netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3cgg-gh9j-w8vm
GHSA-2hpj-g53m-9gj6
This commit is contained in:
advisory-database[bot]
2023-09-08 20:53:26 +00:00
parent 3c2baa5c9d
commit dc31343cca
2 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2018/07/GHSA-3cgg-gh9j-w8vm/GHSA-3cgg-gh9j-w8vm.json
+7 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3cgg-gh9j-w8vm",
"modified": "2020-08-31T18:20:01Z",
"modified": "2023-09-08T20:52:35Z",
"published": "2018-07-24T13:58:10Z",
"aliases": [
"CVE-2017-16094"
],
"summary": "Directory Traversal in iter-http",
"details": "Affected versions of `iter-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\nExample request:\n```\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.",
"details": "Affected versions of `iter-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n**Example request:**\n```http\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.",
"severity": [
],
@@ -17,6 +17,11 @@
"ecosystem": "npm",
"name": "iter-http"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
advisories/github-reviewed/2019/02/GHSA-2hpj-g53m-9gj6/GHSA-2hpj-g53m-9gj6.json
+8 -3
View File
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2hpj-g53m-9gj6",
"modified": "2021-08-30T21:55:14Z",
"modified": "2023-09-08T20:52:07Z",
"published": "2019-02-18T23:58:03Z",
"aliases": [
"CVE-2016-10583"
],
"summary": "Downloads Resources over HTTP in closure-util",
"summary": "closure-util downloads Resources over HTTP",
"details": "Affected versions of `closure-util` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closure-util`.\n\n\n## Recommendation\n\nTo mitigate this issue:\n1. Install the package using npm's `--ignore-scripts` flag.\n2. Navigate to the package directory, and open `default-config.json` in a text editor\n3. Change the download URLs in the `compiler_url` and `library_url` to `https` equivalents\n4. run `npm i` in the package directory.",
"severity": [
{
@@ -20,6 +20,11 @@
"ecosystem": "npm",
"name": "closure-util"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -51,7 +56,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-311"
],
"severity": "HIGH",
"github_reviewed": true,