From 9f1b79d4420dbf0b79b6b644067ee74df5e91328 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 15 Oct 2024 18:13:23 +0000
Subject: [PATCH] Publish Advisories

GHSA-f96h-pmfr-66vw
GHSA-qcvh-p9jq-wp8v
---
 .../GHSA-f96h-pmfr-66vw.json                  | 61 +++++++++++++++++
 .../GHSA-qcvh-p9jq-wp8v.json                  | 65 +++++++++++++++++++
 2 files changed, 126 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json
 create mode 100644 advisories/github-reviewed/2024/10/GHSA-qcvh-p9jq-wp8v/GHSA-qcvh-p9jq-wp8v.json

diff --git a/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json b/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json
new file mode 100644
index 00000000000..42573c1d11c
--- /dev/null
+++ b/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f96h-pmfr-66vw",
+  "modified": "2024-10-15T18:12:57Z",
+  "published": "2024-10-15T18:12:57Z",
+  "aliases": [
+    "CVE-2024-47874"
+  ],
+  "summary": "Starlette Denial of service (DoS) via multipart/form-data",
+  "details": "### Summary\nStarlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.\n\n### PoC\n\n```python\nfrom starlette.applications import Starlette\nfrom starlette.routing import Route\n\nasync def poc(request):\n    async with request.form():\n        pass\n\napp = Starlette(routes=[\n    Route('/', poc, methods=[\"POST\"]),\n])\n```\n\n```sh\ncurl http://localhost:8000 -F 'big=</dev/urandom'\n```\n\n### Impact\nThis Denial of service (DoS) vulnerability affects all applications built with Starlette (or FastAPI) accepting form requests.\n",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "starlette"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.40.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/encode/starlette"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-15T18:12:57Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/10/GHSA-qcvh-p9jq-wp8v/GHSA-qcvh-p9jq-wp8v.json b/advisories/github-reviewed/2024/10/GHSA-qcvh-p9jq-wp8v/GHSA-qcvh-p9jq-wp8v.json
new file mode 100644
index 00000000000..76545cb8e94
--- /dev/null
+++ b/advisories/github-reviewed/2024/10/GHSA-qcvh-p9jq-wp8v/GHSA-qcvh-p9jq-wp8v.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qcvh-p9jq-wp8v",
+  "modified": "2024-10-15T18:11:52Z",
+  "published": "2024-10-15T18:11:51Z",
+  "aliases": [
+    "CVE-2024-47824"
+  ],
+  "summary": "Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room",
+  "details": "### Impact\n\nmatrix-react-sdk before 3.102.0 allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite.\n\n### Patches\n\nmatrix-react-sdk 3.102.0 [disables sharing message keys on invite](https://github.com/matrix-org/matrix-react-sdk/pull/12618) by removing calls to the vulnerable functionality.\n\n### Workarounds\n\nNone.\n\n### References\n\nThe vulnerability in matrix-react-sdk is caused by calling `MatrixClient.sendSharedHistoryKeys` in matrix-js-sdk, which is inherently vulnerable to this sort of attack. This matrix-js-sdk vulnerability is tracked as CVE-2024-47080 / [GHSA-4jf8-g8wp-cx7c](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-4jf8-g8wp-cx7c). Given that this functionality is not specific to sharing message keys on *invite*, is optional, has to be explicitly called by the caller and has been independently patched in matrix-react-sdk by removing the offending calls, we believe it is proper to treat the matrix-react-sdk vulnerability as a separate one, with its own advisory and CVE.\n\nThe matrix-org/matrix-react-sdk repository has recently been archived and the project was moved to [element-hq/matrix-react-sdk](https://github.com/element-hq/matrix-react-sdk). Given that this happened *after* the first patched release, no releases of the project on [element-hq/matrix-react-sdk](https://github.com/element-hq/matrix-react-sdk) were ever vulnerable to this vulnerability.\n\nPatching pull request: https://github.com/matrix-org/matrix-react-sdk/pull/12618.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at security at [security at matrix.org](mailto:security@matrix.org).\n",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "matrix-react-sdk"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.18.0"
+            },
+            {
+              "fixed": "3.102.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/matrix-org/matrix-react-sdk/pull/12618"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/matrix-org/matrix-react-sdk"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-15T18:11:51Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file