netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-fhr7-8jx4-r9cp
GHSA-r4w2-hjmr-36m7
GHSA-2326-pfpj-vx3h
GHSA-fhr7-8jx4-r9cp
GHSA-r4w2-hjmr-36m7
This commit is contained in:
advisory-database[bot]
2024-09-16 17:20:51 +00:00
parent 70898c0904
commit 99499cb76b
5 changed files with 290 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json
+104
View File
@@ -0,0 +1,104 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fhr7-8jx4-r9cp",
"modified": "2024-09-16T17:19:18Z",
"published": "2023-12-30T00:30:23Z",
"aliases": [
"CVE-2023-3628"
],
"summary": "Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions",
"details": "A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-server-rest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "15.0.0.Dev01"
},
{
"fixed": "15.0.0.Dev04"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-server-rest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.18.Final"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3628"
},
{
"type": "WEB",
"url": "https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263"
},
{
"type": "WEB",
"url": "https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5396"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3628"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217924"
},
{
"type": "PACKAGE",
"url": "https://github.com/infinispan/infinispan"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240125-0004"
}
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-09-16T17:19:18Z",
"nvd_published_at": "2023-12-18T14:15:08Z"
}
}
advisories/github-reviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json
+104
View File
@@ -0,0 +1,104 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4w2-hjmr-36m7",
"modified": "2024-09-16T17:19:37Z",
"published": "2023-12-30T00:30:23Z",
"aliases": [
"CVE-2023-3629"
],
"summary": " Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions",
"details": "A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-server-rest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "15.0.0.Dev01"
},
{
"fixed": "15.0.0.Dev04"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-server-rest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.18.Final"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3629"
},
{
"type": "WEB",
"url": "https://github.com/infinispan/infinispan/commit/11b3cb0f7ba68b73dd32f655ff3f3df842a0c6bd"
},
{
"type": "WEB",
"url": "https://github.com/infinispan/infinispan/commit/1e3cc542336d2f49743ab8176ed6f1175e034c59"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5396"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3629"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217926"
},
{
"type": "PACKAGE",
"url": "https://github.com/infinispan/infinispan"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240125-0004"
}
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-09-16T17:19:37Z",
"nvd_published_at": "2023-12-18T14:15:08Z"
}
}
advisories/github-reviewed/2024/09/GHSA-2326-pfpj-vx3h/GHSA-2326-pfpj-vx3h.json
+82
View File
@@ -0,0 +1,82 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2326-pfpj-vx3h",
"modified": "2024-09-16T17:19:01Z",
"published": "2024-09-16T17:19:01Z",
"aliases": [
],
"summary": "lexical-core has multiple soundness issues",
"details": "`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.\n",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "lexical-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/Alexhuszagh/rust-lexical/issues/101"
},
{
"type": "WEB",
"url": "https://github.com/Alexhuszagh/rust-lexical/issues/102"
},
{
"type": "WEB",
"url": "https://github.com/Alexhuszagh/rust-lexical/issues/104"
},
{
"type": "WEB",
"url": "https://github.com/Alexhuszagh/rust-lexical/issues/126"
},
{
"type": "WEB",
"url": "https://github.com/Alexhuszagh/rust-lexical/issues/95"
},
{
"type": "PACKAGE",
"url": "https://github.com/Alexhuszagh/rust-lexical"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-c2hm-mjxv-89r4"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2023-0055"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2023-0086.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-09-16T17:19:01Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fhr7-8jx4-r9cp",
"modified": "2024-09-16T14:37:22Z",
"published": "2023-12-30T00:30:23Z",
"aliases": [
"CVE-2023-3628"
],
"details": "A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3628"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5396"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3628"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217924"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240125-0004"
}
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-18T14:15:08Z"
}
}
advisories/unreviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4w2-hjmr-36m7",
"modified": "2024-09-16T14:37:22Z",
"published": "2023-12-30T00:30:23Z",
"aliases": [
"CVE-2023-3629"
],
"details": "A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3629"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5396"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3629"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217926"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240125-0004"
}
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-18T14:15:08Z"
}
}