From b759c5ee13a8878135b2d1cd78fe9aabd612a498 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 3 Jun 2025 01:12:16 +0000
Subject: [PATCH] Publish Advisories

GHSA-8w7f-8pr9-xgwj
GHSA-v75g-77vf-6jjq
---
 .../05/GHSA-8w7f-8pr9-xgwj/GHSA-8w7f-8pr9-xgwj.json  |  6 +++++-
 .../05/GHSA-v75g-77vf-6jjq/GHSA-v75g-77vf-6jjq.json  | 12 +++++++++---
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2025/05/GHSA-8w7f-8pr9-xgwj/GHSA-8w7f-8pr9-xgwj.json b/advisories/github-reviewed/2025/05/GHSA-8w7f-8pr9-xgwj/GHSA-8w7f-8pr9-xgwj.json
index 711347e5919..70d0839c2e4 100644
--- a/advisories/github-reviewed/2025/05/GHSA-8w7f-8pr9-xgwj/GHSA-8w7f-8pr9-xgwj.json
+++ b/advisories/github-reviewed/2025/05/GHSA-8w7f-8pr9-xgwj/GHSA-8w7f-8pr9-xgwj.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8w7f-8pr9-xgwj",
-  "modified": "2025-05-30T15:25:31Z",
+  "modified": "2025-06-03T01:10:36Z",
   "published": "2025-05-30T09:30:27Z",
   "aliases": [
     "CVE-2025-48912"
@@ -47,6 +47,10 @@
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/ms2t2oq218hb7l628trsogo4fj7h1135"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2025/05/30/3"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2025/05/GHSA-v75g-77vf-6jjq/GHSA-v75g-77vf-6jjq.json b/advisories/github-reviewed/2025/05/GHSA-v75g-77vf-6jjq/GHSA-v75g-77vf-6jjq.json
index 0de749f12bb..4d491050053 100644
--- a/advisories/github-reviewed/2025/05/GHSA-v75g-77vf-6jjq/GHSA-v75g-77vf-6jjq.json
+++ b/advisories/github-reviewed/2025/05/GHSA-v75g-77vf-6jjq/GHSA-v75g-77vf-6jjq.json
@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v75g-77vf-6jjq",
-  "modified": "2025-05-30T20:01:10Z",
+  "modified": "2025-06-03T01:10:53Z",
   "published": "2025-05-30T20:01:10Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-48955"
+  ],
   "summary": "Para Server Logs Sensitive Information",
   "details": "CWE ID: CWE-532 (Insertion of Sensitive Information into Log File)\nCVSS:  7.5 (High)\nVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n**Affected Component:** Para Server Initialization Logging\n**Version:** Para v1.50.6\n**File Path:** `para-1.50.6/para-server/src/main/java/com/erudika/para/server/utils/HealthUtils.java`\n**Vulnerable Line(s):** Line 132 (via `logger.info(...)` with root credentials)\n\nTechnical Details:\n\nThe vulnerability is located in the HealthUtils.java file, where a failed configuration file write triggers the following logging statement:\n```java\nlogger.info(\"Initialized root app with access key '{}' and secret '{}', but could not write these to {}.\",\n    rootAppCredentials.get(\"accessKey\"),\n    rootAppCredentials.get(\"secretKey\"),\n    confFile);\n```\nThis exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes.",
   "severity": [
@@ -38,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/Erudika/para/security/advisories/GHSA-v75g-77vf-6jjq"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48955"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/Erudika/para/commit/1e8a89558542854bb0683ab234c4429ad93b0835"
@@ -54,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2025-05-30T20:01:10Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-06-02T12:15:25Z"
   }
 }
\ No newline at end of file