From ac3cba8735c577ff02ce1174b00771a1902f56a8 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 10 Jun 2024 18:37:52 +0000 Subject: [PATCH] Publish Advisories GHSA-3mwc-2cj7-gx8c GHSA-69fp-7c8p-crjr GHSA-87m9-rv8p-rgmg GHSA-99hm-86h7-gr3g --- .../GHSA-3mwc-2cj7-gx8c.json | 31 ++++++++-- .../GHSA-69fp-7c8p-crjr.json | 61 +++++++++++++++++++ .../GHSA-87m9-rv8p-rgmg.json | 61 +++++++++++++++++++ .../GHSA-99hm-86h7-gr3g.json | 31 ++++++++-- 4 files changed, 176 insertions(+), 8 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json (67%) create mode 100644 advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json create mode 100644 advisories/github-reviewed/2024/06/GHSA-87m9-rv8p-rgmg/GHSA-87m9-rv8p-rgmg.json rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json (66%) diff --git a/advisories/unreviewed/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json b/advisories/github-reviewed/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json similarity index 67% rename from advisories/unreviewed/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json rename to advisories/github-reviewed/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json index 9016eaef727..08751bbe321 100644 --- a/advisories/unreviewed/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json +++ b/advisories/github-reviewed/2024/06/GHSA-3mwc-2cj7-gx8c/GHSA-3mwc-2cj7-gx8c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3mwc-2cj7-gx8c", - "modified": "2024-06-10T00:30:39Z", + "modified": "2024-06-10T18:36:36Z", "published": "2024-06-10T00:30:39Z", "aliases": [ "CVE-2024-5389" ], + "summary": "lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management", "details": "In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "lunary" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 1.2.13" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5389" }, + { + "type": "PACKAGE", + "url": "https://github.com/lunary-ai/lunary-py" + }, { "type": "WEB", "url": "https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2" @@ -31,8 +54,8 @@ "CWE-1220" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-10T18:36:36Z", "nvd_published_at": "2024-06-09T23:15:50Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json b/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json new file mode 100644 index 00000000000..b920f945cb4 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-69fp-7c8p-crjr/GHSA-69fp-7c8p-crjr.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69fp-7c8p-crjr", + "modified": "2024-06-10T18:36:56Z", + "published": "2024-06-10T18:36:56Z", + "aliases": [ + + ], + "summary": "Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)", + "details": "A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.0.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-69fp-7c8p-crjr" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/commit/2191cc26ae6deb52eeaf74046027b65804d16fd0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-922" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-10T18:36:56Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-87m9-rv8p-rgmg/GHSA-87m9-rv8p-rgmg.json b/advisories/github-reviewed/2024/06/GHSA-87m9-rv8p-rgmg/GHSA-87m9-rv8p-rgmg.json new file mode 100644 index 00000000000..60aaac1724c --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-87m9-rv8p-rgmg/GHSA-87m9-rv8p-rgmg.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-87m9-rv8p-rgmg", + "modified": "2024-06-10T18:36:23Z", + "published": "2024-06-10T18:36:23Z", + "aliases": [ + + ], + "summary": "go-grpc-compression has a zstd decompression bombing vulnerability", + "details": "### Impact\n\nA malicious user could cause a denial of service (DoS) when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases.\n\nVersions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll function in github.com/klauspost/compress/zstd to decompress data provided by the peer. The vulnerability is exploitable only by attackers who can send gRPC payloads to users of github.com/mostynb/go-grpc-compression/zstd or github.com/mostynb/go-grpc-compression/nonclobbering/zstd.\n\n### Patches\n\nVersion v1.2.3 of github.com/mostynb/go-grpc-compression avoids the issue by not using the Decoder.DecodeAll function in github.com/klauspost/compress/zstd.\n\nAll users of github.com/mostynb/go-grpc-compression/zstd or github.com/mostynb/go-grpc-compression/nonclobbering/zstd in the affected versions should update to v1.2.3.\n\n### Workarounds\n\nOther compression formats were not affected, users may consider switching from zstd to another format without upgrading to a newer release.\n\n### References\n\nThis issue was uncovered during a security audit performed by [Miroslav Stampar](https://github.com/stamparm/) of [7ASecurity](https://7asecurity.com/), facilitated by [OSTIF](https://ostif.org/), for the OpenTelemetry project.\n\nhttps://opentelemetry.io/blog/2024/cve-2024-36129\nhttps://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mostynb/go-grpc-compression" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.1.4" + }, + { + "fixed": "1.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mostynb/go-grpc-compression/security/advisories/GHSA-87m9-rv8p-rgmg" + }, + { + "type": "WEB", + "url": "https://github.com/mostynb/go-grpc-compression/commit/629c44d3acb9624993cc7de629f47d72109e2ce5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mostynb/go-grpc-compression" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-10T18:36:23Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json b/advisories/github-reviewed/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json similarity index 66% rename from advisories/unreviewed/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json rename to advisories/github-reviewed/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json index d74b3063768..c71c0d798de 100644 --- a/advisories/unreviewed/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json +++ b/advisories/github-reviewed/2024/06/GHSA-99hm-86h7-gr3g/GHSA-99hm-86h7-gr3g.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-99hm-86h7-gr3g", - "modified": "2024-06-08T21:30:38Z", + "modified": "2024-06-10T18:36:32Z", "published": "2024-06-08T21:30:38Z", "aliases": [ "CVE-2024-4680" ], + "summary": "zenml-io/zenml does not expire the session after password reset", "details": "A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "zenml" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.56.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4680" }, + { + "type": "PACKAGE", + "url": "https://github.com/zenml-io/zenml" + }, { "type": "WEB", "url": "https://huntr.com/bounties/c88f6bd2-490d-4930-98dd-03651b20230a" @@ -31,8 +54,8 @@ "CWE-613" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-10T18:36:32Z", "nvd_published_at": "2024-06-08T20:15:52Z" } } \ No newline at end of file