From c5fa86f34fcdedec2321f99c1591492b95f2ea84 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sun, 2 Jun 2024 22:30:53 +0000 Subject: [PATCH] Publish Advisories GHSA-2p57-rm9w-gvfp GHSA-973x-65j7-xcf4 GHSA-9p73-x86v-jw57 GHSA-qq99-p57r-g3v7 GHSA-xcr2-h8hv-6227 --- .../GHSA-2p57-rm9w-gvfp.json | 66 ++++++++++++++++ .../GHSA-973x-65j7-xcf4.json | 78 +++++++++++++++++++ .../GHSA-9p73-x86v-jw57.json | 55 +++++++++++++ .../GHSA-qq99-p57r-g3v7.json | 65 ++++++++++++++++ .../GHSA-xcr2-h8hv-6227.json | 68 ++++++++++++++++ 5 files changed, 332 insertions(+) create mode 100644 advisories/github-reviewed/2024/06/GHSA-2p57-rm9w-gvfp/GHSA-2p57-rm9w-gvfp.json create mode 100644 advisories/github-reviewed/2024/06/GHSA-973x-65j7-xcf4/GHSA-973x-65j7-xcf4.json create mode 100644 advisories/github-reviewed/2024/06/GHSA-9p73-x86v-jw57/GHSA-9p73-x86v-jw57.json create mode 100644 advisories/github-reviewed/2024/06/GHSA-qq99-p57r-g3v7/GHSA-qq99-p57r-g3v7.json create mode 100644 advisories/github-reviewed/2024/06/GHSA-xcr2-h8hv-6227/GHSA-xcr2-h8hv-6227.json diff --git a/advisories/github-reviewed/2024/06/GHSA-2p57-rm9w-gvfp/GHSA-2p57-rm9w-gvfp.json b/advisories/github-reviewed/2024/06/GHSA-2p57-rm9w-gvfp/GHSA-2p57-rm9w-gvfp.json new file mode 100644 index 00000000000..70372727694 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-2p57-rm9w-gvfp/GHSA-2p57-rm9w-gvfp.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2p57-rm9w-gvfp", + "modified": "2024-06-02T22:29:29Z", + "published": "2024-06-02T22:29:29Z", + "aliases": [ + "CVE-2024-29415" + ], + "summary": "ip SSRF improper categorization in isPublic", + "details": "The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "ip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29415" + }, + { + "type": "WEB", + "url": "https://github.com/indutny/node-ip/issues/150" + }, + { + "type": "WEB", + "url": "https://github.com/indutny/node-ip/pull/143" + }, + { + "type": "WEB", + "url": "https://github.com/indutny/node-ip/pull/144" + }, + { + "type": "PACKAGE", + "url": "https://github.com/indutny/node-ip" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:29:29Z", + "nvd_published_at": "2024-05-27T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-973x-65j7-xcf4/GHSA-973x-65j7-xcf4.json b/advisories/github-reviewed/2024/06/GHSA-973x-65j7-xcf4/GHSA-973x-65j7-xcf4.json new file mode 100644 index 00000000000..d0e0ddd773f --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-973x-65j7-xcf4/GHSA-973x-65j7-xcf4.json @@ -0,0 +1,78 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-973x-65j7-xcf4", + "modified": "2024-06-02T22:30:02Z", + "published": "2024-06-02T22:30:02Z", + "aliases": [ + "CVE-2024-36114" + ], + "summary": "Decompressors can crash the JVM and leak memory content in Aircompressor", + "details": "### Summary\nAll decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information).\n\n### Details\nWhen decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM.\n\nUsers should update to Aircompressor 0.27 or newer where these issues have been fixed.\n\n### Impact\nWhen decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.airlift:aircompressor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.27" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/security/advisories/GHSA-973x-65j7-xcf4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36114" + }, + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/commit/15e68df9eb0c2bfde7f796231ee7cd1982965071" + }, + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/commit/2cea90a45534f9aacbb77426fb64e975504dee6e" + }, + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/commit/cf66151541edb062ea88b6f3baab3f95e48b7b7f" + }, + { + "type": "WEB", + "url": "https://github.com/airlift/aircompressor/commit/d01ecb779375a092d00e224abe7869cdf49ddc3e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/airlift/aircompressor" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125", + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:30:02Z", + "nvd_published_at": "2024-05-29T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-9p73-x86v-jw57/GHSA-9p73-x86v-jw57.json b/advisories/github-reviewed/2024/06/GHSA-9p73-x86v-jw57/GHSA-9p73-x86v-jw57.json new file mode 100644 index 00000000000..e3e625a8573 --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-9p73-x86v-jw57/GHSA-9p73-x86v-jw57.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9p73-x86v-jw57", + "modified": "2024-06-02T22:30:25Z", + "published": "2024-06-02T22:30:25Z", + "aliases": [ + "CVE-2024-4330" + ], + "summary": "path traversal vulnerability was identified in the parisneo/lollms-webui ", + "details": "A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "lollms" + }, + "versions": [ + "9.6" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4330" + }, + { + "type": "WEB", + "url": "https://github.com/ParisNeo/lollms/commit/0e52d59a06b7f05e3b2611ce7b053fafa44143a9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ParisNeo/lollms" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-23" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:30:25Z", + "nvd_published_at": "2024-05-30T15:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-qq99-p57r-g3v7/GHSA-qq99-p57r-g3v7.json b/advisories/github-reviewed/2024/06/GHSA-qq99-p57r-g3v7/GHSA-qq99-p57r-g3v7.json new file mode 100644 index 00000000000..3d1d2f7c5bc --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-qq99-p57r-g3v7/GHSA-qq99-p57r-g3v7.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qq99-p57r-g3v7", + "modified": "2024-06-02T22:30:17Z", + "published": "2024-06-02T22:30:17Z", + "aliases": [ + "CVE-2024-3924" + ], + "summary": "code injection vulnerability exists in the huggingface/text-generation-inference repository", + "details": "A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file. The vulnerability arises from the insecure handling of the `github.head_ref` user input, which is used to dynamically construct a command for installing a software package. An attacker can exploit this by forking the repository, creating a branch with a malicious payload as the name, and then opening a pull request to the base repository. Successful exploitation could lead to arbitrary code execution within the context of the GitHub Actions runner. This issue affects versions up to and including v2.0.0 and was fixed in version 2.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "text-generation" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3924" + }, + { + "type": "WEB", + "url": "https://github.com/huggingface/text-generation-inference/commit/88702d876383f7200eccf67e28ba00500dc804bb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/huggingface/text-generation-inference" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/8af92fc2-0103-4d29-bb28-c3893154c422" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:30:17Z", + "nvd_published_at": "2024-05-30T15:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/06/GHSA-xcr2-h8hv-6227/GHSA-xcr2-h8hv-6227.json b/advisories/github-reviewed/2024/06/GHSA-xcr2-h8hv-6227/GHSA-xcr2-h8hv-6227.json new file mode 100644 index 00000000000..4d08531782a --- /dev/null +++ b/advisories/github-reviewed/2024/06/GHSA-xcr2-h8hv-6227/GHSA-xcr2-h8hv-6227.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xcr2-h8hv-6227", + "modified": "2024-06-02T22:30:10Z", + "published": "2024-06-02T22:30:10Z", + "aliases": [ + "CVE-2024-3584" + ], + "summary": "qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint", + "details": "qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "qdrant" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0-dev" + }, + { + "fixed": "1.9.0" + } + ] + } + ], + "versions": [ + "1.9.0-dev" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3584" + }, + { + "type": "WEB", + "url": "https://github.com/qdrant/qdrant/commit/15479a45ffa3b955485ae516696f7e933a8cce8a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/qdrant/qdrant" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/5c7c82e2-4873-40b7-a5f3-0f4a42642f73" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-06-02T22:30:10Z", + "nvd_published_at": "2024-05-30T13:15:49Z" + } +} \ No newline at end of file