diff --git a/advisories/github-reviewed/2025/05/GHSA-965r-9cg9-g42p/GHSA-965r-9cg9-g42p.json b/advisories/github-reviewed/2025/05/GHSA-965r-9cg9-g42p/GHSA-965r-9cg9-g42p.json index e98c5a0af0b..2ab60fd1b53 100644 --- a/advisories/github-reviewed/2025/05/GHSA-965r-9cg9-g42p/GHSA-965r-9cg9-g42p.json +++ b/advisories/github-reviewed/2025/05/GHSA-965r-9cg9-g42p/GHSA-965r-9cg9-g42p.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-965r-9cg9-g42p", - "modified": "2025-05-30T15:18:12Z", + "modified": "2025-06-04T20:48:00Z", "published": "2025-05-28T14:38:54Z", "aliases": [ "CVE-2025-48881" ], "summary": "Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users", - "details": "### Impact\nAll objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users.\n\nIf object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations.\n\n### Attack requirements\nThe following conditions have to be met in order to perform this attack:\n- A user must be logged in\n - No relevant application roles are required\n- At least one object-type must be configured via object-management\n - The scope of the attack is limited to objects that are configured via object-management.\n - The value of `showInDataMenu` is irrelevant for this attack\n\n### Patches\nNo patch is available yet\n\n### Workarounds\nIt is possible to override the endpoint security as defined in `ObjectenApiHttpSecurityConfigurer` and `ObjectManagementHttpSecurityConfigurer`. Depending on the implementation, this could result in loss of functionality.", + "details": "### Impact\nAll objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users.\n\nIf object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations.\n\n### Attack requirements\nThe following conditions have to be met in order to perform this attack:\n- A user must be logged in\n - No relevant application roles are required\n- At least one object-type must be configured via object-management\n - The scope of the attack is limited to objects that are configured via object-management.\n - The value of `showInDataMenu` is irrelevant for this attack\n\n### Patches\nThis issue was patched in version 12.13.0.RELEASE.\n\n### Workarounds\nIt is possible to override the endpoint security as defined in `ObjectenApiHttpSecurityConfigurer` and `ObjectManagementHttpSecurityConfigurer`. Depending on the implementation, this could result in loss of functionality.", "severity": [ { "type": "CVSS_V3", @@ -66,7 +66,7 @@ "introduced": "12.0.0.RELEASE" }, { - "last_affected": "12.12.0.RELEASE" + "fixed": "12.13.0.RELEASE" } ] } @@ -85,7 +85,7 @@ "introduced": "12.0.0.RELEASE" }, { - "last_affected": "12.12.0.RELEASE" + "fixed": "12.13.0.RELEASE" } ] } @@ -101,6 +101,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48881" }, + { + "type": "WEB", + "url": "https://github.com/valtimo-platform/valtimo-backend-libraries/commit/6ab04b30d3dab816bfea32d40ba50e5dd4517272" + }, { "type": "PACKAGE", "url": "https://github.com/valtimo-platform/valtimo-backend-libraries" diff --git a/advisories/github-reviewed/2025/06/GHSA-2x3r-hwv5-p32x/GHSA-2x3r-hwv5-p32x.json b/advisories/github-reviewed/2025/06/GHSA-2x3r-hwv5-p32x/GHSA-2x3r-hwv5-p32x.json new file mode 100644 index 00000000000..a10e28e8c80 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-2x3r-hwv5-p32x/GHSA-2x3r-hwv5-p32x.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2x3r-hwv5-p32x", + "modified": "2025-06-04T20:48:56Z", + "published": "2025-06-04T20:48:56Z", + "aliases": [ + "CVE-2025-24015" + ], + "summary": "Deno's AES GCM authentication tags are not verified", + "details": "### Summary\n\nThis affects AES-256-GCM and AES-128-GCM in Deno, introduced by commit [0d1beed](https://github.com/denoland/deno/commit/0d1beed). Specifically, the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as does Node.js.\n\nWithout authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set_aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective.\n\n### PoC\n\n```ts\nimport { Buffer } from \"node:buffer\";\nimport {\n createCipheriv,\n createDecipheriv,\n randomBytes,\n scrypt,\n} from \"node:crypto\";\n\ntype Encrypted = {\n salt: string;\n iv: string;\n enc: string;\n authTag: string;\n};\n\nconst deriveKey = (key: string, salt: Buffer) =>\n new Promise((res, rej) =>\n scrypt(key, salt, 32, (err, k) => {\n if (err) rej(err);\n else res(k);\n })\n );\n\nasync function encrypt(text: string, key: string): Promise {\n const salt = randomBytes(32);\n const k = await deriveKey(key, salt);\n\n const iv = randomBytes(16);\n const enc = createCipheriv(\"aes-256-gcm\", k, iv);\n const ciphertext = enc.update(text, \"binary\", \"binary\") + enc.final(\"binary\");\n\n return {\n salt: salt.toString(\"binary\"),\n iv: iv.toString(\"binary\"),\n enc: ciphertext,\n authTag: enc.getAuthTag().toString(\"binary\"),\n };\n}\n\nasync function decrypt(enc: Encrypted, key: string) {\n const k = await deriveKey(key, Buffer.from(enc.salt, \"binary\"));\n const dec = createDecipheriv(\"aes-256-gcm\", k, Buffer.from(enc.iv, \"binary\"));\n\n const out = dec.update(enc.enc, \"binary\", \"binary\");\n dec.setAuthTag(Buffer.from(enc.authTag, \"binary\"));\n return out + dec.final(\"binary\");\n}\n\nconst test = await encrypt(\"abcdefghi\", \"key\");\ntest.enc = \"\";\nconsole.log(await decrypt(test, \"\")); // no error\n```\n\n### Impact\n\nWhile discovered through experimentation, authentication failures that should raise errors may be silently ignored.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "deno" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.46.0" + }, + { + "fixed": "2.1.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "deno_node" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.102.0" + }, + { + "fixed": "0.125.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/denoland/deno/security/advisories/GHSA-2x3r-hwv5-p32x" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24015" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/commit/0d1beed2e3633d71d5e288e0382b85be361ec13d" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/commit/4f27d7cdc02e3edfb9d36275341fb8185d6e99ed" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/commit/a4003a5292bd0affefad3ecb24a8732886900f67" + }, + { + "type": "PACKAGE", + "url": "https://github.com/denoland/deno" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-06-04T20:48:56Z", + "nvd_published_at": "2025-06-03T23:15:20Z" + } +} \ No newline at end of file