netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-27mf-ghqm-j3j8
GHSA-8495-4g3g-x7pr
GHSA-qvf5-hvjx-wm27
GHSA-qvf5-hvjx-wm27
This commit is contained in:
advisory-database[bot]
2024-11-18 21:03:47 +00:00
parent 886f4533fd
commit b44309f109
4 changed files with 290 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/11/GHSA-27mf-ghqm-j3j8/GHSA-27mf-ghqm-j3j8.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27mf-ghqm-j3j8",
"modified": "2024-11-18T21:02:17Z",
"published": "2024-11-18T21:02:17Z",
"aliases": [
"CVE-2024-52303"
],
"summary": "aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method",
"details": "### Summary\n\nA memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry.\n\n### Impact\n\nIf the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately.\n\nAn attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.10.6"
},
{
"fixed": "3.10.11"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-27mf-ghqm-j3j8"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
}
],
"database_specific": {
"cwe_ids": [
"CWE-772"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T21:02:17Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/11/GHSA-8495-4g3g-x7pr/GHSA-8495-4g3g-x7pr.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8495-4g3g-x7pr",
"modified": "2024-11-18T21:02:32Z",
"published": "2024-11-18T21:02:32Z",
"aliases": [
"CVE-2024-52304"
],
"summary": "aiohttp allows request smuggling due to incorrect parsing of chunk extensions",
"details": "### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.11"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.10.10"
}
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
}
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T21:02:32Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/11/GHSA-qvf5-hvjx-wm27/GHSA-qvf5-hvjx-wm27.json
+168
View File
@@ -0,0 +1,168 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qvf5-hvjx-wm27",
"modified": "2024-11-18T21:03:05Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-52317"
],
"summary": "Apache Tomcat Request and/or response mix-up",
"details": "Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users.\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.92"
},
{
"fixed": "9.0.96"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.92"
},
{
"fixed": "9.0.96"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.27"
},
{
"fixed": "10.1.31"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M23"
},
{
"fixed": "11.0.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.27"
},
{
"fixed": "10.1.31"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-coyote"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M23"
},
{
"fixed": "11.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52317"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/9e840ccacb40881c03a03b1e0746bfba7369b3bd"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs"
}
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T21:03:05Z",
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-qvf5-hvjx-wm27/GHSA-qvf5-hvjx-wm27.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qvf5-hvjx-wm27",
"modified": "2024-11-18T18:30:55Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-52317"
],
"details": "Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests \ncould lead to request and/or response mix-up between users.\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52317"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs"
}
],
"database_specific": {
"cwe_ids": [
"CWE-326"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}