From a167695237e53faf86b5c1fe8f7a3d9329bc5e35 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 1 May 2024 13:08:11 +0000 Subject: [PATCH] Publish Advisories GHSA-2cgq-h8xw-2v5j GHSA-4jrx-5w4h-3gpm GHSA-jxgr-gcj5-cqqg --- .../04/GHSA-2cgq-h8xw-2v5j/GHSA-2cgq-h8xw-2v5j.json | 4 ++-- .../05/GHSA-4jrx-5w4h-3gpm/GHSA-4jrx-5w4h-3gpm.json | 8 ++++++-- .../05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json | 12 ++++++++---- 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/advisories/github-reviewed/2024/04/GHSA-2cgq-h8xw-2v5j/GHSA-2cgq-h8xw-2v5j.json b/advisories/github-reviewed/2024/04/GHSA-2cgq-h8xw-2v5j/GHSA-2cgq-h8xw-2v5j.json index 3d27ccba0b4..93bb7d5b8b2 100644 --- a/advisories/github-reviewed/2024/04/GHSA-2cgq-h8xw-2v5j/GHSA-2cgq-h8xw-2v5j.json +++ b/advisories/github-reviewed/2024/04/GHSA-2cgq-h8xw-2v5j/GHSA-2cgq-h8xw-2v5j.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-2cgq-h8xw-2v5j", - "modified": "2024-04-30T09:39:38Z", + "modified": "2024-05-01T13:06:49Z", "published": "2024-04-30T09:39:38Z", "aliases": [ "CVE-2024-3154" ], "summary": "CRI-O vulnerable to an arbitrary systemd property injection", - "details": "### Impact\nOn CRI-O, an arbitrary systemd property can be injected via a Pod annotation:\n```\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: poc-arbitrary-systemd-property-injection\n annotations:\n # I believe that ExecStart with an arbitrary command works here too,\n # but I haven't figured out how to marshalize the ExecStart struct to gvariant string.\n org.systemd.property.SuccessAction: \"'poweroff-force'\"\nspec:\n containers:\n - name: hello\n image: [quay.io/podman/hello](http://quay.io/podman/hello)\n```\n\nThis means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.\n\nTested with CRI-O v1.24 on minikube.\n\nThanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations:\nhttps://github.com/opencontainers/runc/pull/3923#discussion_r1532292536\n\nCRI-O has to filter out annotations that have the prefix \"org.systend.property.\"\n\nSee also:\n- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson\n- https://github.com/opencontainers/runc/pull/4217\n\n\n### Workarounds\nUnfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations", + "details": "### Impact\nOn CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation:\n```\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: poc-arbitrary-systemd-property-injection\n annotations:\n # I believe that ExecStart with an arbitrary command works here too,\n # but I haven't figured out how to marshalize the ExecStart struct to gvariant string.\n org.systemd.property.SuccessAction: \"'poweroff-force'\"\nspec:\n containers:\n - name: hello\n image: [quay.io/podman/hello](http://quay.io/podman/hello)\n```\n\nThis means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.\n\nTested with CRI-O v1.24 on minikube.\nI didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367\n\nThanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations:\nhttps://github.com/opencontainers/runc/pull/3923#discussion_r1532292536\n\nCRI-O has to filter out annotations that have the prefix \"org.systemd.property.\"\n\nSee also:\n- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson\n- https://github.com/opencontainers/runc/pull/4217\n\n\n### Workarounds\nUnfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations\n\n### References\n\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/05/GHSA-4jrx-5w4h-3gpm/GHSA-4jrx-5w4h-3gpm.json b/advisories/github-reviewed/2024/05/GHSA-4jrx-5w4h-3gpm/GHSA-4jrx-5w4h-3gpm.json index cf3cb48b842..ca4786c694b 100644 --- a/advisories/github-reviewed/2024/05/GHSA-4jrx-5w4h-3gpm/GHSA-4jrx-5w4h-3gpm.json +++ b/advisories/github-reviewed/2024/05/GHSA-4jrx-5w4h-3gpm/GHSA-4jrx-5w4h-3gpm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4jrx-5w4h-3gpm", - "modified": "2024-05-01T08:29:48Z", + "modified": "2024-05-01T13:07:04Z", "published": "2024-05-01T08:29:48Z", "aliases": [ "CVE-2024-32963" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-4jrx-5w4h-3gpm" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32963" + }, { "type": "PACKAGE", "url": "https://github.com/navidrome/navidrome" @@ -52,6 +56,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-05-01T08:29:48Z", - "nvd_published_at": null + "nvd_published_at": "2024-05-01T07:15:40Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json b/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json index e5769a96def..d88f3c8810a 100644 --- a/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json +++ b/advisories/github-reviewed/2024/05/GHSA-jxgr-gcj5-cqqg/GHSA-jxgr-gcj5-cqqg.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-jxgr-gcj5-cqqg", - "modified": "2024-05-01T09:36:36Z", + "modified": "2024-05-01T13:07:14Z", "published": "2024-05-01T09:36:35Z", "aliases": [ - + "CVE-2024-32979" ], "summary": "nautobot has reflected Cross-site Scripting potential in all object list views", "details": "### Impact\n\nIt was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable, including:\n\n- /dcim/location-types/\n- /dcim/locations/\n- /dcim/racks/\n- /dcim/rack-groups/\n- /dcim/rack-reservations/\n- /dcim/rack-elevations/\n- /tenancy/tenants/\n- /tenancy/tenant-groups/\n- /extras/tags/\n- /extras/statuses/\n- /extras/roles/\n- /extras/dynamic-groups/\n- /dcim/devices/\n- /dcim/platforms/\n- /dcim/virtual-chassis/\n- /dcim/device-redundancy-groups/\n- /dcim/interface-redundancy-groups/\n- /dcim/device-types/\n- /dcim/manufacturers/\n- /dcim/cables/\n- /dcim/console-connections/\n- /dcim/power-connections/\n- /dcim/interface-connections/\n- /dcim/interfaces/\n- /dcim/front-ports/\n- /dcim/rear-ports/\n- /dcim/console-ports/\n- /dcim/console-server-ports/\n- /dcim/power-ports/\n- /dcim/power-outlets/\n- /dcim/device-bays/\n- /dcim/inventory-items/\n- /ipam/ip-addresses/\n- /ipam/prefixes\n- /ipam/rirs/\n- /ipam/namespaces/\n- /ipam/vrfs/\n- /ipam/route-targets/\n- /ipam/vlans/\n- /ipam/vlan-groups/\n- /ipam/services/\n- /virtualization/virtual-machines/\n- /virtualization/interfaces/\n- /virtualization/clusters/\n- /virtualization/cluster-types/\n- /virtualization/cluster-groups/\n- /circuits/circuits/\n- /circuits/circuit-types/\n- /circuits/providers/\n- /circuits/provider-networks/\n- /dcim/power-feeds/\n- /dcim/power-panels/\n- /extras/secrets/\n- /extras/secrets-groups/\n- /extras/jobs/\n- /extras/jobs/scheduled-jobs/approval-queue/\n- /extras/jobs/scheduled-jobs/\n- /extras/job-results/\n- /extras/job-hooks/\n- /extras/job-buttons/\n- /extras/object-changes/\n- /extras/git-repositories/\n- /extras/graphql-queries/\n- /extras/relationships/\n- /extras/notes/\n- /extras/config-contexts/\n- /extras/config-context-schemas/\n- /extras/export-templates/\n- /extras/external-integrations/\n- /extras/webhooks/\n- /extras/computed-fields/\n- /extras/custom-fields/\n- /extras/custom-links/\n\nas well as any similar object-list views provided by any Nautobot App.\n\n### Patches\n\nFixed in Nautobot 1.6.20 and 2.2.3.\n\n### Workarounds\n\nNo workaround has been identified\n\n### References\n\n- #5646 \n- #5647\n\n**Credit to [Michael Panorios](mailto:michael.panorios@pwc.com) for reporting this issue.**", @@ -59,6 +59,10 @@ "type": "WEB", "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-jxgr-gcj5-cqqg" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32979" + }, { "type": "WEB", "url": "https://github.com/nautobot/nautobot/pull/5646" @@ -90,11 +94,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-05-01T09:36:35Z", - "nvd_published_at": null + "nvd_published_at": "2024-05-01T11:15:47Z" } } \ No newline at end of file