From 91262050e26bbb8dd2eac56e1110b103b1f7fb5f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 3 Oct 2024 16:52:44 +0000 Subject: [PATCH] Publish Advisories GHSA-78wr-2p64-hpwj GHSA-qc4v-xq2m-65wc GHSA-wpr2-j6gr-pjw9 GHSA-78wr-2p64-hpwj --- .../GHSA-78wr-2p64-hpwj.json | 65 +++++++++++++++++++ .../GHSA-qc4v-xq2m-65wc.json | 65 +++++++++++++++++++ .../GHSA-wpr2-j6gr-pjw9.json | 61 +++++++++++++++++ .../GHSA-78wr-2p64-hpwj.json | 35 ---------- 4 files changed, 191 insertions(+), 35 deletions(-) create mode 100644 advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json create mode 100644 advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json delete mode 100644 advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json diff --git a/advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json b/advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json new file mode 100644 index 00000000000..f91c1b72d07 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-78wr-2p64-hpwj", + "modified": "2024-10-03T16:52:23Z", + "published": "2024-10-03T12:30:48Z", + "aliases": [ + "CVE-2024-47554" + ], + "summary": "Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader", + "details": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe `org.apache.commons.io.input.XmlStreamReader` class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "commons-io:commons-io" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0" + }, + { + "fixed": "2.14.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/commons-io" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:52:23Z", + "nvd_published_at": "2024-10-03T12:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json b/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json new file mode 100644 index 00000000000..41a48f3d37b --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-qc4v-xq2m-65wc/GHSA-qc4v-xq2m-65wc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qc4v-xq2m-65wc", + "modified": "2024-10-03T16:51:25Z", + "published": "2024-10-03T16:51:24Z", + "aliases": [ + + ], + "summary": "Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend", + "details": "### Impact\n\nConfiguration supplied through `APP_CONFIG_*` environment variables, for example `APP_CONFIG_backend_listen_port=7007`, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret visibility. This was an intended feature of the `APP_CONFIG_*` way of supplying configuration, but now clearly goes against the expected behavior of the configuration system. This behavior leads to a risk of potentially exposing sensitive configuration details intended to remain private or restricted to backend processes.\n\n### Patches\n\nThe issue has been resolved in version `0.3.75` of the `@backstage/plugin-app-backend` package. Users are encouraged to upgrade to this version to mitigate the vulnerability.\n\n### Workarounds\n\nAs a temporary measure, avoid supplying secrets using the `APP_CONFIG_` configuration pattern. Consider alternative methods for setting secrets, such as the [environment substitution](https://backstage.io/docs/conf/writing#environment-variable-substitution) available for Backstage configuration.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@backstage/plugin-app-backend" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.3.75" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/security/advisories/GHSA-qc4v-xq2m-65wc" + }, + { + "type": "WEB", + "url": "https://github.com/backstage/backstage/commit/323e6129073c5cb4cc106a1239eaec31a129554f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/backstage/backstage" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-440" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:51:24Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json b/advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json new file mode 100644 index 00000000000..73aed557c26 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-wpr2-j6gr-pjw9/GHSA-wpr2-j6gr-pjw9.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wpr2-j6gr-pjw9", + "modified": "2024-10-03T16:51:51Z", + "published": "2024-10-03T16:51:50Z", + "aliases": [ + + ], + "summary": "OpenTofu potential leaking of secret variable values when using static evaluation in v1.8", + "details": "### Impact\nUsers who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors.\n\n### Workarounds\nCheck that you are not using sensitive variables in module sources and versions, as well as backend configurations. The patch will add explicit errors and prevent this from being possible.\n\n### Examples\n```hcl\nvariable \"backend_path\" {\n type = string\n sensitive = true\n}\n\nterraform {\n backend \"local\" {\n path = var.backend_path\n }\n}\n```\n\n```hcl\nvariable \"mod_info\" {\n type = string\n sensitive = true\n}\n\nmodule \"foo\" {\n source = var.mod_info\n //version = var.mod_info\n}\n```\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/opentofu/opentofu" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opentofu/opentofu" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:51:50Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json b/advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json deleted file mode 100644 index 4869e605c12..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-78wr-2p64-hpwj/GHSA-78wr-2p64-hpwj.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-78wr-2p64-hpwj", - "modified": "2024-10-03T12:30:48Z", - "published": "2024-10-03T12:30:48Z", - "aliases": [ - "CVE-2024-47554" - ], - "details": "Uncontrolled Resource Consumption vulnerability in Apache Commons IO.\n\nThe org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.\n\n\nThis issue affects Apache Commons IO: from 2.0 before 2.14.0.\n\nUsers are recommended to upgrade to version 2.14.0 or later, which fixes the issue.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47554" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-03T12:15:02Z" - } -} \ No newline at end of file