From a0b339094dea28225e45c1d827e57350194cb673 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 18 Dec 2023 19:31:47 +0000 Subject: [PATCH] Publish Advisories GHSA-q7jc-v6f2-q9jr GHSA-4h72-34j6-j8x7 GHSA-5968-qw33-h47j GHSA-9hmq-fm33-x4xx GHSA-cvg2-7c3j-g36j GHSA-q7jc-v6f2-q9jr --- .../GHSA-q7jc-v6f2-q9jr.json | 59 ++++++++++ .../GHSA-4h72-34j6-j8x7.json | 61 +++++++++++ .../GHSA-5968-qw33-h47j.json | 32 ++++-- .../GHSA-9hmq-fm33-x4xx.json | 65 +++++++++++ .../GHSA-cvg2-7c3j-g36j.json | 101 ++++++++++++++++++ .../GHSA-q7jc-v6f2-q9jr.json | 39 ------- 6 files changed, 312 insertions(+), 45 deletions(-) create mode 100644 advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json create mode 100644 advisories/github-reviewed/2023/12/GHSA-4h72-34j6-j8x7/GHSA-4h72-34j6-j8x7.json rename advisories/{unreviewed => github-reviewed}/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json (55%) create mode 100644 advisories/github-reviewed/2023/12/GHSA-9hmq-fm33-x4xx/GHSA-9hmq-fm33-x4xx.json create mode 100644 advisories/github-reviewed/2023/12/GHSA-cvg2-7c3j-g36j/GHSA-cvg2-7c3j-g36j.json delete mode 100644 advisories/unreviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json diff --git a/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json b/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json new file mode 100644 index 00000000000..0bf06d23919 --- /dev/null +++ b/advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7jc-v6f2-q9jr", + "modified": "2023-12-18T19:30:26Z", + "published": "2022-12-13T15:30:26Z", + "withdrawn": "2023-12-18T19:30:26Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9hmq-fm33-x4xx. This link is maintained to preserve external references.\n\n## Original Description\nResque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "resque-scheduler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.27.4" + }, + { + "fixed": "4.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44303" + }, + { + "type": "WEB", + "url": "https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job" + }, + { + "type": "WEB", + "url": "http://resque.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-18T19:30:26Z", + "nvd_published_at": "2022-12-13T15:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-4h72-34j6-j8x7/GHSA-4h72-34j6-j8x7.json b/advisories/github-reviewed/2023/12/GHSA-4h72-34j6-j8x7/GHSA-4h72-34j6-j8x7.json new file mode 100644 index 00000000000..9995ac7d99b --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-4h72-34j6-j8x7/GHSA-4h72-34j6-j8x7.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4h72-34j6-j8x7", + "modified": "2023-12-18T19:31:12Z", + "published": "2023-12-18T19:31:12Z", + "aliases": [ + + ], + "summary": "Maloja error page XSS vulnerability", + "details": "### Impact\nThe error page for a missing path echoes the path back to the user. If this contains HTML, an attacker could execute a script on the user's machine inside the Maloja context and perform authorized actions like scrobbling or deleting scrobbles.\nThis does not affect the security of your server. The exploit is purely client-side.\nSince there is very little incentive to mess with your scrobble data and it requires very specific targeting (an attacker would have to send a user a link to their own server), the severity rating might be misleading.\n\n### Patches\nThe Vulnerability is patched in 3.2.2\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "malojaserver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/krateng/maloja/security/advisories/GHSA-4h72-34j6-j8x7" + }, + { + "type": "WEB", + "url": "https://github.com/krateng/maloja/commit/febaff97228b37a192f2630aa331cac5e5c3e98e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/krateng/maloja" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-18T19:31:12Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json b/advisories/github-reviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json similarity index 55% rename from advisories/unreviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json rename to advisories/github-reviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json index 372ae8c1397..a4f10e89dd4 100644 --- a/advisories/unreviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json +++ b/advisories/github-reviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json @@ -1,12 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-5968-qw33-h47j", - "modified": "2023-12-15T00:31:03Z", + "modified": "2023-12-18T19:30:55Z", "published": "2023-12-15T00:31:03Z", + "withdrawn": "2023-12-18T19:30:55Z", "aliases": [ - "CVE-2023-6134" + ], - "details": "A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.", + "summary": "Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvg2-7c3j-g36j. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +16,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "23.0.3" + } + ] + } + ] + } ], "references": [ { @@ -63,8 +83,8 @@ "CWE-75" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-18T19:30:55Z", "nvd_published_at": "2023-12-14T22:15:44Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-9hmq-fm33-x4xx/GHSA-9hmq-fm33-x4xx.json b/advisories/github-reviewed/2023/12/GHSA-9hmq-fm33-x4xx/GHSA-9hmq-fm33-x4xx.json new file mode 100644 index 00000000000..cdf04e97b56 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-9hmq-fm33-x4xx/GHSA-9hmq-fm33-x4xx.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9hmq-fm33-x4xx", + "modified": "2023-12-18T19:30:32Z", + "published": "2023-12-18T19:30:32Z", + "aliases": [ + "CVE-2022-44303" + ], + "summary": "Resque Scheduler Reflected XSS In Delayed Jobs View", + "details": "### Impact\n\nResque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.\n\n### Patches\n\nFixed in v4.10.2\n\n### Workarounds\n\nNo known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.\n\n### References\n* https://nvd.nist.gov/vuln/detail/CVE-2022-44303\n* https://github.com/resque/resque-scheduler/issues/761\n* https://github.com/resque/resque/issues/1885\n* https://github.com/resque/resque-scheduler/pull/780\n* https://github.com/resque/resque-scheduler/pull/783\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "resque-scheduler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.27.4" + }, + { + "fixed": "4.10.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44303" + }, + { + "type": "PACKAGE", + "url": "https://github.com/resque/resque-scheduler" + }, + { + "type": "WEB", + "url": "https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-18T19:30:32Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-cvg2-7c3j-g36j/GHSA-cvg2-7c3j-g36j.json b/advisories/github-reviewed/2023/12/GHSA-cvg2-7c3j-g36j/GHSA-cvg2-7c3j-g36j.json new file mode 100644 index 00000000000..3c44b61e30d --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-cvg2-7c3j-g36j/GHSA-cvg2-7c3j-g36j.json @@ -0,0 +1,101 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cvg2-7c3j-g36j", + "modified": "2023-12-18T19:31:02Z", + "published": "2023-12-18T19:31:02Z", + "aliases": [ + "CVE-2023-6134" + ], + "summary": "Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri", + "details": "Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "23.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-cvg2-7c3j-g36j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6134" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7854" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7855" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7856" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7857" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7858" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7860" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7861" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-6134" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249673" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-75" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-18T19:31:02Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json b/advisories/unreviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json deleted file mode 100644 index 922e4d9b2d1..00000000000 --- a/advisories/unreviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-q7jc-v6f2-q9jr", - "modified": "2022-12-13T15:30:26Z", - "published": "2022-12-13T15:30:26Z", - "aliases": [ - "CVE-2022-44303" - ], - "details": "Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44303" - }, - { - "type": "WEB", - "url": "https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job" - }, - { - "type": "WEB", - "url": "http://resque.com" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-12-13T15:15:00Z" - } -} \ No newline at end of file