diff --git a/advisories/unreviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json b/advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json similarity index 52% rename from advisories/unreviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json rename to advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json index dfaadae302b..3ea9e308dbc 100644 --- a/advisories/unreviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json +++ b/advisories/github-reviewed/2024/04/GHSA-3rq5-2g8h-59hc/GHSA-3rq5-2g8h-59hc.json @@ -1,17 +1,58 @@ { "schema_version": "1.4.0", "id": "GHSA-3rq5-2g8h-59hc", - "modified": "2024-04-11T15:30:48Z", + "modified": "2024-04-12T21:25:53Z", "published": "2024-04-11T15:30:48Z", "aliases": [ "CVE-2023-29483" ], + "summary": "Potential DoS via the Tudoor mechanism in eventlet and dnspython", "details": "eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a \"TuDoor\" attack. In other words, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "eventlet" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.35.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "dnspython" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.1" + } + ] + } + ] + } ], "references": [ { @@ -26,6 +67,18 @@ "type": "WEB", "url": "https://github.com/rthalley/dnspython/issues/1045" }, + { + "type": "WEB", + "url": "https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4" + }, + { + "type": "WEB", + "url": "https://github.com/rthalley/dnspython/commit/0ea5ad0a4583e1f519b9bcc67cfac381230d9cf2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/eventlet/eventlet" + }, { "type": "WEB", "url": "https://github.com/eventlet/eventlet/releases/tag/v0.35.2" @@ -37,19 +90,15 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-PYTHON-DNSPYTHON-6241713" - }, - { - "type": "WEB", - "url": "https://www.dnspython.org" } ], "database_specific": { "cwe_ids": [ - + "CWE-696" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-12T21:25:53Z", "nvd_published_at": "2024-04-11T14:15:12Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-79vv-vp32-gpp7/GHSA-79vv-vp32-gpp7.json b/advisories/github-reviewed/2024/04/GHSA-79vv-vp32-gpp7/GHSA-79vv-vp32-gpp7.json similarity index 64% rename from advisories/unreviewed/2024/04/GHSA-79vv-vp32-gpp7/GHSA-79vv-vp32-gpp7.json rename to advisories/github-reviewed/2024/04/GHSA-79vv-vp32-gpp7/GHSA-79vv-vp32-gpp7.json index bc04a9111df..becb5587b7a 100644 --- a/advisories/unreviewed/2024/04/GHSA-79vv-vp32-gpp7/GHSA-79vv-vp32-gpp7.json +++ b/advisories/github-reviewed/2024/04/GHSA-79vv-vp32-gpp7/GHSA-79vv-vp32-gpp7.json @@ -1,23 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-79vv-vp32-gpp7", - "modified": "2024-04-12T09:33:40Z", + "modified": "2024-04-12T21:26:30Z", "published": "2024-04-12T09:33:40Z", "aliases": [ "CVE-2024-27309" ], + "summary": "Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode", "details": "While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced.\n\nTwo preconditions are needed to trigger the bug:\n1. The administrator decides to remove an ACL\n2. The resource associated with the removed ACL continues to have two or more other ACLs associated with it after the removal.\n\nWhen those two preconditions are met, Kafka will treat the resource as if it had only one ACL associated with it after the removal, rather than the two or more that would be correct.\n\nThe incorrect condition is cleared by removing all brokers in ZK mode, or by adding a new ACL to the affected resource. Once the migration is completed, there is no metadata loss (the ACLs all remain).\n\nThe full impact depends on the ACLs in use. If only ALLOW ACLs were configured during the migration, the impact would be limited to availability impact. if DENY ACLs were configured, the impact could include confidentiality and integrity impact depending on the ACLs configured, as the DENY ACLs might be ignored due to this vulnerability during the migration period.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.kafka:kafka-metadata" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5.0" + }, + { + "fixed": "3.6.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27309" }, + { + "type": "WEB", + "url": "https://github.com/apache/kafka/commit/c000b1fae2bd7d4b76713a53508f128a13431ab6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/kafka" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy" @@ -27,9 +57,9 @@ "cwe_ids": [ "CWE-863" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-12T21:26:30Z", "nvd_published_at": "2024-04-12T07:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-chcp-g9j5-3xxx/GHSA-chcp-g9j5-3xxx.json b/advisories/github-reviewed/2024/04/GHSA-chcp-g9j5-3xxx/GHSA-chcp-g9j5-3xxx.json new file mode 100644 index 00000000000..364b7e8bb4b --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-chcp-g9j5-3xxx/GHSA-chcp-g9j5-3xxx.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-chcp-g9j5-3xxx", + "modified": "2024-04-12T21:26:01Z", + "published": "2024-04-12T21:26:01Z", + "aliases": [ + "CVE-2024-32003" + ], + "summary": "Dusk plugin may allow unfettered user authentication in misconfigured installs", + "details": "The Dusk plugin provides some special routes as part of its testing framework to allow a browser environment (such as headless Chrome) to act as a user in the Backend or User plugin without having to go through authentication. This route is `[[URL]]/_dusk/login/[[USER ID]]/[[MANAGER]]` - where `[[URL]]` is the base URL of the site, `[[USER ID]]` is the ID of the user account and `[[MANAGER]]` is the authentication manager (either `backend` for Backend, or `user` for the User plugin).\n\nIf a configuration of a site using the Dusk plugin is set up in such a way that the Dusk plugin is available publicly and the test cases in Dusk are run with live data, this route may potentially be used to gain access to any user account in either the Backend or User plugin without authentication.\n\nAs indicated in the [README](https://github.com/wintercms/wn-dusk-plugin/blob/main/README.md), this plugin should only be used in development and should *NOT* be used in a production instance. It is specifically recommended that the plugin be installed as a development dependency only in Composer.\n\nIn order to remediate this issue, the special routes used above will now no longer be registered unless the `APP_ENV` environment variable is specifically set to `dusk`. Since Winter by default does not use this environment variable and it is not populated by default, it will only exist if Dusk's automatic configuration is used (which won't exhibit this vulnerability) or if a developer manually specifies it in their configuration.\n\nThe automatic configuration performed by the Dusk plugin has also been hardened by default to use sane defaults and not allow external environment variables to leak into this configuration.\n\n### Impact\n\nLow. This will only affect users in which the Winter CMS installation meets ALL the following criteria:\n\n- The Dusk plugin is installed in the Winter CMS instance.\n- The application is in production mode (ie. the `debug` config value is set to `true` in `config/app.php`).\n- The Dusk plugin's automatic configuration has been overridden, either by providing a custom `.env.dusk` file or by providing custom configuration in the `config/dusk` folder, or by providing configuration environment variables externally.\n- The environment has been configured to use production data in the database for testing, and not the temporary SQLite database that Dusk uses by default.\n- The application is connectable via the web.\n\n### Patches\n\nIssue has been fixed in v2.1.0.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "winter/wn-dusk-plugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/wintercms/wn-dusk-plugin/security/advisories/GHSA-chcp-g9j5-3xxx" + }, + { + "type": "PACKAGE", + "url": "https://github.com/wintercms/wn-dusk-plugin" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-12T21:26:01Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-mgv8-w49f-822w/GHSA-mgv8-w49f-822w.json b/advisories/github-reviewed/2024/04/GHSA-mgv8-w49f-822w/GHSA-mgv8-w49f-822w.json new file mode 100644 index 00000000000..c7754f4ac43 --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-mgv8-w49f-822w/GHSA-mgv8-w49f-822w.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgv8-w49f-822w", + "modified": "2024-04-12T21:25:18Z", + "published": "2024-04-12T21:25:18Z", + "aliases": [ + "CVE-2022-25777" + ], + "summary": "Mautic: MST-48 Server-Side Request Forgery in Asset section ", + "details": "### Impact\nPrior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.\n\n### Patches\nUpdate to 4.4.12 or 5.0.4\n\n### Workarounds\nNone\n\n### References\n- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@mautic.org](mailto:security@mautic.org)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "mautic/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0-beta4" + }, + { + "fixed": "4.4.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "mautic/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.0.0-alpha" + }, + { + "fixed": "5.0.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/mautic/mautic/security/advisories/GHSA-mgv8-w49f-822w" + }, + { + "type": "WEB", + "url": "https://github.com/mautic/mautic/commit/b4b4ab5f0613854152ceb7b5e5228acf50648fd0" + }, + { + "type": "WEB", + "url": "https://github.com/mautic/mautic/commit/c54befd9eaaa49e4fc10a0fe22435c09ef2821b2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mautic/mautic" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-12T21:25:18Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-pww3-x2g7-x8q2/GHSA-pww3-x2g7-x8q2.json b/advisories/github-reviewed/2024/04/GHSA-pww3-x2g7-x8q2/GHSA-pww3-x2g7-x8q2.json similarity index 50% rename from advisories/unreviewed/2024/04/GHSA-pww3-x2g7-x8q2/GHSA-pww3-x2g7-x8q2.json rename to advisories/github-reviewed/2024/04/GHSA-pww3-x2g7-x8q2/GHSA-pww3-x2g7-x8q2.json index ac62e81530d..1b28b948327 100644 --- a/advisories/unreviewed/2024/04/GHSA-pww3-x2g7-x8q2/GHSA-pww3-x2g7-x8q2.json +++ b/advisories/github-reviewed/2024/04/GHSA-pww3-x2g7-x8q2/GHSA-pww3-x2g7-x8q2.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-pww3-x2g7-x8q2", - "modified": "2024-04-12T00:30:26Z", + "modified": "2024-04-12T21:26:13Z", "published": "2024-04-12T00:30:26Z", "aliases": [ "CVE-2023-48865" ], + "summary": "Reportico affected by Incorrect Access Control", "details": "An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "reportico-web/reportico" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "8.1.0" + } + ] + } + ] + } ], "references": [ { @@ -25,15 +47,19 @@ { "type": "WEB", "url": "https://gist.github.com/aashiqahamedn/39383cfbc639cbdc3e1a7d74b977aeae" + }, + { + "type": "PACKAGE", + "url": "https://github.com/reportico-web/reportico" } ], "database_specific": { "cwe_ids": [ - + "CWE-639" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-12T21:26:13Z", "nvd_published_at": "2024-04-11T22:15:13Z" } } \ No newline at end of file