 +0000 Subject: [PATCH] Publish Advisories GHSA-jw9c-mfg7-9rx2 GHSA-qw6h-vgh9-j6wx GHSA-w97f-w3hq-36g2 --- .../GHSA-jw9c-mfg7-9rx2.json | 88 +++++++++++++++++++ .../GHSA-qw6h-vgh9-j6wx.json | 88 +++++++++++++++++++ .../GHSA-w97f-w3hq-36g2.json | 35 +++++++- 3 files changed, 207 insertions(+), 4 deletions(-) create mode 100644 advisories/github-reviewed/2024/09/GHSA-jw9c-mfg7-9rx2/GHSA-jw9c-mfg7-9rx2.json create mode 100644 advisories/github-reviewed/2024/09/GHSA-qw6h-vgh9-j6wx/GHSA-qw6h-vgh9-j6wx.json rename advisories/{unreviewed => github-reviewed}/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json (58%) diff --git a/advisories/github-reviewed/2024/09/GHSA-jw9c-mfg7-9rx2/GHSA-jw9c-mfg7-9rx2.json b/advisories/github-reviewed/2024/09/GHSA-jw9c-mfg7-9rx2/GHSA-jw9c-mfg7-9rx2.json new file mode 100644 index 00000000000..9b78cf23bde --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-jw9c-mfg7-9rx2/GHSA-jw9c-mfg7-9rx2.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jw9c-mfg7-9rx2", + "modified": "2024-09-10T19:42:03Z", + "published": "2024-09-10T19:42:03Z", + "aliases": [ + "CVE-2024-45409" + ], + "summary": "SAML authentication bypass via Incorrect XPath selector", + "details": "Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.\n\nThis vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "ruby-saml" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.12.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "ruby-saml" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "1.17.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2" + }, + { + "type": "WEB", + "url": "https://github.com/SAML-Toolkits/ruby-saml/commit/1ec5392bc506fe43a02dbb66b68741051c5ffeae" + }, + { + "type": "WEB", + "url": "https://github.com/SAML-Toolkits/ruby-saml/commit/4865d030cae9705ee5cdb12415c654c634093ae7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/SAML-Toolkits/ruby-saml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-09-10T19:42:03Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-qw6h-vgh9-j6wx/GHSA-qw6h-vgh9-j6wx.json b/advisories/github-reviewed/2024/09/GHSA-qw6h-vgh9-j6wx/GHSA-qw6h-vgh9-j6wx.json new file mode 100644 index 00000000000..37b044e3e6c --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-qw6h-vgh9-j6wx/GHSA-qw6h-vgh9-j6wx.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw6h-vgh9-j6wx", + "modified": "2024-09-10T19:41:04Z", + "published": "2024-09-10T19:41:04Z", + "aliases": [ + "CVE-2024-43796" + ], + "summary": "express vulnerable to XSS via response.redirect()", + "details": "### Impact\n\nIn express <4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in express 4.20.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "express" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.20.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "express" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-alpha.1" + }, + { + "fixed": "5.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796" + }, + { + "type": "WEB", + "url": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553" + }, + { + "type": "PACKAGE", + "url": "https://github.com/expressjs/express" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-10T19:41:04Z", + "nvd_published_at": "2024-09-10T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json b/advisories/github-reviewed/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json similarity index 58% rename from advisories/unreviewed/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json rename to advisories/github-reviewed/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json index d0810318d66..56c891b5fdd 100644 --- a/advisories/unreviewed/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json +++ b/advisories/github-reviewed/2024/09/GHSA-w97f-w3hq-36g2/GHSA-w97f-w3hq-36g2.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-w97f-w3hq-36g2", - "modified": "2024-09-10T18:30:44Z", + "modified": "2024-09-10T19:41:54Z", "published": "2024-09-10T18:30:44Z", "aliases": [ "CVE-2023-6841" ], + "summary": "Keycloak Denial of Service vulnerability", "details": "A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "25.0.5" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +51,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254714" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-231" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-10T19:41:54Z", "nvd_published_at": "2024-09-10T17:15:15Z" } } \ No newline at end of file