diff --git a/advisories/github-reviewed/2022/05/GHSA-5hch-v5pq-x4qp/GHSA-5hch-v5pq-x4qp.json b/advisories/github-reviewed/2022/05/GHSA-5hch-v5pq-x4qp/GHSA-5hch-v5pq-x4qp.json index 98f33f43383..4f05bc6a88c 100644 --- a/advisories/github-reviewed/2022/05/GHSA-5hch-v5pq-x4qp/GHSA-5hch-v5pq-x4qp.json +++ b/advisories/github-reviewed/2022/05/GHSA-5hch-v5pq-x4qp/GHSA-5hch-v5pq-x4qp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5hch-v5pq-x4qp", - "modified": "2024-05-09T16:14:08Z", + "modified": "2024-11-22T20:12:04Z", "published": "2022-05-01T07:16:48Z", "aliases": [ "CVE-2006-4247" @@ -37,6 +37,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4247" }, + { + "type": "PACKAGE", + "url": "https://github.com/plone/Plone" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-5.yaml" + }, { "type": "WEB", "url": "http://plone.org/about/security/advisories/cve-2006-4247" diff --git a/advisories/unreviewed/2022/05/GHSA-8823-xphr-qw9v/GHSA-8823-xphr-qw9v.json b/advisories/github-reviewed/2022/05/GHSA-8823-xphr-qw9v/GHSA-8823-xphr-qw9v.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-8823-xphr-qw9v/GHSA-8823-xphr-qw9v.json rename to advisories/github-reviewed/2022/05/GHSA-8823-xphr-qw9v/GHSA-8823-xphr-qw9v.json index 53ff1296b92..72061d18bbe 100644 --- a/advisories/unreviewed/2022/05/GHSA-8823-xphr-qw9v/GHSA-8823-xphr-qw9v.json +++ b/advisories/github-reviewed/2022/05/GHSA-8823-xphr-qw9v/GHSA-8823-xphr-qw9v.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-8823-xphr-qw9v", - "modified": "2022-05-17T01:36:20Z", + "modified": "2024-11-22T20:12:21Z", "published": "2022-05-17T01:36:20Z", "aliases": [ "CVE-2013-2100" ], + "summary": "Gentoo Portage does not verify X.509 certificates from SSL servers", "details": "The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "portage" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.12.2" + } + ] + } + ] + } ], "references": [ { @@ -26,6 +45,14 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/84315" }, + { + "type": "PACKAGE", + "url": "https://github.com/gentoo/portage" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/portage/PYSEC-2014-115.yaml" + }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/201507-16" @@ -37,10 +64,6 @@ { "type": "WEB", "url": "http://openwall.com/lists/oss-security/2013/05/16/3" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/59878" } ], "database_specific": { @@ -48,8 +71,8 @@ ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:12:21Z", "nvd_published_at": "2014-09-29T22:55:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json b/advisories/github-reviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json index 9645f0fa125..b049f188450 100644 --- a/advisories/github-reviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json +++ b/advisories/github-reviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r7j4-82xw-8m9p", - "modified": "2024-05-14T17:22:00Z", + "modified": "2024-11-22T20:12:29Z", "published": "2022-05-01T07:16:48Z", "aliases": [ "CVE-2006-4249" @@ -48,6 +48,10 @@ "type": "PACKAGE", "url": "https://github.com/plone/Plone" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-6.yaml" + }, { "type": "WEB", "url": "http://plone.org/about/security/advisories/cve-2006-4249" @@ -55,18 +59,6 @@ { "type": "WEB", "url": "http://plone.org/products/plone-hotfix/releases/20061031" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/23240" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/21460" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2006/4878" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/11/GHSA-h4f5-h82v-5w4r/GHSA-h4f5-h82v-5w4r.json b/advisories/github-reviewed/2024/11/GHSA-h4f5-h82v-5w4r/GHSA-h4f5-h82v-5w4r.json new file mode 100644 index 00000000000..f70dc007f33 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-h4f5-h82v-5w4r/GHSA-h4f5-h82v-5w4r.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h4f5-h82v-5w4r", + "modified": "2024-11-22T20:11:38Z", + "published": "2024-11-22T20:11:38Z", + "aliases": [ + + ], + "summary": "SurrealDB has an Uncaught Exception in Function Generating Random Time", + "details": "The `rand::time()` function in SurrealQL generates a random time from an optional range of two Unix timestamps. Due to the underlying use of `timestamp_opt` from the `chrono` crate, this function could potentially return `None` in some instances, leading to a panic when `unwrap` was called on its result in order to return a SurrealQL `datetime` type to the caller of the function.\n\n### Impact\n\nA client that is authorized to run queries in a SurrealDB server would be able to make repeated (in the order of millions) calls to `rand::time()` in order to reliably trigger a panic. This would crash the server, leading to denial of service.\n\n### Patches\n\nThe function has been updated in to guarantee that some `datetime` is returned or that an error is otherwise gracefully handled.\n\n- Version 2.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update may want to limit the ability of untrusted clients to run the `rand::time()` function in the affected versions of SurrealDB using security capabilities. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.\n\n### References\n\n- #5126\n- [SurrealQL Documentation - Database Functions (`rand::time`)](https://surrealdb.com/docs/surrealql/functions/database/rand#randtime)\n- [SurrealDB Documentation - Security Capabilities (Functions)](https://surrealdb.com/docs/surrealdb/security/capabilities#functions)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4f5-h82v-5w4r" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/5126" + }, + { + "type": "PACKAGE", + "url": "https://github.com/surrealdb/surrealdb" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:11:38Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-jc55-246c-r88f/GHSA-jc55-246c-r88f.json b/advisories/github-reviewed/2024/11/GHSA-jc55-246c-r88f/GHSA-jc55-246c-r88f.json new file mode 100644 index 00000000000..245492d26ee --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-jc55-246c-r88f/GHSA-jc55-246c-r88f.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jc55-246c-r88f", + "modified": "2024-11-22T20:11:44Z", + "published": "2024-11-22T20:11:44Z", + "aliases": [ + + ], + "summary": "SurrealDB has an Uncaught Exception Handling Nonexistent Role", + "details": "Roles for system users are stored as generic `Ident` values and converted as strings and into the `Role` enum whenever IAM operations are to be performed that require processing the user roles. This conversion expects those identifiers to only contain the values `owner`, `editor` and `viewer` and will return an error otherwise. However, the `unwrap()` method would be called on this result when implementing `std::convert::From<&Ident> for Role`, which would result in a panic where a nonexistent role was used.\n\n### Impact\n\nA privileged user with the `owner` role at any level in SurrealDB would be able to define a user with `DEFINE USER` with an nonexistent role, which would panic when being converted to a `Role` enum in order to perform certain IAM operations with that user. These operations included signing in with the user. This would crash the server, leading to denial of service.\n\n### Patches\n\nUnexistent roles are no longer accepted during parsing when defining a user. Even when successfully associated with a user, referencing unexistent roles will no longer result in a panic and will instead throw an `InvalidRole` error.\n\n- Version 2.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update may want to limit access to users with the `owner` role at any level to trusted parties only. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.\n\n### References\n\n- #5079\n- #5092", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/5079" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/5092" + }, + { + "type": "PACKAGE", + "url": "https://github.com/surrealdb/surrealdb" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:11:44Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-m52v-24p8-654f/GHSA-m52v-24p8-654f.json b/advisories/github-reviewed/2024/11/GHSA-m52v-24p8-654f/GHSA-m52v-24p8-654f.json new file mode 100644 index 00000000000..798d09dcdf7 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-m52v-24p8-654f/GHSA-m52v-24p8-654f.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m52v-24p8-654f", + "modified": "2024-11-22T20:11:48Z", + "published": "2024-11-22T20:11:48Z", + "aliases": [ + + ], + "summary": "SurrealDB has an Uncaught Exception Sorting Tables by Random Order", + "details": "Sorting table records using an `ORDER BY` clause with the `rand()` function as sorting mechanism could cause a panic due to relying on a comparison function that did not implement total order. This event resulted in a panic due to a recent [change in Rust 1.81](https://blog.rust-lang.org/2024/09/05/Rust-1.81.0.html#new-sort-implementations).\n\n### Impact\n\nA client that is authorized to run queries in a SurrealDB server would be able to query a table with `ORDER BY rand()` in order to potentially cause a panic in the sorting function. This would crash the server, leading to denial of service.\n\n### Patches\n\nThe sorting algorithm has been updated to guarantee total order when shuffling records.\n\n- Version 2.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update may want to limit the ability of untrusted clients to run arbitrary SurrealQL queries in the affected versions of SurrealDB. To limit the impact of the denial of service, SurrealDB administrators may also want to ensure that the SurrealDB process is running so that it can be automatically re-started after a crash.\n\n### References\n\n- https://github.com/surrealdb/surrealdb/issues/4969\n- https://github.com/surrealdb/surrealdb/pull/4989\n- https://github.com/surrealdb/surrealdb/pull/4805\n- https://github.com/surrealdb/surrealdb/pull/4906", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "surrealdb-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m52v-24p8-654f" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/issues/4969" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/4805" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/4906" + }, + { + "type": "WEB", + "url": "https://github.com/surrealdb/surrealdb/pull/4989" + }, + { + "type": "PACKAGE", + "url": "https://github.com/surrealdb/surrealdb" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:11:48Z", + "nvd_published_at": null + } +} \ No newline at end of file