From cd75583aee0f0f834355dda78573ad556a74d227 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 20 Nov 2024 18:25:19 +0000 Subject: [PATCH] Publish Advisories GHSA-7225-m954-23v7 GHSA-ffp2-8p2h-4m5j GHSA-j5hq-5jcr-xwx7 --- .../GHSA-7225-m954-23v7.json | 64 +++++++++++++++++++ .../GHSA-ffp2-8p2h-4m5j.json | 57 +++++++++++++++++ .../GHSA-j5hq-5jcr-xwx7.json | 62 ++++++++++++++++++ 3 files changed, 183 insertions(+) create mode 100644 advisories/github-reviewed/2024/11/GHSA-7225-m954-23v7/GHSA-7225-m954-23v7.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-ffp2-8p2h-4m5j/GHSA-ffp2-8p2h-4m5j.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-j5hq-5jcr-xwx7/GHSA-j5hq-5jcr-xwx7.json diff --git a/advisories/github-reviewed/2024/11/GHSA-7225-m954-23v7/GHSA-7225-m954-23v7.json b/advisories/github-reviewed/2024/11/GHSA-7225-m954-23v7/GHSA-7225-m954-23v7.json new file mode 100644 index 00000000000..6001ee25e2f --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-7225-m954-23v7/GHSA-7225-m954-23v7.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7225-m954-23v7", + "modified": "2024-11-20T18:23:51Z", + "published": "2024-11-20T18:23:51Z", + "aliases": [ + + ], + "summary": "ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic", + "details": "Name: ASA-2024-010: Mismatched bit-length in `sdk.Int` and `sdk.Dec` can lead to panic \nComponent: Cosmos SDK / Math\nCriticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: `cosmossdk.io/math` package versions <= `math/v1.3.0`\nAffected users: Chain Builders + Maintainers, Validators\n\n### Impact\n\nThe bit-length in `sdk.Int` and `sdk.Dec` are not aligned, which may present a possible panic condition when interacting with `Dec` types in an `Int` context. This issue was resolved by aligning the max size between the data types in the cosmossdk.io/math package.\n\nThis issue impacts consumers of the cosmossdk.io/math, which includes popular modules including IBC-Go and tokenfactory (permissionless). If your chain interacts with APIs in the cosmossdk.io/math package, or utilizes a module that consumes this library, it is advised to update to the latest version at the time of the patch release by updating your project's go.mod dependency for cosmossdk.io/math.\n\nThe patch can be applied without a hard-fork, and with a version bump in a chain's go.mod file like the following:\n\n#### `go.mod`\n\n```diff\n- cosmossdk.io/math v1.3.0\n+ cosmossdk.io/math v1.4.0\n```\n\n> [!NOTE] \n> When on a lower version than cosmossdk.io/math v1.3.0, please do a coordinated upgrade before upgrading to >= 1.3.0\n\n### Patches\n\nThe new release of `cosmossdk.io/math v1.4.0` resolves this issue. Chains that utilize the cosmossdk.io/math library or modules that utilize the cosmossdk.io/math library should update to avoid this condition.\n\n### Timeline\n\n* October 31, 2024, 6:55pm UTC: Issue reported to the Cosmos Bug Bounty program\n* October 31, 2024, 8:56pm UTC: Issue triaged by Amulet on-call, and distributed to Core team\n* Nov 15, 2024, 2:12am PST: Core team completes patch for issue\n* Nov 19, 2024, 8:00am PST / 16:00 GMT: Pre-notification delivered\n* Nov 20, 2024, 8:00am PST / 16:00 GMT: Patch made available\n\n\nThis issue was reported by LonelySloth to the Cosmos Bug Bounty Program on HackerOne on October 31, 2024. If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\nIf you have questions about Interchain security efforts, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io). For more information about the Interchain Foundation’s engagement with Amulet, and to sign up for security notification emails, please see https://github.com/interchainio/security. \n\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "cosmossdk.io/math" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.3.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7" + }, + { + "type": "WEB", + "url": "https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/cosmos-sdk" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:23:51Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-ffp2-8p2h-4m5j/GHSA-ffp2-8p2h-4m5j.json b/advisories/github-reviewed/2024/11/GHSA-ffp2-8p2h-4m5j/GHSA-ffp2-8p2h-4m5j.json new file mode 100644 index 00000000000..7d4734f82a1 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-ffp2-8p2h-4m5j/GHSA-ffp2-8p2h-4m5j.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ffp2-8p2h-4m5j", + "modified": "2024-11-20T18:24:28Z", + "published": "2024-11-20T18:24:28Z", + "aliases": [ + "CVE-2024-52796" + ], + "summary": "Password Pusher rate limiter can be bypassed by forging proxy headers", + "details": "### Impact\n\nPassword Pusher comes with a configurable rate limiter. In versions prior to [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service.\n\n\n### Patches\n\nIn [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), a fix was implemented to only authorize proxies on local IPs which resolves this issue.\n\nIf you are running a remote proxy, please see [this documentation](https://docs.pwpush.com/docs/proxies/#trusted-proxies) on how to authorize the IP address of your remote proxy.\n\n### Workarounds\n\nIt is highly suggested to upgrade to at least [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0) to mitigate this risk.\n\nIf for some reason you cannot immediately upgrade, the alternative is that you can add rules to your proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.\n\n### References\n\nThe new settings are [configurable to authorize remote proxies](https://docs.pwpush.com/docs/proxies/#trusted-proxies).\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "pwpush" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.49.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-ffp2-8p2h-4m5j" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pglombardo/PasswordPusher" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:24:28Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-j5hq-5jcr-xwx7/GHSA-j5hq-5jcr-xwx7.json b/advisories/github-reviewed/2024/11/GHSA-j5hq-5jcr-xwx7/GHSA-j5hq-5jcr-xwx7.json new file mode 100644 index 00000000000..536684b16a8 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-j5hq-5jcr-xwx7/GHSA-j5hq-5jcr-xwx7.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j5hq-5jcr-xwx7", + "modified": "2024-11-20T18:23:26Z", + "published": "2024-11-20T18:23:25Z", + "aliases": [ + "CVE-2024-52280" + ], + "summary": " github.com/rancher/steve's users can issue watch commands for arbitrary resources", + "details": "### Impact\nA vulnerability has been discovered in Steve API (Kubernetes API Translator) in which users can watch resources they are not allowed to access, when they have at least some generic permissions on the type. For example, a user who can get a single secret in a single namespace can get all secrets in every namespace.\n\nDuring a `watch` request for a single ID, the following occurs:\n- In the case of a watch request for a single resource, Steve API will return a partition with the requested resource in it. In other cases, it will check the user's access when constructing partitions.\n- When a watch request for a single resource is issued, instead of using a client which impersonates the user making the request, Steve API will use the admin client, which can read all resources.\n\nThis allows any requester to see the contents of any object such as secret keys, signing certificates, API tokens.\n\nPlease consult the associated [MITRE ATT&CK - Technique - Valid Accounts](https://attack.mitre.org/techniques/T1078/003/) and [MITRE ATT&CK - Technique - Container and Resource Discovery](https://attack.mitre.org/techniques/T1613/) for further information about this category of attack.\n\n### Patches\nTo address this issue, the fix introduces a change in the behavior of the Steve API.\n\nWhen issuing a `watch` request with an ID specified, the requester's permissions are now correctly honoured. This will deny events for objects the requester cannot actually access. Previously these events were returned unconditionally, allowing any requester to see the contents of any object.\n\nPatched versions include the following commits:\n\n| Branch | Commit |\n| -------- | ------- |\n| main | https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9 |\n| release/v2.9 | https://github.com/rancher/steve/commit/6e30359c652333a49e229b2791c9b403d5ef81a9 |\n| release/v2.8 | https://github.com/rancher/steve/commit/c744f0b17b88ff5e2fcabc60841174d878ddc88e |\n\n### Workarounds\nThere are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of Steve API/Rancher Manager which contains the fixes.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security-related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/rancher/steve" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20241029132712-2175e090fe4b" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7" + }, + { + "type": "WEB", + "url": "https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9" + }, + { + "type": "PACKAGE", + "url": "https://github.com/rancher/steve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-20T18:23:25Z", + "nvd_published_at": null + } +} \ No newline at end of file