From b5c897139642d46ecbac09c5f1eed3b44bf68736 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 8 May 2024 14:34:17 +0000 Subject: [PATCH] Publish Advisories GHSA-23rx-c3g5-hv9w GHSA-649x-hxfx-57j2 --- .../GHSA-23rx-c3g5-hv9w.json | 61 +++++++++ .../GHSA-649x-hxfx-57j2.json | 119 ++++++++++++++++++ 2 files changed, 180 insertions(+) create mode 100644 advisories/github-reviewed/2024/05/GHSA-23rx-c3g5-hv9w/GHSA-23rx-c3g5-hv9w.json create mode 100644 advisories/github-reviewed/2024/05/GHSA-649x-hxfx-57j2/GHSA-649x-hxfx-57j2.json diff --git a/advisories/github-reviewed/2024/05/GHSA-23rx-c3g5-hv9w/GHSA-23rx-c3g5-hv9w.json b/advisories/github-reviewed/2024/05/GHSA-23rx-c3g5-hv9w/GHSA-23rx-c3g5-hv9w.json new file mode 100644 index 00000000000..f952fd7af5a --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-23rx-c3g5-hv9w/GHSA-23rx-c3g5-hv9w.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23rx-c3g5-hv9w", + "modified": "2024-05-08T14:33:16Z", + "published": "2024-05-08T14:33:16Z", + "aliases": [ + "CVE-2024-34346" + ], + "summary": "Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag", + "details": "The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`.\n\nUsers who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. \n\n### Impact\n\nUsers who run code with `--allow-read` or `--allow-write` may unexpectedly end up granting additional permissions via file-system operations.\n\n### Patches\n\nDeno 1.43 and above require explicit `--allow-all` access to read or write `/etc`, `/dev` on unix platform (as well as `/proc` and `/sys` on linux platforms), and any path starting with `\\\\` on Windows.\n\n### Workarounds\n\nThe security sandbox in previous versions of Deno allows for denial of access to these files, but it requires an explicit addition of deny flags: `--deny-read=/dev --deny-read=/sys --deny-read=/proc --deny-read=/etc --deny-write=/dev --deny-write=/sys --deny-write=/proc --deny-write=/etc`. Note that symlinks in allowed locations may defeat this protection in earlier versions of Deno.\n\n### Reporters\n\nThis vulnerability was reported by a number of analysts. Thanks to [oliver@secfault-security.com](mailto:oliver@secfault-security.com), [finn@secfault-security.com](mailto:finn@secfault-security.com), @leesh3288, and @cristianstaicu for their reports and analysis.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "deno" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.43.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/denoland/deno/security/advisories/GHSA-23rx-c3g5-hv9w" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34346" + }, + { + "type": "PACKAGE", + "url": "https://github.com/denoland/deno" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-05-08T14:33:16Z", + "nvd_published_at": "2024-05-07T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/05/GHSA-649x-hxfx-57j2/GHSA-649x-hxfx-57j2.json b/advisories/github-reviewed/2024/05/GHSA-649x-hxfx-57j2/GHSA-649x-hxfx-57j2.json new file mode 100644 index 00000000000..1c4a177e08e --- /dev/null +++ b/advisories/github-reviewed/2024/05/GHSA-649x-hxfx-57j2/GHSA-649x-hxfx-57j2.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-649x-hxfx-57j2", + "modified": "2024-05-08T14:32:32Z", + "published": "2024-05-08T14:32:32Z", + "aliases": [ + "CVE-2024-32886" + ], + "summary": "Vitess vulnerable to infinite memory consumption and vtgate crash", + "details": "### Summary\n\nWhen executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will OOM.\n\n### Details\n\nWhen running the following query, the `evalengine` will try evaluate it and runs forever.\n\n```\nselect _utf16 0xFF\n```\n\nThe source of the bug lies in the collation logic that we have. The bug applies to all `utf16`, `utf32` and `ucs2` encodings. In general, the bug is there for any encoding where the minimal byte length for a single character is more than 1 byte.\n\nThe decoding functions for these collations all implement logic like the following to enforce the minimal character length:\n\nhttps://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71\n\nThe problem is that all the callers of `DecodeRune` expect progress by returning the number of bytes consumed. This means that if there's only 1 byte left in an input, it will here return still `0` and the caller(s) don't consume the character. \n\nOne example of such a caller is the following:\n\nhttps://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79\n\nThe logic here moves forward the pointer in the input `[]byte` but if `DecodeRune` returns `0` in case of error, it will keep running forever. The OOM happens since it keeps adding the `?` as the invalid character to the destination buffer infinitely, growing forever until it runs out of memory.\n\nThe fix here would be to always return forward progress also on invalid strings. \n\nThere's also a separate bug here that even if progress is guaranteed, `select _utf16 0xFF` will return the wrong result currently. MySQL will pad here the input when the `_utf16` introducer is used with leading `0x00` bytes and then decode to UTF-16, resulting in the output of `ΓΏ` here. \n\n### PoC\n\n```\nselect _utf16 0xFF\n```\n\n### Impact\n\nDenial of service attack by triggering unbounded memory usage.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/vitessio/vitess" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "19.0.0" + }, + { + "fixed": "19.0.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/vitessio/vitess" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "18.0.0" + }, + { + "fixed": "18.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/vitessio/vitess" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "17.0.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/security/advisories/GHSA-649x-hxfx-57j2" + }, + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/commit/2fd5ba1dbf6e9b32fdfdaf869d130066b1b5c0df" + }, + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/commit/9df4b66550e46b5d7079e21ed0e1b0f49f92b055" + }, + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/commit/c46dc5b6a4329a10589ca928392218d96031ac8d" + }, + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/commit/d438adf7e34a6cf00fe441db80842ec669a99202" + }, + { + "type": "PACKAGE", + "url": "https://github.com/vitessio/vitess" + }, + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/convert.go#L73-L79" + }, + { + "type": "WEB", + "url": "https://github.com/vitessio/vitess/blob/8f6cfaaa643a08dc111395a75a2d250ee746cfa8/go/mysql/collations/charset/unicode/utf16.go#L69-L71" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-08T14:32:32Z", + "nvd_published_at": null + } +} \ No newline at end of file