diff --git a/advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json b/advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json new file mode 100644 index 00000000000..f91c1b72d07 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-78wr-2p64-hpwj", + "modified": "2024-10-03T16:52:23Z", + "published": "2024-10-03T12:30:48Z", + "aliases": [ + "CVE-2024-47554" + ], + "summary": "Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader", + "details": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe `org.apache.commons.io.input.XmlStreamReader` class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "commons-io:commons-io" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0" + }, + { + "fixed": "2.14.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/commons-io" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:52:23Z", + "nvd_published_at": "2024-10-03T12:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json b/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json new file mode 100644 index 00000000000..41a48f3d37b --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qc4v-xq2m-65wc", + "modified": "2024-10-03T16:51:25Z", + "published": "2024-10-03T16:51:24Z", + "aliases": [ + + ], + "summary": "Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend", + "details": "### Impact\n\nConfiguration supplied through `APP_CONFIG_*` environment variables, for example `APP_CONFIG_backend_listen_port=7007`, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret visibility. This was an intended feature of the `APP_CONFIG_*` way of supplying configuration, but now clearly goes against the expected behavior of the configuration system. This behavior leads to a risk of potentially exposing sensitive configuration details intended to remain private or restricted to backend processes.\n\n### Patches\n\nThe issue has been resolved in version `0.3.75` of the `@backstage/plugin-app-backend` package. Users are encouraged to upgrade to this version to mitigate the vulnerability.\n\n### Workarounds\n\nAs a temporary measure, avoid supplying secrets using the `APP_CONFIG_` configuration pattern. Consider alternative methods for setting secrets, such as the [environment substitution](https://backstage.io/docs/conf/writing#environment-variable-substitution) available for Backstage configuration.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@backstage/plugin-app-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.3.75" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qc4v-xq2m-65wc" + }, + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/commit/323e6129073c5cb4cc106a1239eaec31a129554f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/backstage/backstage" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-440" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:51:24Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json b/advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json new file mode 100644 index 00000000000..73aed557c26 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wpr2-j6gr-pjw9", + "modified": "2024-10-03T16:51:51Z", + "published": "2024-10-03T16:51:50Z", + "aliases": [ + + ], + "summary": "OpenTofu potential leaking of secret variable values when using static evaluation in v1.8", + "details": "### Impact\nUsers who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors.\n\n### Workarounds\nCheck that you are not using sensitive variables in module sources and versions, as well as backend configurations. The patch will add explicit errors and prevent this from being possible.\n\n### Examples\n```hcl\nvariable \"backend_path\" {\n type = string\n sensitive = true\n}\n\nterraform {\n backend \"local\" {\n path = var.backend_path\n }\n}\n```\n\n```hcl\nvariable \"mod_info\" {\n type = string\n sensitive = true\n}\n\nmodule \"foo\" {\n source = var.mod_info\n //version = var.mod_info\n}\n```\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/opentofu/opentofu" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opentofu/opentofu" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:51:50Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json b/advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json deleted file mode 100644 index 4869e605c12..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-78wr-2p64-hpwj", - "modified": "2024-10-03T12:30:48Z", - "published": "2024-10-03T12:30:48Z", - "aliases": [ - "CVE-2024-47554" - ], - "details": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-03T12:15:02Z" - } -} \ No newline at end of file