From 9dd087b14f203f7aecf22b9da84accd7dfebf9e6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 27 Jan 2025 20:51:58 +0000 Subject: [PATCH] Publish Advisories GHSA-2v3r-gvq5-qqgh GHSA-j2hp-6m75-v4j4 GHSA-rh4j-5rhw-hr54 GHSA-x2j8-vjg7-386r --- .../GHSA-2v3r-gvq5-qqgh.json | 36 +++++++-- .../GHSA-j2hp-6m75-v4j4.json | 65 ++++++++++++++++ .../GHSA-rh4j-5rhw-hr54.json | 77 +++++++++++++++++++ .../GHSA-x2j8-vjg7-386r.json | 36 +++++++-- 4 files changed, 200 insertions(+), 14 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json (64%) create mode 100644 advisories/github-reviewed/2025/01/GHSA-j2hp-6m75-v4j4/GHSA-j2hp-6m75-v4j4.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-rh4j-5rhw-hr54/GHSA-rh4j-5rhw-hr54.json rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json (64%) diff --git a/advisories/unreviewed/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json b/advisories/github-reviewed/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json similarity index 64% rename from advisories/unreviewed/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json rename to advisories/github-reviewed/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json index b41e7010a9f..edea88fd97f 100644 --- a/advisories/unreviewed/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json +++ b/advisories/github-reviewed/2025/01/GHSA-2v3r-gvq5-qqgh/GHSA-2v3r-gvq5-qqgh.json @@ -1,14 +1,30 @@ { "schema_version": "1.4.0", "id": "GHSA-2v3r-gvq5-qqgh", - "modified": "2025-01-27T18:32:01Z", + "modified": "2025-01-27T20:50:34Z", "published": "2025-01-27T18:32:01Z", "aliases": [ "CVE-2024-55227" ], + "summary": "Dolibarr Cross-site Scripting vulnerability", "details": "A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "21.0.0-beta" + ] + } + ], "references": [ { "type": "ADVISORY", @@ -30,16 +46,22 @@ "type": "WEB", "url": "https://gist.github.com/Dqtdqt/9762466cd6ec541ea265ba33b09489ff" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/security/policy" } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-01-27T20:50:34Z", "nvd_published_at": "2025-01-27T17:15:16Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-j2hp-6m75-v4j4/GHSA-j2hp-6m75-v4j4.json b/advisories/github-reviewed/2025/01/GHSA-j2hp-6m75-v4j4/GHSA-j2hp-6m75-v4j4.json new file mode 100644 index 00000000000..50b01578137 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-j2hp-6m75-v4j4/GHSA-j2hp-6m75-v4j4.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2hp-6m75-v4j4", + "modified": "2025-01-27T20:50:21Z", + "published": "2025-01-27T20:50:21Z", + "aliases": [ + "CVE-2025-24354" + ], + "summary": "imgproxy is vulnerable to SSRF against 0.0.0.0", + "details": "### Summary\n\nImgproxy does not block the `0.0.0.0` address, even with `IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES` set to false. This can expose services on the local host.\n\n### Details\n\nimgproxy protects against SSRF against a loopback address with the following check ([source](https://github.com/imgproxy/imgproxy/blob/0f37d62fd8326a32c213b30dd52e2319770885d8/security/source.go#L43C1-L47C1)):\n\n```\nif !config.AllowLoopbackSourceAddresses && ip.IsLoopback() {\n\treturn ErrSourceAddressNotAllowed\n}\n```\n\nThis check is insufficient to prevent accessing services on the local host, as services may receive traffic on `0.0.0.0`. Go's `IsLoopback` ([source](https://github.com/golang/go/blob/40b3c0e58a0ae8dec4684a009bf3806769e0fc41/src/net/ip.go#L126-L131)) strictly follows the definition of loopback IPs beginning with `127`. `0.0.0.0` is not blocked.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/imgproxy/imgproxy" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.27.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24354" + }, + { + "type": "WEB", + "url": "https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081" + }, + { + "type": "PACKAGE", + "url": "https://github.com/imgproxy/imgproxy" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-27T20:50:21Z", + "nvd_published_at": "2025-01-27T18:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-rh4j-5rhw-hr54/GHSA-rh4j-5rhw-hr54.json b/advisories/github-reviewed/2025/01/GHSA-rh4j-5rhw-hr54/GHSA-rh4j-5rhw-hr54.json new file mode 100644 index 00000000000..71a26448b49 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-rh4j-5rhw-hr54/GHSA-rh4j-5rhw-hr54.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rh4j-5rhw-hr54", + "modified": "2025-01-27T20:50:30Z", + "published": "2025-01-27T20:50:30Z", + "aliases": [ + "CVE-2025-24357" + ], + "summary": "vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator", + "details": "### Description\nThe vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It use torch.load function and weights_only parameter is default value False. There is a security warning on https://pytorch.org/docs/stable/generated/torch.load.html, when torch.load load a malicious pickle data it will execute arbitrary code during unpickling.\n\n### Impact\nThis vulnerability can be exploited to execute arbitrary codes and OS commands in the victim machine who fetch the pretrained repo remotely.\n\nNote that most models now use the safetensors format, which is not vulnerable to this issue.\n\n### References\n* https://pytorch.org/docs/stable/generated/torch.load.html\n* Fix: https://github.com/vllm-project/vllm/pull/12366", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "vllm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.7.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24357" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/pull/12366" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/commit/d3d6bb13fb62da3234addf6574922a4ec0513d04" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vllm-project/vllm" + }, + { + "type": "WEB", + "url": "https://github.com/vllm-project/vllm/releases/tag/v0.7.0" + }, + { + "type": "WEB", + "url": "https://pytorch.org/docs/stable/generated/torch.load.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-27T20:50:30Z", + "nvd_published_at": "2025-01-27T18:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json b/advisories/github-reviewed/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json similarity index 64% rename from advisories/unreviewed/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json rename to advisories/github-reviewed/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json index e6034422bfe..ed3bf3e9365 100644 --- a/advisories/unreviewed/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json +++ b/advisories/github-reviewed/2025/01/GHSA-x2j8-vjg7-386r/GHSA-x2j8-vjg7-386r.json @@ -1,14 +1,30 @@ { "schema_version": "1.4.0", "id": "GHSA-x2j8-vjg7-386r", - "modified": "2025-01-27T18:32:01Z", + "modified": "2025-01-27T20:50:36Z", "published": "2025-01-27T18:32:01Z", "aliases": [ "CVE-2024-55228" ], + "summary": "Dolibarr Cross-site Scripting vulnerability", "details": "A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "dolibarr/dolibarr" + }, + "versions": [ + "21.0.0-beta" + ] + } + ], "references": [ { "type": "ADVISORY", @@ -30,16 +46,22 @@ "type": "WEB", "url": "https://gist.github.com/Dqtdqt/a942bbce9a5fc851dce366902411c768" }, + { + "type": "PACKAGE", + "url": "https://github.com/Dolibarr/dolibarr" + }, { "type": "WEB", "url": "https://github.com/Dolibarr/dolibarr/security/policy" } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-01-27T20:50:36Z", "nvd_published_at": "2025-01-27T17:15:16Z" } } \ No newline at end of file