From 8b72ba2b3c845946fdd0f9cf4fa6febac1085456 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 17 Mar 2025 21:28:10 +0000 Subject: [PATCH] Publish Advisories GHSA-93mq-9ffx-83m2 GHSA-94vh-gphv-8pm8 GHSA-c98h-7hp9-v9hq GHSA-m4gq-fm9h-8q75 GHSA-pqq3-q84h-pj6x GHSA-xmvv-w44w-j8wx --- .../GHSA-93mq-9ffx-83m2.json | 69 ++++++++++ .../GHSA-94vh-gphv-8pm8.json | 73 +++++++++++ .../GHSA-c98h-7hp9-v9hq.json | 99 +++++++++++++++ .../GHSA-m4gq-fm9h-8q75.json | 64 ++++++++++ .../GHSA-pqq3-q84h-pj6x.json | 119 ++++++++++++++++++ .../GHSA-xmvv-w44w-j8wx.json | 39 ++++-- 6 files changed, 454 insertions(+), 9 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-93mq-9ffx-83m2/GHSA-93mq-9ffx-83m2.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-94vh-gphv-8pm8/GHSA-94vh-gphv-8pm8.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-c98h-7hp9-v9hq/GHSA-c98h-7hp9-v9hq.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-m4gq-fm9h-8q75/GHSA-m4gq-fm9h-8q75.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-pqq3-q84h-pj6x/GHSA-pqq3-q84h-pj6x.json rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json (54%) diff --git a/advisories/github-reviewed/2025/03/GHSA-93mq-9ffx-83m2/GHSA-93mq-9ffx-83m2.json b/advisories/github-reviewed/2025/03/GHSA-93mq-9ffx-83m2/GHSA-93mq-9ffx-83m2.json new file mode 100644 index 00000000000..a1081f8339c --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-93mq-9ffx-83m2/GHSA-93mq-9ffx-83m2.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93mq-9ffx-83m2", + "modified": "2025-03-17T21:26:22Z", + "published": "2025-03-17T21:26:22Z", + "aliases": [ + "CVE-2025-29786" + ], + "summary": "Memory Exhaustion in Expr Parser with Unrestricted Input", + "details": "### Impact\nIf the Expr expression parser is given an **unbounded input string**, it will attempt to compile the *entire* string and generate an Abstract Syntax Tree (AST) node for each part of the expression. In scenarios where input size isn’t limited, a malicious or inadvertent extremely large expression can consume excessive memory as the parser builds a huge AST. This can ultimately lead to **excessive memory usage** and an **Out-Of-Memory (OOM) crash** of the process. This issue is relatively uncommon and will only manifest when there are **no restrictions on the input size**, i.e. the expression length is allowed to grow arbitrarily large. In typical use cases where inputs are bounded or validated, this problem would not occur.\n\n### Patches\n\nThe problem has been **patched** in the latest versions of the Expr library. The fix introduces compile-time limits on the number of AST nodes and memory usage during parsing, preventing any single expression from exhausting resources. Users should upgrade to **Expr version 1.17.0 or later**, as this release includes the new node budget and memory limit safeguards. Upgrading to v1.17.0 ensures that extremely deep or large expressions are detected and safely aborted during compilation, avoiding the OOM condition.\n\n### Workarounds\n\nFor users who cannot immediately upgrade, the recommended workaround is to **impose an input size restriction before parsing**. In practice, this means validating or limiting the length of expression strings that your application will accept. For example, set a maximum allowable number of characters (or nodes) for any expression and reject or truncate inputs that exceed this limit. By ensuring no unbounded-length expression is ever fed into the parser, you can prevent the parser from constructing a pathologically large AST and avoid potential memory exhaustion. In short, **pre-validate and cap input size** as a safeguard in the absence of the patch.\n\n### References\n\n- #762", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/expr-lang/expr" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.17.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/expr-lang/expr/security/advisories/GHSA-93mq-9ffx-83m2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29786" + }, + { + "type": "WEB", + "url": "https://github.com/expr-lang/expr/pull/762" + }, + { + "type": "WEB", + "url": "https://github.com/expr-lang/expr/commit/0d19441454426d2f58edb22c31f3ba5f99c7a26e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/expr-lang/expr" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-17T21:26:22Z", + "nvd_published_at": "2025-03-17T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-94vh-gphv-8pm8/GHSA-94vh-gphv-8pm8.json b/advisories/github-reviewed/2025/03/GHSA-94vh-gphv-8pm8/GHSA-94vh-gphv-8pm8.json new file mode 100644 index 00000000000..2951d999a71 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-94vh-gphv-8pm8/GHSA-94vh-gphv-8pm8.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-94vh-gphv-8pm8", + "modified": "2025-03-17T21:26:32Z", + "published": "2025-03-17T21:26:32Z", + "aliases": [ + "CVE-2025-29787" + ], + "summary": "zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write", + "details": "### Summary\n\n\nIn the archive extraction routine of affected versions of the `zip` crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted.\n\n### Details\n\nThis is a variant of the [zip-slip](https://github.com/snyk/zip-slip-vulnerability) vulnerability, we can make the extraction logic step outside of the target directory by creating a symlink to the parent directory and then extracting further files through that symlink.\n\nThe documentation of the [`::zip::read::ZipArchive::extract`] method is in my opinion implying this should not happen:\n\n> \"Paths are sanitized with ZipFile::enclosed_name.\" ...\n> [`::zip::read::FileOptions::enclosed_name`] ... is resistant to path-based exploits ... can’t resolve to a path outside the current directory.\n\n\nMost archive software either decline to extract symlinks that traverse out of the directory or defer creation of symlinks after all files have been created to prevent unexpected behavior when later entries depend on earlier symbolic link entries.\n\n### PoC\n\nhttps://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85\n\n### Impact\n\nUsers who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution.\n\n- zip::unstable::stream::ZipStreamReader::extract\n- zip::read::ZipArchive::extract", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "zip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.3.0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29787" + }, + { + "type": "WEB", + "url": "https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe" + }, + { + "type": "WEB", + "url": "https://gist.github.com/eternal-flame-AD/bf71ef4f6828e741eb12ce7fd47b7b85" + }, + { + "type": "PACKAGE", + "url": "https://github.com/zip-rs/zip2" + }, + { + "type": "WEB", + "url": "https://github.com/zip-rs/zip2/releases/tag/v2.3.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-17T21:26:32Z", + "nvd_published_at": "2025-03-17T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-c98h-7hp9-v9hq/GHSA-c98h-7hp9-v9hq.json b/advisories/github-reviewed/2025/03/GHSA-c98h-7hp9-v9hq/GHSA-c98h-7hp9-v9hq.json new file mode 100644 index 00000000000..dfbd92a92c8 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-c98h-7hp9-v9hq/GHSA-c98h-7hp9-v9hq.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c98h-7hp9-v9hq", + "modified": "2025-03-17T21:26:14Z", + "published": "2025-03-17T21:26:14Z", + "aliases": [ + "CVE-2025-29781" + ], + "summary": "Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD", + "details": "### Impact\n\nThe Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. \n\nBaremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventSubscription` (BMCES). An adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a BMCES in their authorized namespace and then load Secrets from their unauthorized namespaces to their authorized namespace via the Baremetal Operator controller's cluster scoped privileges, causing Secret leakage.\n\n### Patches\n\nThe patch makes BMO refuse to read Secrets from other namespace than where the corresponding Bare Metal Host (BMH) resource is. The patch does not change the `BMCEventSubscription` API in BMO, but stricter validation will deny the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES resource has already been deployed.\n\nThe issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by `BMCEventSubscription`'s `httpHeadersRef` to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets.\n\n### Workarounds\n\nOperator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use `WATCH_NAMESPACE` configuration option to limit BMO to single namespace.\n\n### References\n\n- [patch to main](https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c)\n- [patch to release-0.9](https://github.com/metal3-io/baremetal-operator/pull/2321)\n- [patch to release-0.8](https://github.com/metal3-io/baremetal-operator/pull/2322)\n- [BMCEventSubscription design document](https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md)\n\n### Credits\n\nMetal3 Security Team thanks [WHALEEYE](https://github.com/WHALEEYE) and [debuggerchen](https://github.com/debuggerchen) of [Lab for Internet and Security Technology](https://users.cs.northwestern.edu/~list/) for responsible vulnerability disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/metal3-io/baremetal-operator/apis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.9.0" + }, + { + "fixed": "0.9.1" + } + ] + } + ], + "versions": [ + "0.9.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/metal3-io/baremetal-operator/apis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.8.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.8.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq" + }, + { + "type": "WEB", + "url": "https://github.com/metal3-io/baremetal-operator/pull/2321" + }, + { + "type": "WEB", + "url": "https://github.com/metal3-io/baremetal-operator/pull/2322" + }, + { + "type": "WEB", + "url": "https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/metal3-io/baremetal-operator" + }, + { + "type": "WEB", + "url": "https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-653" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-17T21:26:14Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-m4gq-fm9h-8q75/GHSA-m4gq-fm9h-8q75.json b/advisories/github-reviewed/2025/03/GHSA-m4gq-fm9h-8q75/GHSA-m4gq-fm9h-8q75.json new file mode 100644 index 00000000000..c6af6a6d9f4 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-m4gq-fm9h-8q75/GHSA-m4gq-fm9h-8q75.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m4gq-fm9h-8q75", + "modified": "2025-03-17T21:27:44Z", + "published": "2025-03-17T21:27:43Z", + "aliases": [ + "CVE-2025-0495" + ], + "summary": "buildx allows a possible credential leakage to telemetry endpoint", + "details": "### Impact\nSome cache backends allow configuring their credentials by setting secrets directly as attribute values in `cache-to/cache-from` configuration. If this was done by the user, these secure values could be captured together with OpenTelemetry trace as part of the arguments and flags for the traced CLI command. Passing tokens to Github cache backend via environment variables or using registry authentication is not affected.\n\nIf you passed a token value like this and use a custom OpenTelemetry collector for computing traces you should make sure that your traces are kept secure. OpenTelemetry traces are also saved in BuildKit daemon's history records.\n\n### Patches\nIssue has been fixed in Buildx v0.21.3 or newer.\n\n### Workarounds\nAvoid passing cache backend credentials with CLI arguments. Make sure access to traces and BuildKit history records is kept secure.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/docker/buildx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.21.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.21.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/docker/buildx/security/advisories/GHSA-m4gq-fm9h-8q75" + }, + { + "type": "WEB", + "url": "https://github.com/docker/buildx/commit/18ccba072076ddbfb0aeedd6746d7719b0729b58" + }, + { + "type": "PACKAGE", + "url": "https://github.com/docker/buildx" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-17T21:27:43Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-pqq3-q84h-pj6x/GHSA-pqq3-q84h-pj6x.json b/advisories/github-reviewed/2025/03/GHSA-pqq3-q84h-pj6x/GHSA-pqq3-q84h-pj6x.json new file mode 100644 index 00000000000..f0ff03eec63 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-pqq3-q84h-pj6x/GHSA-pqq3-q84h-pj6x.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pqq3-q84h-pj6x", + "modified": "2025-03-17T21:26:51Z", + "published": "2025-03-17T21:26:50Z", + "aliases": [ + "CVE-2025-29788" + ], + "summary": "Sylius PayPal Plugin Payment Amount Manipulation Vulnerability", + "details": "A vulnerability allows users to manipulate the final payment amount processed by PayPal. If a user modifies the item quantity in their shopping cart after initiating the PayPal Checkout process, PayPal will not receive the updated total amount. As a result, PayPal captures only the initially transmitted amount, while Sylius incorrectly considers the order fully paid based on the modified total. This flaw can be exploited both accidentally and intentionally, potentially enabling fraud by allowing customers to pay less than the actual order value.\n\n### Impact\n\n- Attackers can intentionally pay less than the actual total order amount.\n- Business owners may suffer financial losses due to underpaid orders.\n- Integrity of payment processing is compromised.\n\n### Patches\n\nThe issue is fixed in versions: 1.6.1, 1.7.1, 2.0.1 and above.\n\n### Workarounds\n\nTo resolve the problem in the end application without updating to the newest patches, there is a need to overwrite `ProcessPayPalOrderAction` with modified logic:\n\n```php\nrequest->getInt('orderId');\n $order = $this->orderProvider->provideOrderById($orderId);\n /** @var PaymentInterface $payment */\n $payment = $order->getLastPayment(PaymentInterface::STATE_CART);\n\n $data = $this->getOrderDetails((string) $request->request->get('payPalOrderId'), $payment);\n\n /** @var CustomerInterface|null $customer */\n $customer = $order->getCustomer();\n if ($customer === null) {\n $customer = $this->getOrderCustomer($data['payer']);\n $order->setCustomer($customer);\n }\n\n $purchaseUnit = (array) $data['purchase_units'][0];\n\n $address = $this->addressFactory->createNew();\n\n if ($order->isShippingRequired()) {\n $name = explode(' ', $purchaseUnit['shipping']['name']['full_name']);\n $address->setLastName(array_pop($name) ?? '');\n $address->setFirstName(implode(' ', $name));\n $address->setStreet($purchaseUnit['shipping']['address']['address_line_1']);\n $address->setCity($purchaseUnit['shipping']['address']['admin_area_2']);\n $address->setPostcode($purchaseUnit['shipping']['address']['postal_code']);\n $address->setCountryCode($purchaseUnit['shipping']['address']['country_code']);\n\n $this->getStateMachine()->apply($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_ADDRESS);\n $this->getStateMachine()->apply($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_SELECT_SHIPPING);\n } else {\n $address->setFirstName($customer->getFirstName());\n $address->setLastName($customer->getLastName());\n\n $defaultAddress = $customer->getDefaultAddress();\n\n $address->setStreet($defaultAddress ? $defaultAddress->getStreet() : '');\n $address->setCity($defaultAddress ? $defaultAddress->getCity() : '');\n $address->setPostcode($defaultAddress ? $defaultAddress->getPostcode() : '');\n $address->setCountryCode($data['payer']['address']['country_code']);\n\n $this->getStateMachine()->apply($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_ADDRESS);\n }\n\n $order->setShippingAddress(clone $address);\n $order->setBillingAddress(clone $address);\n\n $this->getStateMachine()->apply($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_SELECT_PAYMENT);\n\n $this->orderManager->flush();\n\n try {\n $this->verify($payment, $data);\n } catch (\\Exception) {\n $this->paymentStateManager->cancel($payment);\n\n return new JsonResponse(['orderID' => $order->getId()]);\n }\n\n $this->paymentStateManager->create($payment);\n $this->paymentStateManager->process($payment);\n\n return new JsonResponse(['orderID' => $order->getId()]);\n }\n\n private function getOrderCustomer(array $customerData): CustomerInterface\n {\n /** @var CustomerInterface|null $existingCustomer */\n $existingCustomer = $this->customerRepository->findOneBy(['email' => $customerData['email_address']]);\n if ($existingCustomer !== null) {\n return $existingCustomer;\n }\n\n /** @var CustomerInterface $customer */\n $customer = $this->customerFactory->createNew();\n $customer->setEmail($customerData['email_address']);\n $customer->setFirstName($customerData['name']['given_name']);\n $customer->setLastName($customerData['name']['surname']);\n\n return $customer;\n }\n\n private function getOrderDetails(string $id, PaymentInterface $payment): array\n {\n /** @var PaymentMethodInterface $paymentMethod */\n $paymentMethod = $payment->getMethod();\n $token = $this->authorizeClientApi->authorize($paymentMethod);\n\n return $this->orderDetailsApi->get($token, $id);\n }\n\n private function getStateMachine(): StateMachineInterface\n {\n if ($this->stateMachineFactory instanceof StateMachineFactoryInterface) {\n return new WinzouStateMachineAdapter($this->stateMachineFactory);\n }\n\n return $this->stateMachineFactory;\n }\n\n private function verify(PaymentInterface $payment, array $paypalOrderDetails): void\n {\n $totalAmount = $this->getTotalPaymentAmountFromPaypal($paypalOrderDetails);\n\n if ($payment->getAmount() !== $totalAmount) {\n throw new \\Exception();\n }\n }\n\n private function getTotalPaymentAmountFromPaypal(array $paypalOrderDetails): int\n {\n if (!isset($paypalOrderDetails['purchase_units']) || !is_array($paypalOrderDetails['purchase_units'])) {\n return 0;\n }\n\n $totalAmount = 0;\n\n foreach ($paypalOrderDetails['purchase_units'] as $unit) {\n $stringAmount = $unit['amount']['value'] ?? '0';\n\n $totalAmount += (int) ($stringAmount * 100);\n }\n\n return $totalAmount;\n }\n}\n```\n\nAlso there is a need to overwrite `CompletePayPalOrderFromPaymentPageAction` with modified logic:\n\n```php\nattributes->getInt('id');\n\n $order = $this->orderProvider->provideOrderById($orderId);\n /** @var PaymentInterface $payment */\n $payment = $order->getLastPayment(PaymentInterface::STATE_PROCESSING);\n\n try {\n $this->verify($payment);\n } catch (\\Exception) {\n $this->paymentStateManager->cancel($payment);\n $order->removePayment($payment);\n\n $this->orderProcessor->process($order);\n\n return new JsonResponse([\n 'return_url' => $this->router->generate('sylius_shop_checkout_complete', [], UrlGeneratorInterface::ABSOLUTE_URL),\n ]);\n }\n\n $this->paymentStateManager->complete($payment);\n\n $this->getStateMachine()->apply($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_SELECT_PAYMENT);\n $this->getStateMachine()->apply($order, OrderCheckoutTransitions::GRAPH, OrderCheckoutTransitions::TRANSITION_COMPLETE);\n\n $this->orderManager->flush();\n\n $request->getSession()->set('sylius_order_id', $order->getId());\n\n return new JsonResponse([\n 'return_url' => $this->router->generate('sylius_shop_order_thank_you', [], UrlGeneratorInterface::ABSOLUTE_URL),\n ]);\n }\n\n private function getStateMachine(): StateMachineInterface\n {\n if ($this->stateMachine instanceof FactoryInterface) {\n return new WinzouStateMachineAdapter($this->stateMachine);\n }\n\n return $this->stateMachine;\n }\n\n private function verify(PaymentInterface $payment): void\n {\n $totalAmount = $this->getTotalPaymentAmountFromPaypal($payment);\n\n if ($payment->getOrder()->getTotal() !== $totalAmount) {\n throw new \\Exception();\n }\n }\n\n private function getTotalPaymentAmountFromPaypal(PaymentInterface $payment): int\n {\n $details = $payment->getDetails();\n\n return $details['payment_amount'] ?? 0;\n }\n}\n```\n\nAnd to overwrite `CaptureAction` with modified logic:\n\n```php\ngetModel();\n /** @var PaymentMethodInterface $paymentMethod */\n $paymentMethod = $payment->getMethod();\n\n $token = $this->authorizeClientApi->authorize($paymentMethod);\n\n $referenceId = $this->uuidProvider->provide();\n $content = $this->createOrderApi->create($token, $payment, $referenceId);\n\n if ($content['status'] === 'CREATED') {\n $payment->setDetails([\n 'status' => StatusAction::STATUS_CAPTURED,\n 'paypal_order_id' => $content['id'],\n 'reference_id' => $referenceId,\n 'payment_amount' => $payment->getAmount(),\n ]);\n }\n }\n\n public function supports($request): bool\n {\n return\n $request instanceof Capture &&\n $request->getModel() instanceof PaymentInterface\n ;\n }\n}\n\n```\n\nAfter that, register services in the container when using PayPal 1.x:\n\n```yaml\nservices:\n App\\Controller\\ProcessPayPalOrderAction:\n class: App\\Controller\\ProcessPayPalOrderAction\n public: true\n arguments:\n - '@sylius.repository.customer'\n - '@sylius.factory.customer'\n - '@sylius.factory.address'\n - '@sylius.manager.order'\n - '@sylius_abstraction.state_machine'\n - '@Sylius\\PayPalPlugin\\Manager\\PaymentStateManagerInterface'\n - '@Sylius\\PayPalPlugin\\Api\\CacheAuthorizeClientApiInterface'\n - '@Sylius\\PayPalPlugin\\Api\\OrderDetailsApiInterface'\n - '@Sylius\\PayPalPlugin\\Provider\\OrderProviderInterface'\n\n Sylius\\PayPalPlugin\\Controller\\ProcessPayPalOrderAction:\n alias: App\\Controller\\ProcessPayPalOrderAction\n\n App\\Controller\\CompletePayPalOrderFromPaymentPageAction:\n class: App\\Controller\\CompletePayPalOrderFromPaymentPageAction\n public: true\n arguments:\n - '@Sylius\\PayPalPlugin\\Manager\\PaymentStateManagerInterface'\n - '@router'\n - '@Sylius\\PayPalPlugin\\Provider\\OrderProviderInterface'\n - '@sylius_abstraction.state_machine'\n - '@sylius.manager.order'\n - '@sylius.order_processing.order_processor'\n\n Sylius\\PayPalPlugin\\Controller\\CompletePayPalOrderFromPaymentPageAction:\n alias: App\\Controller\\CompletePayPalOrderFromPaymentPageAction\n\n Sylius\\PayPalPlugin\\Payum\\Action\\CaptureAction:\n class: App\\Payum\\Action\\CaptureAction\n public: true\n arguments:\n - '@Sylius\\PayPalPlugin\\Api\\CacheAuthorizeClientApiInterface'\n - '@Sylius\\PayPalPlugin\\Api\\CreateOrderApiInterface'\n - '@Sylius\\PayPalPlugin\\Provider\\UuidProviderInterface'\n tags:\n - { name: 'payum.action', factory: 'sylius.pay_pal', alias: 'payum.action.capture' }\n```\n\nor when using PayPal 2.x:\n\n```yaml\nservices:\n App\\Controller\\ProcessPayPalOrderAction:\n class: App\\Controller\\ProcessPayPalOrderAction\n public: true\n arguments:\n - '@sylius.repository.customer'\n - '@sylius.factory.customer'\n - '@sylius.factory.address'\n - '@sylius.manager.order'\n - '@sylius_abstraction.state_machine'\n - '@sylius_paypal.manager.payment_state'\n - '@sylius_paypal.api.cache_authorize_client'\n - '@sylius_paypal.api.order_details'\n - '@sylius_paypal.provider.order'\n\n sylius_paypal.controller.process_paypal_order:\n alias: App\\Controller\\ProcessPayPalOrderAction\n\n App\\Controller\\CompletePayPalOrderFromPaymentPageAction:\n class: App\\Controller\\CompletePayPalOrderFromPaymentPageAction\n public: true\n arguments:\n - '@sylius_paypal.manager.payment_state'\n - '@router'\n - '@sylius_paypal.provider.order'\n - '@sylius_abstraction.state_machine'\n - '@sylius.manager.order'\n - '@sylius.order_processing.order_processor'\n\n sylius_paypal.controller.complete_paypal_order_from_payment_page:\n alias: App\\Controller\\CompletePayPalOrderFromPaymentPageAction\n\n sylius_paypal.payum.action.capture:\n class: App\\Payum\\Action\\CaptureAction\n public: true\n arguments:\n - '@sylius_paypal.api.cache_authorize_client'\n - '@sylius_paypal.api.create_order'\n - '@sylius_paypal.provider.uuid'\n tags:\n - { name: 'payum.action', factory: 'sylius.paypal', alias: 'payum.action.capture' }\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)\n* Email us at security@sylius.com", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "sylius/paypal-plugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "sylius/paypal-plugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7.0" + }, + { + "fixed": "1.7.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "sylius/paypal-plugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Sylius/PayPalPlugin/security/advisories/GHSA-pqq3-q84h-pj6x" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29788" + }, + { + "type": "WEB", + "url": "https://github.com/Sylius/PayPalPlugin/commit/31e71b0457e5d887a6c19f8cfabb8b16125ec406" + }, + { + "type": "WEB", + "url": "https://github.com/Sylius/PayPalPlugin/commit/8a81258f965b7860d4bccb52942e4c5b53e6774d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Sylius/PayPalPlugin" + }, + { + "type": "WEB", + "url": "https://github.com/Sylius/PayPalPlugin/releases/tag/v1.6.1" + }, + { + "type": "WEB", + "url": "https://github.com/Sylius/PayPalPlugin/releases/tag/v1.7.1" + }, + { + "type": "WEB", + "url": "https://github.com/Sylius/PayPalPlugin/releases/tag/v2.0.1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-472" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-17T21:26:50Z", + "nvd_published_at": "2025-03-17T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json b/advisories/github-reviewed/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json similarity index 54% rename from advisories/unreviewed/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json rename to advisories/github-reviewed/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json index ea501d1bf00..de7fc85d2e5 100644 --- a/advisories/unreviewed/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json +++ b/advisories/github-reviewed/2025/03/GHSA-xmvv-w44w-j8wx/GHSA-xmvv-w44w-j8wx.json @@ -1,28 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-xmvv-w44w-j8wx", - "modified": "2025-03-17T15:31:50Z", + "modified": "2025-03-17T21:27:32Z", "published": "2025-03-17T15:31:50Z", "aliases": [ "CVE-2025-1398" ], + "summary": "Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection", "details": "Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - }, - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "mattermost-desktop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.11.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1398" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/desktop" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -32,9 +53,9 @@ "cwe_ids": [ "CWE-426" ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-03-17T21:27:32Z", "nvd_published_at": "2025-03-17T15:15:43Z" } } \ No newline at end of file