From b38eaeb1ddb4b824eeb6de57b8e40d95b45dd205 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 12 Feb 2025 20:53:09 +0000
Subject: [PATCH] Publish GHSA-mm6v-68qp-f9fw

---
 .../2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json b/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
index 455fc74c320..1167ca9ae17 100644
--- a/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
+++ b/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
@@ -1,11 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mm6v-68qp-f9fw",
-  "modified": "2025-01-15T22:04:19Z",
+  "modified": "2025-02-12T20:51:44Z",
   "published": "2025-01-15T22:04:19Z",
   "aliases": [],
   "summary": "Crayfish allows Remote Code Execution via Homarus Authorization header",
-  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- XBOW-024-071",
+  "details": "### Impact\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n\n- XBOW-024-071",
   "severity": [
     {
       "type": "CVSS_V3",