From c96107ce60ef3afa3820e6ae0d855eb9b5e78e2c Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
<45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 15 Dec 2023 23:45:04 +0000
Subject: [PATCH] Publish Advisories
GHSA-356j-hg45-x525
GHSA-qqhq-8r2c-c3f5
---
.../GHSA-356j-hg45-x525.json | 57 ++++++++++
.../GHSA-qqhq-8r2c-c3f5.json | 101 ++++++++++++++++++
2 files changed, 158 insertions(+)
create mode 100644 advisories/github-reviewed/2023/12/GHSA-356j-hg45-x525/GHSA-356j-hg45-x525.json
create mode 100644 advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json
diff --git a/advisories/github-reviewed/2023/12/GHSA-356j-hg45-x525/GHSA-356j-hg45-x525.json b/advisories/github-reviewed/2023/12/GHSA-356j-hg45-x525/GHSA-356j-hg45-x525.json
new file mode 100644
index 00000000000..fae60bd9fd2
--- /dev/null
+++ b/advisories/github-reviewed/2023/12/GHSA-356j-hg45-x525/GHSA-356j-hg45-x525.json
@@ -0,0 +1,57 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-356j-hg45-x525",
+ "modified": "2023-12-15T23:44:34Z",
+ "published": "2023-12-15T23:44:34Z",
+ "aliases": [
+ "CVE-2023-50448"
+ ],
+ "summary": "Potential CSV export data leak",
+ "details": "### Impact\n\nIn ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user.\n\nThe bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized.\n\nThe attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request.\n\n### Patches\n\nVersions 2.12.0 and above fixed the problem by completely removing the shared state.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "RubyGems",
+ "name": "activeadmin"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "2.12.0"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/activeadmin/activeadmin/security/advisories/GHSA-356j-hg45-x525"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/activeadmin/activeadmin"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-200"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": true,
+ "github_reviewed_at": "2023-12-15T23:44:34Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json b/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json
new file mode 100644
index 00000000000..f0f848227bd
--- /dev/null
+++ b/advisories/github-reviewed/2023/12/GHSA-qqhq-8r2c-c3f5/GHSA-qqhq-8r2c-c3f5.json
@@ -0,0 +1,101 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-qqhq-8r2c-c3f5",
+ "modified": "2023-12-15T23:43:30Z",
+ "published": "2023-12-15T23:43:30Z",
+ "aliases": [
+
+ ],
+ "summary": "nvdApiKey is logged in debug mode",
+ "details": "### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n\n### UPDATE ###\nThe issue isn't still resoved in 9.0.6:\nCreate a `pom.xml` with the following configuration:\n \n \n \n \n org.owasp\n dependency-check-maven\n 9.0.6\n \n \n HTML\n XML\n JSON\n \n 7\n true\n true\n 12\n true\n https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\n foobar\n \n \n \n OWASP-Check\n \n check\n \n \n \n \n \n \n\nand run `mvn -X -B verify > check.txt 2>&1`\nthen see that the API key ist still present in clear text: `grep nvdApiKey check.txt`\nreturns:\n`foobar`\n`[DEBUG] (f) nvdApiKey = foobar`\n\nHINT: Can only verify maven, so didn't edit other Affected products.",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "Maven",
+ "name": "org.owasp:dependency-check-ant"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "9.0.0"
+ },
+ {
+ "fixed": "9.0.6"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 9.0.5"
+ }
+ },
+ {
+ "package": {
+ "ecosystem": "Maven",
+ "name": "org.owasp:dependency-check-cli"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "9.0.0"
+ },
+ {
+ "fixed": "9.0.6"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "last_known_affected_version_range": "<= 9.0.5"
+ }
+ },
+ {
+ "package": {
+ "ecosystem": "Maven",
+ "name": "org.owasp:dependency-check-maven"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "9.0.0"
+ },
+ {
+ "last_affected": "9.0.6"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/jeremylong/DependencyCheck"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-532"
+ ],
+ "severity": "LOW",
+ "github_reviewed": true,
+ "github_reviewed_at": "2023-12-15T23:43:30Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file