Publish Advisories

GHSA-248v-346w-9cwc
GHSA-mm6v-68qp-f9fw

advisories/github-reviewed/2024/07/GHSA-248v-346w-9cwc/GHSA-248v-346w-9cwc.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-248v-346w-9cwc",
-  "modified": "2025-02-11T22:38:18Z",
+  "modified": "2025-02-13T00:44:19Z",
   "published": "2024-07-05T20:06:40Z",
   "aliases": [
     "CVE-2024-39689"
@@ -47,6 +47,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/certifi/python-certifi"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"

advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mm6v-68qp-f9fw",
-  "modified": "2025-02-12T20:51:44Z",
+  "modified": "2025-02-13T00:44:33Z",
   "published": "2025-01-15T22:04:19Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-25286"
+  ],
   "summary": "Crayfish allows Remote Code Execution via Homarus Authorization header",
   "details": "### Impact\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n\n- XBOW-024-071",
   "severity": [