From c6f48d8ac35694bb9a63a8e21fa6005d1dbd073a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 2 Dec 2024 18:36:11 +0000 Subject: [PATCH] Publish Advisories GHSA-75c5-xw7c-p5pm GHSA-8w3p-gf85-qcch GHSA-p57h-3cmc-xpjq --- .../GHSA-75c5-xw7c-p5pm.json | 76 +++++++++++++++++++ .../GHSA-8w3p-gf85-qcch.json | 73 ++++++++++++++++++ .../GHSA-p57h-3cmc-xpjq.json | 69 +++++++++++++++++ 3 files changed, 218 insertions(+) create mode 100644 advisories/github-reviewed/2024/12/GHSA-75c5-xw7c-p5pm/GHSA-75c5-xw7c-p5pm.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-8w3p-gf85-qcch/GHSA-8w3p-gf85-qcch.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-p57h-3cmc-xpjq/GHSA-p57h-3cmc-xpjq.json diff --git a/advisories/github-reviewed/2024/12/GHSA-75c5-xw7c-p5pm/GHSA-75c5-xw7c-p5pm.json b/advisories/github-reviewed/2024/12/GHSA-75c5-xw7c-p5pm/GHSA-75c5-xw7c-p5pm.json new file mode 100644 index 00000000000..32253ea45f6 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-75c5-xw7c-p5pm/GHSA-75c5-xw7c-p5pm.json @@ -0,0 +1,76 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-75c5-xw7c-p5pm", + "modified": "2024-12-02T18:34:11Z", + "published": "2024-12-02T18:34:11Z", + "aliases": [ + "CVE-2024-53861" + ], + "summary": "PyJWT Issuer field partial matches allowed", + "details": "### Summary\nThe wrong string if check is run for `iss` checking, resulting in `\"acb\"` being accepted for `\"_abc_\"`.\n\n### Details\nThis is a bug introduced in version [2.10.0](https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366): checking the \"iss\" claim\nchanged from `isinstance(issuer, list)` to `isinstance(issuer,\nSequence)`.\n\n```diff\n- if isinstance(issuer, list):\n+ if isinstance(issuer, Sequence):\n if payload[\"iss\"] not in issuer:\n raise InvalidIssuerError(\"Invalid issuer\")\n else:\n```\n\nSince str is a Sequnce, but not a list, `in` is also used for string\ncomparison. This results in `if \"abc\" not in \"__abcd__\":` being\nchecked instead of `if \"abc\" != \"__abc__\":`.\n### PoC\nCheck out the unit tests added here: https://github.com/jpadilla/pyjwt-ghsa-75c5-xw7c-p5pm\n```python\n issuer = \"urn:expected\"\n\n payload = {\"iss\": \"urn:\"}\n\n token = jwt.encode(payload, \"secret\")\n\n # decode() succeeds, even though `\"urn:\" != \"urn:expected\". No exception is raised.\n with pytest.raises(InvalidIssuerError):\n jwt.decode(token, \"secret\", issuer=issuer, algorithms=[\"HS256\"])\n```\n\n\n### Impact\n\nI would say the real world impact is not that high, seeing as the signature still has to match. We should still fix it.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "PyJWT" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.10.0" + }, + { + "fixed": "2.10.1" + } + ] + } + ], + "versions": [ + "2.10.0" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53861" + }, + { + "type": "WEB", + "url": "https://github.com/jpadilla/pyjwt/commit/1570e708672aa9036bc772476beae8bfa48f4131#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380R366" + }, + { + "type": "WEB", + "url": "https://github.com/jpadilla/pyjwt/commit/33022c25525c1020869c71ce2a4109e44ae4ced1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jpadilla/pyjwt" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-697" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-12-02T18:34:11Z", + "nvd_published_at": "2024-11-29T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-8w3p-gf85-qcch/GHSA-8w3p-gf85-qcch.json b/advisories/github-reviewed/2024/12/GHSA-8w3p-gf85-qcch/GHSA-8w3p-gf85-qcch.json new file mode 100644 index 00000000000..f161246c5a1 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-8w3p-gf85-qcch/GHSA-8w3p-gf85-qcch.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8w3p-gf85-qcch", + "modified": "2024-12-02T18:34:45Z", + "published": "2024-12-02T18:34:45Z", + "aliases": [ + "CVE-2024-53864" + ], + "summary": "Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern", + "details": "### Impact\nThe Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, any existing injected XSS will not run.\n\n### Patches\n- See \"Patched versions.\n- https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc\n\n### Workarounds\nNone.\n\n### References\n- Advisory: https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates\n- Release notes: https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "ibexa/admin-ui" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.6.0" + }, + { + "fixed": "4.6.14" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ibexa/admin-ui/security/advisories/GHSA-8w3p-gf85-qcch" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53864" + }, + { + "type": "WEB", + "url": "https://github.com/ibexa/admin-ui/commit/8ec824a8cf06c566ed88e4c21cc66f7ed42649fc" + }, + { + "type": "WEB", + "url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2024-006-vulnerabilities-in-content-name-pattern-commerce-shop-and-varnish-vhost-templates" + }, + { + "type": "WEB", + "url": "https://doc.ibexa.co/en/latest/update_and_migration/from_4.6/update_from_4.6/#v4614" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ibexa/admin-ui" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-02T18:34:45Z", + "nvd_published_at": "2024-11-29T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-p57h-3cmc-xpjq/GHSA-p57h-3cmc-xpjq.json b/advisories/github-reviewed/2024/12/GHSA-p57h-3cmc-xpjq/GHSA-p57h-3cmc-xpjq.json new file mode 100644 index 00000000000..ecb47c3f8b2 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-p57h-3cmc-xpjq/GHSA-p57h-3cmc-xpjq.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p57h-3cmc-xpjq", + "modified": "2024-12-02T18:35:18Z", + "published": "2024-12-02T18:35:18Z", + "aliases": [ + "CVE-2024-53865" + ], + "summary": "Python package \"zhmcclient\" stores passwords in clear text in its HMC and API logs", + "details": "### Impact\n\nThe Python package \"zhmcclient\" writes password-like properties in clear text into its HMC and API logs in the following cases:\n\n* The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs\n* The 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs\n* The 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs\n* The 'password' property when creating or updating an HMC user, in the zhmcclient API log\n* The 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs\n\nThis issue affects only users of the zhmcclient package that have enabled the Python loggers named \"zhmcclient.api\" (for the API log) or \"zhmcclient.hmc\" (for the HMC log) and that use the functions listed above.\n\n### Patches\n\nHas been fixed in zhmcclient version 1.18.1\n\n### Workarounds\n\nNot applicable, since fix is available.\n\n### References\n\nNone\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "zhmcclient" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.18.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/zhmcclient/python-zhmcclient/security/advisories/GHSA-p57h-3cmc-xpjq" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53865" + }, + { + "type": "WEB", + "url": "https://github.com/zhmcclient/python-zhmcclient/commit/ad32781e782d0f604c6da4680fce48e4cc1f4433" + }, + { + "type": "PACKAGE", + "url": "https://github.com/zhmcclient/python-zhmcclient" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-312" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-02T18:35:18Z", + "nvd_published_at": "2024-11-29T19:15:09Z" + } +} \ No newline at end of file