From b2b083f637b52450823a1885a640c8c73e519e29 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 3 May 2024 20:28:15 +0000 Subject: [PATCH] Publish Advisories GHSA-65h2-wf7m-q2v8 GHSA-g6ph-x5wf-g337 GHSA-jcwr-x25h-x5fh GHSA-7pc3-pr3q-58vg GHSA-vpw3-3prf-3974 --- .../GHSA-65h2-wf7m-q2v8.json | 13 +++- .../GHSA-g6ph-x5wf-g337.json | 4 +- .../GHSA-jcwr-x25h-x5fh.json | 4 +- .../GHSA-7pc3-pr3q-58vg.json | 69 +++++++++++++++++++ .../GHSA-vpw3-3prf-3974.json | 43 ++++++++++-- 5 files changed, 121 insertions(+), 12 deletions(-) create mode 100644 advisories/github-reviewed/2024/05/GHSA-7pc3-pr3q-58vg/GHSA-7pc3-pr3q-58vg.json rename advisories/{unreviewed => github-reviewed}/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json (62%) diff --git a/advisories/github-reviewed/2023/09/GHSA-65h2-wf7m-q2v8/GHSA-65h2-wf7m-q2v8.json b/advisories/github-reviewed/2023/09/GHSA-65h2-wf7m-q2v8/GHSA-65h2-wf7m-q2v8.json index 5fcc63ed4ae..94f350e921c 100644 --- a/advisories/github-reviewed/2023/09/GHSA-65h2-wf7m-q2v8/GHSA-65h2-wf7m-q2v8.json +++ b/advisories/github-reviewed/2023/09/GHSA-65h2-wf7m-q2v8/GHSA-65h2-wf7m-q2v8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-65h2-wf7m-q2v8", - "modified": "2023-10-27T21:03:21Z", + "modified": "2024-05-03T20:27:47Z", "published": "2023-09-27T15:30:35Z", "aliases": [ "CVE-2023-3223" @@ -76,6 +76,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2023:4924" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7247" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2023-3223" @@ -87,11 +91,16 @@ { "type": "PACKAGE", "url": "https://github.com/undertow-io/undertow" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20231027-0004" } ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-789" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2023/09/GHSA-g6ph-x5wf-g337/GHSA-g6ph-x5wf-g337.json b/advisories/github-reviewed/2023/09/GHSA-g6ph-x5wf-g337/GHSA-g6ph-x5wf-g337.json index 8ee10408baa..a6e6d30aafc 100644 --- a/advisories/github-reviewed/2023/09/GHSA-g6ph-x5wf-g337/GHSA-g6ph-x5wf-g337.json +++ b/advisories/github-reviewed/2023/09/GHSA-g6ph-x5wf-g337/GHSA-g6ph-x5wf-g337.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-g6ph-x5wf-g337", - "modified": "2024-05-03T18:30:34Z", + "modified": "2024-05-03T20:27:06Z", "published": "2023-09-25T21:30:26Z", "aliases": [ "CVE-2022-4244" ], "summary": "plexus-codehaus vulnerable to directory traversal", - "details": "A flaw was found in plexus-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash (`../`) sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.", + "details": "A flaw was found in plexus-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash (`../`) sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files. ", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/09/GHSA-jcwr-x25h-x5fh/GHSA-jcwr-x25h-x5fh.json b/advisories/github-reviewed/2023/09/GHSA-jcwr-x25h-x5fh/GHSA-jcwr-x25h-x5fh.json index 6460a60ad58..f7ba949b86e 100644 --- a/advisories/github-reviewed/2023/09/GHSA-jcwr-x25h-x5fh/GHSA-jcwr-x25h-x5fh.json +++ b/advisories/github-reviewed/2023/09/GHSA-jcwr-x25h-x5fh/GHSA-jcwr-x25h-x5fh.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-jcwr-x25h-x5fh", - "modified": "2024-05-03T18:30:35Z", + "modified": "2024-05-03T20:26:14Z", "published": "2023-09-25T21:30:26Z", "aliases": [ "CVE-2022-4245" ], "summary": "codehaus-plexus vulnerable to XML injection", - "details": "A flaw was found in codehaus-plexus. The `org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment` fails to sanitize comments for a `-->` sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.", + "details": "A flaw was found in codehaus-plexus. The `org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment` fails to sanitize comments for a `-->` sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection. ", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/05/GHSA-7pc3-pr3q-58vg/GHSA-7pc3-pr3q-58vg.json b/advisories/github-reviewed/2024/05/GHSA-7pc3-pr3q-58vg/GHSA-7pc3-pr3q-58vg.json new file mode 100644 index 00000000000..8cad4db05bc --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-7pc3-pr3q-58vg/GHSA-7pc3-pr3q-58vg.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7pc3-pr3q-58vg", + "modified": "2024-05-03T20:26:03Z", + "published": "2024-05-03T20:26:03Z", + "aliases": [ + "CVE-2024-34073" + ], + "summary": "sagemaker-python-sdk Command Injection vulnerability", + "details": "### Impact\n\nThe capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module before version 2.214.3 allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity.\n\nImpacted versions: <2.214.3\n\n### Credit\n\nWe would like to thank HiddenLayer for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n### Workarounds\n\nDo not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, instead use the default value.\n\n### References\n\nIf you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.\n[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting\n\nFixed by: https://github.com/aws/sagemaker-python-sdk/pull/4556", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "sagemaker" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.214.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7pc3-pr3q-58vg" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34073" + }, + { + "type": "WEB", + "url": "https://github.com/aws/sagemaker-python-sdk/pull/4556" + }, + { + "type": "WEB", + "url": "https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/aws/sagemaker-python-sdk" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-05-03T20:26:03Z", + "nvd_published_at": "2024-05-03T11:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json b/advisories/github-reviewed/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json similarity index 62% rename from advisories/unreviewed/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json rename to advisories/github-reviewed/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json index 8105ed9f190..133c90dc4b5 100644 --- a/advisories/unreviewed/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json +++ b/advisories/github-reviewed/2024/05/GHSA-vpw3-3prf-3974/GHSA-vpw3-3prf-3974.json @@ -1,23 +1,54 @@ { "schema_version": "1.4.0", "id": "GHSA-vpw3-3prf-3974", - "modified": "2024-05-03T12:30:51Z", + "modified": "2024-05-03T20:27:25Z", "published": "2024-05-03T09:30:52Z", "aliases": [ "CVE-2023-35701" ], - "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive.\n\nThe vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability. \n\nThe attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.\n\nUsers are recommended to upgrade to version 4.0.0, which fixes the issue.\n\n", + "summary": "Apache Hive Code Injection vulnerability", + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive.\n\nThe vulnerability affects the Hive JDBC driver component and it can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver (client) is running. The malicious user must have sufficient permissions to specify/edit JDBC URL(s) in an endpoint relying on the Hive JDBC driver and the JDBC client process must run under a privileged user to fully exploit the vulnerability. \n\nThe attacker can setup a malicious HTTP server and specify a JDBC URL pointing towards this server. When a JDBC connection is attempted, the malicious HTTP server can provide a special response with customized payload that can trigger the execution of certain commands in the JDBC client.This issue affects Apache Hive: from 4.0.0-alpha-1 before 4.0.0.\n\nUsers are recommended to upgrade to version 4.0.0, which fixes the issue.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.hive:hive-jdbc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0-alpha-1" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35701" }, + { + "type": "WEB", + "url": "https://github.com/apache/hive/commit/7abeb1df463cc389f668172e7cf3bb772799858a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/hive" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/HIVE-27554" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/7zcv6l63spl4r66xwz5jv9rtrg2opx81" @@ -31,9 +62,9 @@ "cwe_ids": [ "CWE-94" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-03T20:27:25Z", "nvd_published_at": "2024-05-03T09:15:07Z" } } \ No newline at end of file