netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-246p-xmg8-wmcq
GHSA-38jr-29fh-w9vm
GHSA-592j-995h-p23j
GHSA-87qp-7cw8-8q9c
GHSA-g4v6-69p6-q3p4
GHSA-jwrc-3v3f-5cq5
GHSA-v5h6-c2hv-hv3r
GHSA-jwrc-3v3f-5cq5
This commit is contained in:
advisory-database[bot]
2024-03-25 19:38:18 +00:00
parent 37755301fd
commit 93ad82c81f
8 changed files with 557 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/03/GHSA-246p-xmg8-wmcq/GHSA-246p-xmg8-wmcq.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-246p-xmg8-wmcq",
"modified": "2024-03-25T19:37:27Z",
"published": "2024-03-25T19:37:27Z",
"aliases": [
"CVE-2024-29194"
],
"summary": "OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation",
"details": "## Summary\nA security vulnerability exists in oneuptime's local storage handling, where a regular user can escalate privileges by modifying the `is_master_admin` key to `true`. This allows unauthorized access to administrative functionalities.\n\n## Details\nThe vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the `is_master_admin` key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. \n\n## POC\n(I am using Firefox Developer to demonstrate this vulnerability)\nLog in as a normal user. Open developer tools (hit F12), click Storage, then Local Storage. Modify the `is_master_admin` key from `false` to `true`.\n\n## Impact\nThis vulnerability represents a high security risk as it allows any authenticated user to gain administrative privileges through client-side manipulation. Most of the admin previlages were disabled except the user list. Where an attacker could see all the list of users who signed up to OneUptome. \n\n\n## Patch\nThis has been patched in 7.0.1815",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@oneuptime/model"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.1815"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@oneuptime/common-server"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.1815"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-246p-xmg8-wmcq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29194"
},
{
"type": "WEB",
"url": "https://github.com/OneUptime/oneuptime/commit/14016d23d834038dd65d3a96cf71af04b556a32c"
},
{
"type": "PACKAGE",
"url": "https://github.com/OneUptime/oneuptime"
}
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:37:27Z",
"nvd_published_at": "2024-03-24T19:15:07Z"
}
}
advisories/github-reviewed/2024/03/GHSA-38jr-29fh-w9vm/GHSA-38jr-29fh-w9vm.json
+100
View File
@@ -0,0 +1,100 @@
{
"schema_version": "1.4.0",
"id": "GHSA-38jr-29fh-w9vm",
"modified": "2024-03-25T19:37:46Z",
"published": "2024-03-25T19:37:46Z",
"aliases": [
"CVE-2024-29189"
],
"summary": "ansys-geometry-core OS Command Injection vulnerability",
"details": "subprocess call with shell=True identified, security issue.\n\n#### Code\n\nOn file [src/ansys/geometry/core/connection/product_instance.py](https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428):\n\n```\n403 def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:\n404 \"\"\"\n405 Start the program where the path is the first item of the ``args`` array argument.\n406\n407 Parameters\n408 ----------\n409 args : List[str]\n410 List of arguments to be passed to the program. The first list's item shall\n411 be the program path.\n412 local_env : Dict[str,str]\n413 Environment variables to be passed to the program.\n414\n415 Returns\n416 -------\n417 subprocess.Popen\n418 The subprocess object.\n419 \"\"\"\n420 return subprocess.Popen(\n421 args,\n422 shell=os.name != \"nt\",\n423 stdin=subprocess.DEVNULL,\n424 stdout=subprocess.DEVNULL,\n425 stderr=subprocess.DEVNULL,\n426 env=local_env,\n427 )\n428 \n429 \n\n```\n\nUpon calling this method ``_start_program`` directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. With this resolution made through #1076 and #1077, we make sure that this method is only called from within the library and we are no longer enabling the ``shell=True`` option.\n\n#### CWE - 78\n\nFor more information see https://cwe.mitre.org/data/definitions/78.html\n\n#### More information\n\nVisit https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html to find out more information.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansys-geometry-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.3.0"
},
{
"fixed": "0.3.3"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansys-geometry-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.4.0"
},
{
"fixed": "0.4.12"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm"
},
{
"type": "WEB",
"url": "https://github.com/ansys/pyansys-geometry/pull/1076"
},
{
"type": "WEB",
"url": "https://github.com/ansys/pyansys-geometry/pull/1077"
},
{
"type": "WEB",
"url": "https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc"
},
{
"type": "WEB",
"url": "https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f"
},
{
"type": "WEB",
"url": "https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansys/pyansys-geometry"
},
{
"type": "WEB",
"url": "https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:37:46Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/03/GHSA-592j-995h-p23j/GHSA-592j-995h-p23j.json
+147
View File
@@ -0,0 +1,147 @@
{
"schema_version": "1.4.0",
"id": "GHSA-592j-995h-p23j",
"modified": "2024-03-25T19:37:00Z",
"published": "2024-03-25T19:36:59Z",
"aliases": [
"CVE-2024-27281"
],
"summary": "RDoc RCE vulnerability with .rdoc_options",
"details": "An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.\n\nWhen parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.\n\nWhen loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.\n\nWe recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.0 users: Update to `rdoc` 6.3.4.1\n* For Ruby 3.1 users: Update to `rdoc` 6.4.1.1\n* For Ruby 3.2 users: Update to `rdoc` 6.5.1.1\n\nYou can use `gem update rdoc` to update it. If you are using bundler, please add `gem \"rdoc\", \">= 6.6.3.1\"` to your `Gemfile`.\n\nNote: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rdoc"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.3.4.1"
}
]
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rdoc"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.4.0"
},
{
"fixed": "6.4.1.1"
}
]
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rdoc"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.5.0"
},
{
"fixed": "6.5.1.1"
}
]
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "rdoc"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.6.0"
},
{
"fixed": "6.6.3.1"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/1254b0066f312ddbf7fae7a195e66ce5b3bc6656"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/48617985e9fbc2825219d55f04e3e0e98d2923be"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/811f125a4a0cc968e3eb18e16ea6c1a3b49a11bf"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/d22ba930f1f611dda531dba04cd3d2531bb3f8a5"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rdoc/commit/e4a0e71e6f1032f8b4e5e58b4ef60d702c22ce17"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/rdoc"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2024-27281.yml"
},
{
"type": "WEB",
"url": "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:36:59Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json → advisories/github-reviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-87qp-7cw8-8q9c",
"modified": "2024-03-25T06:30:24Z",
"modified": "2024-03-25T19:36:43Z",
"published": "2024-03-25T06:30:24Z",
"aliases": [
"CVE-2024-21505"
],
"summary": "web3-utils Prototype Pollution vulnerability",
"details": "Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.\nAn attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "web3-utils"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/web3/web3.js/commit/8ed041c6635d807b3da8960ad49e125e3d1b0e80"
},
{
"type": "PACKAGE",
"url": "https://github.com/web3/web3.js"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-WEB3UTILS-6229337"
@@ -35,8 +58,8 @@
"CWE-1321"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:36:43Z",
"nvd_published_at": "2024-03-25T05:15:50Z"
}
}
advisories/github-reviewed/2024/03/GHSA-g4v6-69p6-q3p4/GHSA-g4v6-69p6-q3p4.json
+64
View File
File diff suppressed because one or more lines are too long
advisories/github-reviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jwrc-3v3f-5cq5",
"modified": "2024-03-25T19:37:34Z",
"published": "2024-03-23T21:30:39Z",
"aliases": [
"CVE-2024-1603"
],
"summary": "PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file",
"details": "paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "paddlepaddle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.6.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1603"
},
{
"type": "PACKAGE",
"url": "https://github.com/PaddlePaddle/Paddle"
},
{
"type": "WEB",
"url": "https://github.com/PaddlePaddle/Paddle/blob/release/2.6/python/paddle/vision/ops.py#L1262"
},
{
"type": "WEB",
"url": "https://github.com/PaddlePaddle/Paddle/blob/release/2.6/python/paddle/vision/ops.py#L1295-L1334"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e"
}
],
"database_specific": {
"cwe_ids": [
"CWE-73"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:37:34Z",
"nvd_published_at": "2024-03-23T19:15:07Z"
}
}
advisories/github-reviewed/2024/03/GHSA-v5h6-c2hv-hv3r/GHSA-v5h6-c2hv-hv3r.json
+66
View File
@@ -0,0 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v5h6-c2hv-hv3r",
"modified": "2024-03-25T19:36:52Z",
"published": "2024-03-25T19:36:52Z",
"aliases": [
"CVE-2024-27280"
],
"summary": "StringIO buffer overread vulnerability",
"details": "An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.\n\nThe `ungetbyte` and `ungetc` methods on a StringIO can read past the end of a string, and a subsequent call to `StringIO.gets` may return the memory value.\n\nThis vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.\n\nWe recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.0 users: Update to `stringio` 3.0.1.1\n* For Ruby 3.1 users: Update to `stringio` 3.1.0.2\n\nYou can use `gem update stringio` to update it. If you are using bundler, please add `gem \"stringio\", \">= 3.0.1.2\"` to your `Gemfile`.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "stringio"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1.1"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/ruby/stringio/commit/0e596524097706263d10900ca180898e4a8f5233"
},
{
"type": "WEB",
"url": "https://github.com/ruby/stringio/commit/c58c5f54f1eab99665ea6a161d29ff6a7490afc8"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/stringio"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stringio/CVE-2024-27280.yml"
},
{
"type": "WEB",
"url": "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280"
}
],
"database_specific": {
"cwe_ids": [
"CWE-126"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:36:52Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jwrc-3v3f-5cq5",
"modified": "2024-03-23T21:30:39Z",
"published": "2024-03-23T21:30:39Z",
"aliases": [
"CVE-2024-1603"
],
"details": "confirmed",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1603"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e"
}
],
"database_specific": {
"cwe_ids": [
"CWE-73"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-23T19:15:07Z"
}
}