From 90da6ca3fa13481491cbfdf48d565b46ef474858 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 16 Dec 2023 00:53:02 +0000 Subject: [PATCH] Publish Advisories GHSA-pwfr-8pq7-x9qv GHSA-qqhq-8r2c-c3f5 --- .../GHSA-pwfr-8pq7-x9qv.json | 206 ++++++++++++++++++ .../GHSA-qqhq-8r2c-c3f5.json | 4 +- 2 files changed, 208 insertions(+), 2 deletions(-) create mode 100644 advisories/github-reviewed/2023/12/GHSA-pwfr-8pq7-x9qv/GHSA-pwfr-8pq7-x9qv.json diff --git a/advisories/github-reviewed/2023/12/GHSA-pwfr-8pq7-x9qv/GHSA-pwfr-8pq7-x9qv.json b/advisories/github-reviewed/2023/12/GHSA-pwfr-8pq7-x9qv/GHSA-pwfr-8pq7-x9qv.json new file mode 100644 index 00000000000..d83a74c2079 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-pwfr-8pq7-x9qv/GHSA-pwfr-8pq7-x9qv.json @@ -0,0 +1,206 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pwfr-8pq7-x9qv", + "modified": "2023-12-16T00:52:19Z", + "published": "2023-12-16T00:52:19Z", + "aliases": [ + "CVE-2023-50728" + ], + "summary": "Unauthenticated Denial of Service in the octokit/webhooks library", + "details": "### Impact\nVersions [v9.26.0](https://github.com/octokit/webhooks.js/releases/tag/v9.26.0), [v10.9.x](https://github.com/octokit/webhooks.js/releases/tag/v10.9.1)), [v11.1.x](https://github.com/octokit/webhooks.js/releases/tag/v11.1.1), [v12.0.x](https://github.com/octokit/webhooks.js/releases/tag/v12.0.3) all contained the code that would throw the error.\n\nSpecifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github Apps). The resulting request was found to cause an uncaught exception that ends the nodejs process.\n\nThe problem is caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases.\n\nCredit goes to @pb82 (for the early analysis) and @rh-tguittet (for discovery). \n\n### Patches\n\nMaintenance releases for the Error being thrown by the verify method in [octokit/webhooks.js](https://github.com/octokit/webhooks.js)\n* v12 - [v12.0.4](https://github.com/octokit/webhooks.js/releases/tag/v12.0.4)\n* v11 - [v11.1.2](https://github.com/octokit/webhooks.js/releases/tag/v11.1.2)\n* v10 -[v10.9.2](https://github.com/octokit/webhooks.js/releases/tag/v10.9.2)\n* v9 - [v9.26.3](https://github.com/octokit/webhooks.js/releases/tag/v9.26.3)\n\nMaintenance release for the reference for [octokit/webhooks.js](https://github.com/octokit/webhooks.js) in [app.js](https://github.com/octokit/app.js)\n* [v14.0.2](https://github.com/octokit/app.js/releases/tag/v14.0.2)\n\nMaintenance release for the reference for [octokit/webhooks.js](https://github.com/octokit/webhooks.js) in [octokit.js](https://github.com/octokit/octokit.js)\n* [v3.1.2](https://github.com/octokit/octokit.js/releases/tag/v3.1.2)\n\nMaintenance release for the reference for [octokit/webhooks.js](https://github.com/octokit/webhooks.js) in [Protobot](https://github.com/probot/probot)\n* [v12.3.3](https://github.com/probot/probot/releases/tag/v12.3.3)\n\n\n### Workarounds\nIt is recommend that all users upgrade to the latest version of [octokit/webhooks.js](https://github.com/octokit/webhooks.js) or use one of the updated back ported versions.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@octokit/webhooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.26.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@octokit/webhooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0.0" + }, + { + "fixed": "10.9.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@octokit/webhooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.1.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@octokit/webhooks" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "12.0.0" + }, + { + "fixed": "12.0.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@octokit/app" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.1" + }, + { + "fixed": "14.0.2" + } + ] + } + ], + "versions": [ + "14.0.1" + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "octokit" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "probot" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.3.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/octokit/webhooks.js/security/advisories/GHSA-pwfr-8pq7-x9qv" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50728" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/app.js/releases/tag/v14.0.2" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/octokit.js/releases/tag/v3.1.2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/octokit/webhooks.js" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/webhooks.js/releases/tag/v10.9.2" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/webhooks.js/releases/tag/v11.1.2" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/webhooks.js/releases/tag/v12.0.4" + }, + { + "type": "WEB", + "url": "https://github.com/octokit/webhooks.js/releases/tag/v9.26.3" + }, + { + "type": "WEB", + "url": "https://github.com/probot/probot/releases/tag/v12.3.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-755" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-12-16T00:52:19Z", + "nvd_published_at": "2023-12-15T22:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json b/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json index f0f848227bd..63a448f17a4 100644 --- a/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json +++ b/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-qqhq-8r2c-c3f5", - "modified": "2023-12-15T23:43:30Z", + "modified": "2023-12-16T00:51:51Z", "published": "2023-12-15T23:43:30Z", "aliases": [ ], "summary": "nvdApiKey is logged in debug mode", - "details": "### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n\n### UPDATE ###\nThe issue isn't still resoved in 9.0.6:\nCreate a `pom.xml` with the following configuration:\n \n \n \n \n org.owasp\n dependency-check-maven\n 9.0.6\n \n \n HTML\n XML\n JSON\n \n 7\n true\n true\n 12\n true\n https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\n foobar\n \n \n \n OWASP-Check\n \n check\n \n \n \n \n \n \n\nand run `mvn -X -B verify > check.txt 2>&1`\nthen see that the API key ist still present in clear text: `grep nvdApiKey check.txt`\nreturns:\n`foobar`\n`[DEBUG] (f) nvdApiKey = foobar`\n\nHINT: Can only verify maven, so didn't edit other Affected products.", + "details": "### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n", "severity": [ { "type": "CVSS_V3",