Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-06 05:07:33 +00:00
parent 101109a87a
commit 916d700b25
938 changed files with 1746 additions and 5238 deletions
@@ -3,9 +3,7 @@
  "id": "GHSA-5v72-xg48-5rpm",
  "modified": "2021-08-04T21:29:05Z",
  "published": "2019-06-04T19:37:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Denial of Service in ws",
  "details": "Affected versions of `ws` can crash when a specially crafted `Sec-WebSocket-Extensions` header containing `Object.prototype` property names as extension or parameter names is sent.\n\n## Proof of concept\n\n```\nconst WebSocket = require('ws');\nconst net = require('net');\n\nconst wss = new WebSocket.Server({ port: 3000 }, function () {\n  const payload = 'constructor';  // or ',;constructor'\n\n  const request = [\n    'GET / HTTP/1.1',\n    'Connection: Upgrade',\n    'Sec-WebSocket-Key: test',\n    'Sec-WebSocket-Version: 8',\n    `Sec-WebSocket-Extensions: ${payload}`,\n    'Upgrade: websocket',\n    '\\r\\n'\n  ].join('\\r\\n');\n\n  const socket = net.connect(3000, function () {\n    socket.resume();\n    socket.write(request);\n  });\n});\n```\n\n\n## Recommendation\n\nUpdate to version 3.3.1 or later.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-hmm9-r2m2-qg9w",
  "modified": "2023-08-30T18:06:49Z",
  "published": "2021-05-21T16:22:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Nil dereference in NATS JWT causing DoS of nats-server",
  "details": "(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2020-26521.txt>)\n\n## Problem Description\n\nThe NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account.  The Operator should be able to safely issue Accounts to other entities which it does not fully trust.\n\nA malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.\n\nThe NATS Server is known to be impacted by this.\n\n\n## Affected versions\n\n#### JWT library\n\n * all versions prior to 1.1.0\n\n#### NATS Server\n\n * Version 2 prior to 2.1.9\n\n\n## Impact\n\n#### JWT library\n\n * Programs would nil dereference and panic, aborting execution by default.\n\n#### NATS server\n\n * Denial of Service caused by process termination\n\n\n## Workaround\n\nIf your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.\n\n\n## Solution\n\nUpgrade the JWT dependency in any application using it.\n\nUpgrade the NATS server if using NATS Accounts.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-h2x7-2ff6-v32p",
  "modified": "2023-08-30T18:02:56Z",
  "published": "2022-02-11T23:39:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "gobase subject to Incorrect routing of some HTTP requests when using httpauth due to a race condition",
  "details": "### Impact\nIncorrect routing of some HTTP requests when using httpauth due to a race condition\n\n### Patches\nUpgrade to version 0.7.2 for fix\n\n### Workarounds\nNone\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [nbosscher@blue-giraffe.ca](mailto:nbosscher@blue-giraffe.ca)",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-g3vv-g2j5-45f2",
  "modified": "2023-08-30T17:56:37Z",
  "published": "2022-04-08T22:08:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ipld/go-codec-dagpb panics when processing certain blocks",
  "details": "### Impact \nDecoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic.  The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.\n\n### Patches\nThe issue is fixed in v1.3.1 and above.\n\nConsumers can discover the versions of `go-codec-dagpb` in a module's dependency graph using the following command in the module root:\n\n```go mod graph | grep go-codec-dagpb```\n\n### Workarounds\nYou can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs)\n* Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)",
  "severity": [
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-23T20:10:38Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling",
  "details": "The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,9 +4,7 @@
  "modified": "2023-12-18T19:30:55Z",
  "published": "2023-12-15T00:31:03Z",
  "withdrawn": "2023-12-18T19:30:55Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvg2-7c3j-g36j. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-29w6-c52g-m8jc",
  "modified": "2024-01-31T18:05:46Z",
  "published": "2024-01-31T18:05:46Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "C5 Firefly III CSV Injection.",
  "details": "### Summary\nCSV injection is a vulnerability where untrusted user input in CSV files can lead to unauthorized access or data manipulation. \nIn my subsequent testing of the application.\n\n### Details\nI discovered that there is an option to \"Export Data\" from the web app to your personal computer, which exports a \"csv\" file that can be opened with Excel software that supports macros.\n\nP.S \nI discovered that the web application's is offering a demo-site that anyone may access to play with the web application. So, there's a chance that someone will export the data (CVS) from the demo site and execute it on their PC, giving the malicious actor a complete control over their machine. (if a user enters a malicious payload to the website).\n\n### PoC\nYou can check out my vulnerability report if you need more details/PoC with screenshots: (removed by JC5)\n\n### Impact\nAn attacker can exploit this by entering a specially crafted payload to one of the fields, and when a user export the csv file using the \"Export Data\" function, the attacker can potentiality can RCE.\n\n### Addendum by JC5, the developer of Firefly III\nThere is zero impact on normal users, even on vulnerable versions.",
  "severity": [
@@ -46,9 +44,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-31T18:05:46Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-7g9j-g5jg-3vv3",
  "modified": "2024-02-09T18:47:01Z",
  "published": "2024-01-24T20:53:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Unauthenticated Nonce Increment in snow",
  "details": "### Impact\nThere was a logic bug where unauthenticated payloads could still cause a nonce increment in snow's internal state. For an attacker with the ability to inject packets into the channel Noise is talking over, this allows a denial-of-service type attack which could prevent communication as it causes the sending and receiving side to be expecting different nonce values than would arrive.\n\nNote that this only affects those who are using the stateful `TransportState`, not those using `StatelessTransportState`.\n\n### Patches\nThis has been patched in version 0.9.5, and all users are recommended to update.\n\n### References\nThere will be a more formal report of this in the near future.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "ReDoS in Embedchain",
  "details": "The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Solr: Backup/Restore APIs allow for  deployment of executables in malicious ConfigSets ",
  "details": "Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1.\n\nIn the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API.\nWhen backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups).\nIf the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted.\n\nWhen Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries.\nUsers are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue.\nIn these versions, the following protections have been added:\n\n  *  Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader.\n  *  The Backup API restricts saving backups to directories that are used in the ClassLoader.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-c4cm-r9fh-jgj9",
  "modified": "2024-02-09T17:04:47Z",
  "published": "2024-02-09T17:04:47Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "commonground-api-common unexploitable privilege escalation in JWT authentication middleware",
  "details": "### Impact\n\nThis is a privilege escalation vulnerability. The impact is negligible and entirely theoretical.\n\nA non-exploitable weakness was found in how the client-supplied JWTs are verified. Because an explicit allow-list\nof known algorithms is used in the PyJWT library, user-supplied (invalid) algorithms are rejected.\n\nIf this was not the case, then the client JWTs could be tampered with, resulting in privilege escalation which\nwould allow the attacker to perform any operation as any client (impersonation) without leaving a trace of\nthe real user/client.\n\n\n### Patches\n\nWill be fixed in 1.12.2\n\n### Workarounds\n\nNone needed. But be careful when updating PyJWT. Check that the used PyJWT has no algorithms specified with a name in \"\", \"HS25\", \"HS2\", \"HS\", \"H\", or that those algorithms are acceptable.\n\n### Details\n\nThe header and payload of JSON Web Tokens (JWTs) are cryptographically signed with an algorithm. A JWT has a header field `alg` that specifies the algorithm used in the signature.\n\nThe `vng-api-common.middleware.AuthMiddleware` uses PyJWT to check the validity of JWT and indicates it should be \"HS256\", otherwise an attacker could construct a token with a cryptographically weak token. It should indicate this with a list of acceptable algorithms  `[\"HS256\"]`, but instead the string `\"HS256\"` is passed to PyJWT.  PyJWT does not check the type of the argument and checks if the `alg` string in the header exists in the acceptable algorithms value with the `in` operator. Any substring of `\"HS256\"` passes this `in` check. It is not exploitable because there is no such substring in de set of algorithms PyJWT supports.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -81,9 +77,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T17:04:47Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-rr69-rxr6-8qwf",
  "modified": "2024-02-09T16:03:32Z",
  "published": "2024-02-09T16:03:32Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "serde-json-wasm stack overflow during recursive JSON parsing",
  "details": "When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.\n",
  "severity": [
@@ -76,9 +74,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-09T16:03:32Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More