Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-05 05:21:51 +00:00
parent e18766d059
commit bdb4efbaf8
891 changed files with 1681 additions and 5043 deletions
@@ -105,9 +105,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T21:48:14Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-3227-r97m-8j95",
  "modified": "2022-04-22T20:16:45Z",
  "published": "2022-04-22T20:16:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Relative Path Traversal in afire serve_static",
  "details": "### Impact\nThis vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.\n\n### Patches\nThe issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).\nIf you can, just update to the newest version of afire.\n\n### Workarounds\nIf you can't update afire you can simply disallow paths containing `/..` with the following middleware.\nMake sure this is the last middleware added to the server so it runs first, stopping the bad requests.\n```rust\nuse afire::prelude::*;\n\nstruct PathTraversalFix;\n\nimpl Middleware for PathTraversalFix {\n    fn pre(&self, req: Request) -> MiddleRequest {\n        if req.path.replace(\"\\\\\", \"/\").contains(\"/..\") {\n            return MiddleRequest::Send(\n                Response::new()\n                    .status(400)\n                    .text(\"Paths containing `..` are not allowed\"),\n            );\n        }\n\n        MiddleRequest::Continue\n    }\n}\n```\n```rust\nlet mut server = Server::new(host, port);\nPathTraversalFix.attach(&mut server);\n```\n\n### References\nYou can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)\n\n### For more information\nIf you have any questions or comments about this advisory you can email me or message me on discord.\n[[https://connorcode.com/contact](https://connorcode.com/contact)]",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -84,9 +84,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-22T20:23:44Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-cf4q-4cqr-7g7w",
  "modified": "2022-04-22T20:25:53Z",
  "published": "2022-04-22T20:25:53Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc",
  "details": "xml2rfc allows `script` elements in SVG sources.\nIn HTML output having these script elements can lead to XSS attacks.\n\nSample XML snippet:\n```\n<artwork type=\"svg\" src=\"data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E\">\n</artwork>\n```\n\n### Impact\nThis vulnerability impacts website that publish HTML drafts and RFCs.\n\n### Patches\nThis has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4).\n\n### Workarounds\nIf SVG source is self-contained within the XML, scraping `script` elements from SVG files.\n\n### References\n* https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/)\n* Email us at [operational-vulnerability@ietf.org](mailto:operational-vulnerability@ietf.org)\n* [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-g5rr-p69h-7v3g",
  "modified": "2022-04-22T20:57:12Z",
  "published": "2022-04-22T20:57:12Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Insufficient type validation in pocketmine/pocketmine-mp",
  "details": "When an inventory interaction is performed (e.g. moving an item around an inventory), the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid. This involves deserializing item NBT from the client, which allows for bogus data to be provided. Usually, this is harmless, but in this particular case, it could result in crashes on certain types of bad data (e.g. incorrect ListTag type provided for the `CanDestroy` tag). This is fixed in 4.2.9 by commit 5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2. It's non-trivial to workaround this, but can be done by handling `InventoryTransactionPacket` and `PlayerAuthInputPacket` to scrub inbound transaction data of bogus NBT that would cause these crashes.\n",
  "severity": [
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-26T20:12:38Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-j35p-q24r-5367",
  "modified": "2022-04-22T20:23:04Z",
  "published": "2022-04-22T20:23:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Dep Group Remote Memory Exhaustion (Denial of Service) in ckb",
  "details": "### Impact\nA remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node.\n\n### Patches\nUpgrade to 0.43.1 or later.\n\n### References\nAfter resolving the outpoints of one dep group, we put the corresponding content into a vec ( https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617 ), there is a vulnerability to a memory dos attack because there is no determination of whether the outpoints is duplicated.\n\nPoC:\n```\nbefore send dos tx rss:\n105700\n\nafter rss:\n2306932\n```\n\nDoS cost: 25.6 KB * 150 + dep_tx out_points capacity ( 36 * 150 * 100 = 540000 ) = 4380000 CKB\nSend 50 dos_tx, memory exhausted: (25.6 KB * 150  * 100) * 50 = 19.2 GB\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-22T20:23:04Z",
@@ -154,9 +154,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-01T21:20:37Z",
@@ -46,9 +46,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-05T22:05:28Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-3jch-9qgp-4844",
  "modified": "2022-06-16T23:54:35Z",
  "published": "2022-06-16T23:54:35Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Generated code can read and write out of bounds in safe code",
  "details": "Code generated by flatbuffers' compiler is `unsafe` but not marked as such.\nSee https://github.com/google/flatbuffers/issues/6627 for details.\n\nAll users that use generated code by `flatbuffers` compiler are recommended to:\n1. not expose flatbuffer generated code as part of their public APIs\n2. audit their code and look for any usage of `follow`, `push`, or any method that uses them\n   (e.g. `self_follow`).\n3. Carefuly go through the crates' documentation to understand which \"safe\" APIs are not\n   intended to be used.\n",
  "severity": [
@@ -58,9 +56,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-16T23:54:35Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-h588-76vg-prgj",
  "modified": "2023-02-09T14:20:32Z",
  "published": "2022-06-16T23:41:29Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`DecimalArray` does not perform bound checks on accessing values and offsets",
  "details": "`DecimalArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-16T23:41:29Z",
@@ -4,9 +4,7 @@
  "modified": "2024-01-22T21:11:52Z",
  "published": "2022-08-06T00:00:42Z",
  "withdrawn": "2022-09-23T16:30:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-wf7g-7h6h-678v](https://github.com/advisories/GHSA-wf7g-7h6h-678v). This link is maintained to preserve external references.\n\n## Original Description\nAn issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.",
  "severity": [
@@ -55,9 +53,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-18T18:53:18Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
--- a/Show More
+++ b/Show More