mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-773q-5334-5gf9",
|
||||
"modified": "2021-08-18T21:38:27Z",
|
||||
"published": "2021-08-25T20:55:36Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Memory over-allocation in evm-core",
|
||||
"details": "Prior to the patch, when executing specific EVM opcodes related\nto memory operations that use `evm_core::Memory::copy_large`, the\ncrate can over-allocate memory when it is not needed, making it\npossible for an attacker to perform denial-of-service attack.\n\nThe flaw was corrected in commit `19ade85`.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-jf43-3v8j-qwwr",
|
||||
"modified": "2023-06-13T20:04:37Z",
|
||||
"published": "2021-08-25T20:59:56Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Data races in multiqueue",
|
||||
"details": "Affected versions of multiqueue unconditionally implemented `Send` for types used in queue implementations (`InnerSend<RW, T>`, `InnerRecv<RW, T>`, `FutInnerSend<RW, T>`, `FutInnerRecv<RW, T>`). This allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior.\n",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-r6ff-2q3c-v3pv",
|
||||
"modified": "2021-08-09T17:13:06Z",
|
||||
"published": "2021-08-25T21:00:01Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Compiler optimisation leads to SEGFAULT",
|
||||
"details": "Affected versions of the `pnet` crate were optimized out by compiler, which caused dereference of uninitialized file descriptor which caused segfault.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-6hg4-vp5q-47mw",
|
||||
"modified": "2023-01-20T23:34:05Z",
|
||||
"published": "2023-01-20T23:34:05Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CakePHP allows direct access of prefixed controller actions",
|
||||
"details": "Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -196,9 +192,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T23:34:05Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-829q-v5g8-hhxc",
|
||||
"modified": "2023-01-20T23:02:02Z",
|
||||
"published": "2023-01-20T23:02:02Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CakePHP has incorrect Cross-Site Request Forgery validation",
|
||||
"details": "CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-f85w-wvc7-crwc",
|
||||
"modified": "2023-01-20T21:54:22Z",
|
||||
"published": "2023-01-20T21:54:22Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`",
|
||||
"details": "In affected versions of this crate, the lifetime of the iterator produced by `Vec::into_iter()` is not constrained to the lifetime of the `Bump` that allocated the vector's memory. Using the iterator after the `Bump` is dropped causes use-after-free accesses.\n\nThe following example demonstrates memory corruption arising from a misuse of this unsoundness.\n\n```rust\nuse bumpalo::{collections::Vec, Bump};\n\nfn main() {\n let bump = Bump::new();\n let mut vec = Vec::new_in(&bump);\n vec.extend([0x01u8; 32]);\n let into_iter = vec.into_iter();\n drop(bump);\n\n for _ in 0..100 {\n let reuse_bump = Bump::new();\n let _reuse_alloc = reuse_bump.alloc([0x41u8; 10]);\n }\n\n for x in into_iter {\n print!(\"0x{:02x} \", x);\n }\n println!();\n}\n```\n\nThe issue was corrected in version 3.11.1 by adding a lifetime to the `IntoIter` type, and updating the signature of `Vec::into_iter()` to constrain this lifetime.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T21:54:22Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-g6pw-999w-j75m",
|
||||
"modified": "2023-01-20T22:41:01Z",
|
||||
"published": "2023-01-20T22:41:01Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ELF header parsing library doesn't check for valid offset",
|
||||
"details": "The crate has several unsafe sections that don't perform proper pointer validation.\n\nAn example can be found in the following function:\n\n```\nfn section_header_raw(&self) -> &[ET::SectionHeader] {\n let sh_off = self.elf_header().section_header_offset() as usize;\n let sh_num = self.elf_header().section_header_entry_num() as usize;\n unsafe {\n let sh_ptr = self.content().as_ptr().add(sh_off);\n from_raw_parts(sh_ptr as *const ET::SectionHeader, sh_num)\n }\n}\n```\n\nWhile this will work perfectly fine *if* the ELF header is valid, malicious or malformed input can contain a section header offset of an arbitrary size, meaning that the resultant pointer in the unsafe block can point to an artibrary address in the address space of the process.\n\nThis can result in unpredictable behaviour, and in our fuzz testing, we discovered that it's trivial to cause SIGABRT (signal 6), or SEGV (signal 11).\n\nThe function should either be marked as unsafe, with a note that the caller is responsible for providing only valid inputs, or it should ideally do the due diligence to ensure that the offset doesn't exceed the bounds of the header (and add additional checks as necessary).\n\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T22:41:01Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-j9q2-f9q7-jhgq",
|
||||
"modified": "2023-01-20T23:22:09Z",
|
||||
"published": "2023-01-20T23:22:09Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CakePHP SecurityComponent cross form submission issue",
|
||||
"details": "Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -70,9 +66,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T23:22:09Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-p76f-wr22-4rv6",
|
||||
"modified": "2023-01-20T23:35:01Z",
|
||||
"published": "2023-01-20T23:35:01Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CakePHP vulnerable to Remote File Inclusion through View template name manipulation",
|
||||
"details": "CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -222,9 +218,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T23:35:01Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-q79m-c546-2g63",
|
||||
"modified": "2023-01-20T23:23:26Z",
|
||||
"published": "2023-01-20T23:23:26Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CakePHP vulnerable to Denial of Service attack through XML payloads",
|
||||
"details": "RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -184,9 +180,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T23:23:26Z",
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-q95h-cqrv-8jv5",
|
||||
"modified": "2023-01-20T19:33:40Z",
|
||||
"published": "2023-01-20T19:33:40Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ExifTool vulnerable to arbitrary code execution",
|
||||
"details": "### Impact\nArbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads\n\n### Patches\nExifTool has already been patched in version 12.24. `exiftool_vendored.rb`, which vendors ExifTool, includes this patch in [v12.25.0](https://github.com/exiftool-rb/exiftool_vendored.rb/releases/tag/v12.25.0).\n\n### Workarounds\nNo\n\n### References\nhttps://twitter.com/wcbowling/status/1385803927321415687\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-22204\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [exiftool_vendored.rb](https://github.com/exiftool-rb/exiftool_vendored.rb/issues)",
|
||||
"severity": [
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-xwhj-pqcg-8rcr",
|
||||
"modified": "2023-01-20T23:35:17Z",
|
||||
"published": "2023-01-20T23:35:17Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CakePHP vulnerable to Cross-site Scripting in some development error pages",
|
||||
"details": "CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only `missing route` and `duplicate named route` error pages.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -89,9 +85,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-20T23:35:17Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-6hcf-g6gr-hhcr",
|
||||
"modified": "2023-03-24T22:01:23Z",
|
||||
"published": "2023-03-24T22:01:23Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference",
|
||||
"details": "These functions would crash when the context argument was None with certain extension types.\n\nThanks to David Benjamin (Google) for reporting this issue.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-9qwg-crg9-m2vc",
|
||||
"modified": "2023-03-24T22:01:29Z",
|
||||
"published": "2023-03-24T22:01:29Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read",
|
||||
"details": "`SubjectAlternativeName` and `ExtendedKeyUsage` arguments were parsed using the OpenSSL function `X509V3_EXT_nconf`. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.\n\nThanks to David Benjamin (Google) for reporting this issue.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-03-24T22:01:29Z",
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-f5v5-ccqc-6w36",
|
||||
"modified": "2023-03-24T21:59:53Z",
|
||||
"published": "2023-03-24T21:59:53Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "async-nats vulnerable to TLS certificate common name validation bypass",
|
||||
"details": "The NATS official Rust clients are vulnerable to MitM when using TLS.\n\nThe common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with the `host` field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.\n\n## Reproduction steps\n\n1. The NATS Rust client tries to establish a new connection\n2. The connection is intercepted by a MitM proxy\n3. The proxy makes a separate connection to the NATS server\n4. The NATS server replies with an `INFO` message\n5. The proxy reads the `INFO`, alters the `host` JSON field and passes the tampered `INFO` back to the client\n6. The proxy upgrades the client connection to TLS, presenting a certificate issued by a certificate authority present in the client's keychain. In the previous step the `host` was set to the common name of said certificate\n7. `rustls` accepts the certificate, having verified that the common name matches the attacker-controlled value it was given\n8. The client has been fooled by the MitM proxy into accepting the attacker-controlled certificate\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-03-24T21:59:53Z",
|
||||
|
||||
@@ -54,9 +54,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-03-21T22:31:47Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-wvc4-j7g5-4f79",
|
||||
"modified": "2023-03-27T21:12:24Z",
|
||||
"published": "2023-03-27T21:12:24Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "NATS TLS certificate common name validation bypass",
|
||||
"details": "The NATS official Rust clients are vulnerable to MitM when using TLS.\n\nA fix for the `nats` crate hasn't been released yet. Since the `nats` crate is going to be deprecated anyway, consider switching to `async-nats` `>= 0.29` which already fixed this vulnerability.\n\nThe common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with the `host` field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.\n\n## Reproduction steps\n\n1. The NATS Rust client tries to establish a new connection\n2. The connection is intercepted by a MitM proxy\n3. The proxy makes a separate connection to the NATS server\n4. The NATS server replies with an `INFO` message\n5. The proxy reads the `INFO`, alters the `host` JSON field and passes the tampered `INFO` back to the client\n6. The proxy upgrades the client connection to TLS, presenting a certificate issued by a certificate authority present in the client's keychain. In the previous step the `host` was set to the common name of said certificate\n7. `rustls` accepts the certificate, having verified that the common name matches the attacker-controlled value it was given\n9. The client has been fooled by the MitM proxy into accepting the attacker-controlled certificate\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -7,12 +7,8 @@
|
||||
"CVE-2001-0293"
|
||||
],
|
||||
"details": "Directory traversal vulnerability in FtpXQ FTP server 2.0.93 allows remote attackers to read arbitrary files via a .. (dot dot) in the GET command.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -28,9 +24,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
|
||||
@@ -7,12 +7,8 @@
|
||||
"CVE-2001-0266"
|
||||
],
|
||||
"details": "Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -28,9 +24,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user