From 942f9aa57d295f9ee3e8442e12d652f548783230 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 12 Mar 2025 19:29:32 +0000 Subject: [PATCH] Publish Advisories GHSA-47ww-ff84-4jrg GHSA-q92j-grw3-h492 --- .../GHSA-47ww-ff84-4jrg.json | 84 ++++++++ .../GHSA-q92j-grw3-h492.json | 194 ++++++++++++++++++ 2 files changed, 278 insertions(+) create mode 100644 advisories/github-reviewed/2025/03/GHSA-47ww-ff84-4jrg/GHSA-47ww-ff84-4jrg.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-q92j-grw3-h492/GHSA-q92j-grw3-h492.json diff --git a/advisories/github-reviewed/2025/03/GHSA-47ww-ff84-4jrg/GHSA-47ww-ff84-4jrg.json b/advisories/github-reviewed/2025/03/GHSA-47ww-ff84-4jrg/GHSA-47ww-ff84-4jrg.json new file mode 100644 index 00000000000..4bd88fbfb88 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-47ww-ff84-4jrg/GHSA-47ww-ff84-4jrg.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-47ww-ff84-4jrg", + "modified": "2025-03-12T19:28:42Z", + "published": "2025-03-12T19:28:42Z", + "aliases": [], + "summary": "Cosmos SDK: x/group can halt when erroring in EndBlocker", + "details": "Name: ISA-2025-002: x/group can halt when erroring in EndBlocker\nComponent: CosmosSDK\nCriticality: High (Considerable Impact; Likely Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: <= v0.47.16, <= 0.50.12\nAffected users: Validators, Full nodes, Users on chains that utilize the groups module\nCosmos SDK chains in unpatched releases that use the `x/group` module are affected.\n\n### Description\n\nAn issue was discovered in the groups module where malicious proposals would result in an errors triggered in the module's end blocker that could result in a chain halt. Any set of users that can interact with the groups module could introduce this state.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe new Cosmos SDK release [v0.50.13](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.13) and [v0.47.17](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.17) fix this issue.\n\n### Testing\n\nTesting we have done to gain more confidence in this release:\n\nIn addition to testing Cosmos SDK we also did the following:\n\n- Ran a patched node in a local `v0.50` testnet with the failing state and did not halt (an unpatched network confirmed to halt)\n- Ran a patched node on Xion Mainnet (uses `x/group`)\n- Ran a patched node on Zetachain Mainnet (uses `x/xgroup`)\n \n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThere are no known workarounds for this issue. It is advised that chains apply the update.\n\nThis issue was reported to the Cosmos Bug Bounty Program by [dongsam](https://github.com/dongsam) on HackerOne on February 28, 2025. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/cosmos-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.50.0-alpha.0" + }, + { + "fixed": "0.50.13" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.50.12" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/cosmos-sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.47.17" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.47.16" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-47ww-ff84-4jrg" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/commit/cbd69fb1f4fac418c1f8c6253f5f91fb1263776a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/cosmos-sdk" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-755" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-12T19:28:42Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-q92j-grw3-h492/GHSA-q92j-grw3-h492.json b/advisories/github-reviewed/2025/03/GHSA-q92j-grw3-h492/GHSA-q92j-grw3-h492.json new file mode 100644 index 00000000000..42ad5b6d7f4 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-q92j-grw3-h492/GHSA-q92j-grw3-h492.json @@ -0,0 +1,194 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q92j-grw3-h492", + "modified": "2025-03-12T19:28:00Z", + "published": "2025-03-12T19:28:00Z", + "aliases": [ + "CVE-2025-27407" + ], + "summary": "graphql allows remote code execution when loading a crafted GraphQL schema", + "details": "# Summary\n\nLoading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.4.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.10" + }, + { + "fixed": "2.2.17" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.14" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.32" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "1.13.24" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0" + }, + { + "fixed": "1.12.25" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "graphql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.11.5" + }, + { + "fixed": "1.11.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492" + }, + { + "type": "WEB", + "url": "https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rmosolgo/graphql-ruby" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-03-12T19:28:00Z", + "nvd_published_at": null + } +} \ No newline at end of file