diff --git a/advisories/github-reviewed/2025/06/GHSA-9wj4-8h85-pgrw/GHSA-9wj4-8h85-pgrw.json b/advisories/github-reviewed/2025/06/GHSA-9wj4-8h85-pgrw/GHSA-9wj4-8h85-pgrw.json new file mode 100644 index 00000000000..8cd9c1d5668 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-9wj4-8h85-pgrw/GHSA-9wj4-8h85-pgrw.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9wj4-8h85-pgrw", + "modified": "2025-06-10T20:14:44Z", + "published": "2025-06-10T20:14:43Z", + "aliases": [ + "CVE-2025-48879" + ], + "summary": "OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint", + "details": "### Impact\n\nOctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken `multipart/form-data` request to OctoPrint and through that make the web server component become unresponsive. This could be used to effectively run a denial of service attack on the OctoPrint server.\n\n### Patches\n\nThe vulnerability has been patched in version 1.11.2.\n\n### Workaround\n\nOctoPrint administrators are once more reminded to not make OctoPrint available on hostile networks (e.g. the internet), regardless of whether this vulnerability is patched or not.\n\n### Details\n\nThe issue can be triggered by a broken `multipart/form-data` request lacking an end boundary to any of OctoPrint's endpoints implemented through the `octoprint.server.util.tornado.UploadStorageFallbackHandler` request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server.\n\nThe fix adds detection of invalid requests like that and ensures they are handled gracefully with an HTTP 400 Bad Request response.\n\n### Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "OctoPrint" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48879" + }, + { + "type": "WEB", + "url": "https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OctoPrint/OctoPrint" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-140", + "CWE-835" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-06-10T20:14:43Z", + "nvd_published_at": "2025-06-10T16:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/06/GHSA-x958-rvg6-956w/GHSA-x958-rvg6-956w.json b/advisories/github-reviewed/2025/06/GHSA-x958-rvg6-956w/GHSA-x958-rvg6-956w.json new file mode 100644 index 00000000000..798253b3cf5 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-x958-rvg6-956w/GHSA-x958-rvg6-956w.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x958-rvg6-956w", + "modified": "2025-06-10T20:15:37Z", + "published": "2025-06-10T20:15:37Z", + "aliases": [ + "CVE-2025-48937" + ], + "summary": "matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator", + "details": "### Summary\n\nmatrix-sdk-crypto since version 0.8.0 up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user.\n\nAlthough the CVSS score is 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), we consider this a High Severity security issue.\n\n### Details\n\nThe Matrix specification [requires](https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2) that clients ensure that \"the event’s `sender`, `room_id`, and the recorded `session_id` match a trusted session\". The vulnerable matrix-sdk-crypto versions check that the `room_id` matches that of the session denoted by `session_id`, but do not check the `sender`.\n\n### Patches\n\nThe issue is resolved by [13c1d20](https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55), included in versions 0.11.1 and 0.12.0 of matrix-sdk-crypto.\n\n### Workarounds\n\nSince a successful attack requires administrator access to the homeserver, users who trust the administrators of their local homeserver are not affected.\n\n### References\n\n * https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "matrix-sdk-crypto" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.8.0" + }, + { + "fixed": "0.11.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-x958-rvg6-956w" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48937" + }, + { + "type": "WEB", + "url": "https://github.com/matrix-org/matrix-rust-sdk/commit/13c1d2048286bbabf5e7bc6b015aafee98f04d55" + }, + { + "type": "WEB", + "url": "https://github.com/matrix-org/matrix-rust-sdk/commit/56980745b4f27f7dc72ac296e6aa003e5d92a75b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/matrix-org/matrix-rust-sdk" + }, + { + "type": "WEB", + "url": "https://spec.matrix.org/v1.14/client-server-api/#mmegolmv1aes-sha2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-290" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-06-10T20:15:37Z", + "nvd_published_at": "2025-06-10T16:15:41Z" + } +} \ No newline at end of file