mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability",
|
||||
"details": "Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -162,9 +160,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2020-06-16T21:27:08Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-6c73-2v8x-qpvm",
|
||||
"modified": "2021-08-23T17:02:24Z",
|
||||
"published": "2021-08-23T19:41:30Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Argo Server TLS requests could be forged by attacker with network access",
|
||||
"details": "### Impact\n\nWe are not aware of any exploits. This is a pro-active fix.\n\nImpacted: \n\n* You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless).\n* The attacker is within your network. If you expose Argo Server to the Internet then \"your network\" is \"the Internet\". \n\nThe Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.\n\n### Patches\n\nhttps://github.com/argoproj/argo-workflows/pull/6540\n\n### Workarounds\n\n* Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.\n\nThis was identified by engineers at Jetstack.io",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -58,9 +54,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2021-08-23T17:02:24Z",
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-6cj2-92m5-7mvp",
|
||||
"modified": "2021-10-08T21:20:09Z",
|
||||
"published": "2021-08-03T16:48:46Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Improperly Controlled Modification of Object Prototype Attributes",
|
||||
"details": "### Impact\n\nThe software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.\n\n### Patches\n\n`think-config@1.1.3` patched it, anyone used `think-config` should upgrade to `>=1.1.3` version.\n\n### References\n\nhttps://cwe.mitre.org/data/definitions/1321.html\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [thinkjs/thinkjs](https://github.com/thinkjs/thinkjs)\n* Email us at [i@imnerd.org](mailto:i@imnerd.org)\n",
|
||||
"severity": [
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-7f92-rr6w-cq64",
|
||||
"modified": "2021-08-02T19:12:30Z",
|
||||
"published": "2021-08-05T16:57:42Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Storage corruption due to variables overwritten by re-entrancy locks",
|
||||
"details": "### Background\nWhen attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator.\n\n### Impact\nReentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator.\n\n### Patches\nThis issue was fixed in v0.2.15 in #2391, #2379\n\n### Workarounds\nDon't use the `@nonreentrant` decorator in these versions.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2021-08-02T19:12:30Z",
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T17:47:15Z",
|
||||
"published": "2021-08-25T21:00:39Z",
|
||||
"withdrawn": "2021-08-24T17:47:15Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Data races in unicycle",
|
||||
"details": "Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab<T>` & `Unordered<T, S>`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.\n\nThis can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab<T>` or `Unordered<T, S>` and accessed concurrently from multiple threads.\n\nThe flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab<T>` & `Unordered<T, S>` and adding `T: Sync` to `Sync` impls for `PinSlab<T>` & `Unordered<T, S>`.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-19T19:03:37Z",
|
||||
"published": "2021-08-25T21:00:30Z",
|
||||
"withdrawn": "2021-08-19T19:03:37Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "WITHDRAWN",
|
||||
"details": "WITHDRAWN",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T17:59:47Z",
|
||||
"published": "2021-08-25T20:59:24Z",
|
||||
"withdrawn": "2021-08-24T17:59:47Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Data races in model",
|
||||
"details": "`Shared` data structure in `model` crate implements `Send` and `Sync` traits regardless of the inner type.\nThis allows safe Rust code to trigger a data race, which is undefined behavior in Rust.\n\nUsers are advised to treat `Shared` as an unsafe type.\nIt should not be used outside of the testing context,\nand care must be taken so that the testing code does not have a data race\nbesides a race condition that is expected to be caught by the test.\n\nCheck [the Rustonomicon](https://doc.rust-lang.org/nomicon/races.html) for the difference between\na data race and a general race condition.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-cfcv-q4qq-2ph4",
|
||||
"modified": "2021-10-08T21:19:54Z",
|
||||
"published": "2021-08-23T19:42:05Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "CKEditor 4 vulnerabilities in versions <4.16.1",
|
||||
"details": "Details see: \n\nhttps://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )\nhttps://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )\nhttps://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg ( CVE-2021-32809 )\n\nPatch: \nhttps://github.com/pimcore/pimcore/pull/10032",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2021-08-23T17:15:06Z",
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T18:08:17Z",
|
||||
"published": "2021-08-05T19:58:06Z",
|
||||
"withdrawn": "2021-08-24T18:08:17Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "VecStorage Deserialize Allows Violation of Length Invariant",
|
||||
"details": "The `Deserialize` implementation for `VecStorage` did not maintain the invariant that the number of elements must equal `nrows * ncols`. Deserialization of specially crafted inputs could allow memory access beyond allocation of the vector.\n\nThis flaw was introduced in v0.11.0 ([`086e6e`](https://github.com/dimforge/nalgebra/commit/086e6e719f53fecba6dadad2e953a487976387f5)) due to the addition of an automatically derived implementation of `Deserialize` for `MatrixVec`. `MatrixVec` was later renamed to `VecStorage` in v0.16.13 ([`0f66403`](https://github.com/dimforge/nalgebra/commit/0f66403cbbe9eeac15cedd8a906c0d6a3d8841f2)) and continued to use the automatically derived implementation of `Deserialize`.\n\nThis flaw was corrected in commit [`5bff536`](https://github.com/dimforge/nalgebra/commit/5bff5368bf38ddfa31416e4ae9897b163031a513) by returning an error during deserialization if the number of elements does not exactly match the expected size.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -60,9 +56,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2021-08-05T19:57:42Z",
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Workflow re-write vulnerability using input parameter",
|
||||
"details": "### Impact\n\n* Allow end-users to set input parameters, but otherwise expect workflows to be secure.\n\n### Patches\n\nNot yet.\n\n### Workarounds\n\n* Set `EXPRESSION_TEMPLATES=false` for the workflow controller\n\n\n### References\n\n* https://github.com/argoproj/argo-workflows/issues/6441\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T18:04:01Z",
|
||||
"published": "2021-08-25T20:55:41Z",
|
||||
"withdrawn": "2021-08-24T18:04:01Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Data races in generator",
|
||||
"details": "The `Generator` type is an iterable which uses a generator function that yields\nvalues. In affected versions of the crate, the provided function yielding values\nhad no `Send` bounds despite the `Generator` itself implementing `Send`.\n\nThe generator function lacking a `Send` bound means that types that are\ndangerous to send across threads such as `Rc` could be sent as part of a\ngenerator, potentially leading to data races.\n\nThis flaw was fixed in commit [`f7d120a3b`](https://github.com/Xudong-Huang/generator-rs/commit/f7d120a3b724d06a7b623d0a4306acf8f78cb4f0)\nby enforcing that the generator function be bound by `Send`.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-hw7r-qrhp-5pff",
|
||||
"modified": "2021-08-25T15:42:30Z",
|
||||
"published": "2021-08-30T16:16:46Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20",
|
||||
"details": "Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors.\n\n- https://vaadin.com/security/cve-2021-33605",
|
||||
"severity": [
|
||||
@@ -61,9 +59,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2021-08-25T15:42:30Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-hxwm-x553-x359",
|
||||
"modified": "2021-08-02T19:02:32Z",
|
||||
"published": "2021-08-05T17:07:39Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Arbitrary Command Injection due to Improper Command Sanitization",
|
||||
"details": "### Summary\nThere exists a command injection vulnerability in `npmcli/git` versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. \n\nThe impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. \n\n### Impact\n\nArbitrary Command Injection\n\n### Details\n\n`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`. \n\nThis issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.\n\n### Patches\n\nThis issue has been patched in release `2.0.8`\n\n### Acknowledgements\n\nThis report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T17:52:52Z",
|
||||
"published": "2021-08-25T21:00:07Z",
|
||||
"withdrawn": "2021-08-24T17:52:52Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Send/Sync bound needed on T for Send/Sync impl of RcuCell<T>",
|
||||
"details": "Affected versions of this crate unconditionally implement Send/Sync for `RcuCell<T>`.\nThis allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell<T>`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell<T>` that provide access to `&T`.\n\nThis can result in memory corruption caused by data races.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T18:01:27Z",
|
||||
"published": "2021-08-25T20:59:59Z",
|
||||
"withdrawn": "2021-08-24T18:01:27Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "MvccRwLock allows data races & aliasing violations",
|
||||
"details": "Affected versions of the `noise_search` crate unconditionally implement Send/Sync for `MvccRwLock`.\nThis can lead to data races when types that are either `!Send` or `!Sync` (e.g. `Rc<T>`, `Arc<Cell<_>>`) are contained inside `MvccRwLock` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).\n\nAlso, safe APIs of `MvccRwLock` allow aliasing violations by allowing `&T` and `LockResult<MutexGuard<Box<T>>>` to co-exist in conflicting lifetime regions. The APIs of `MvccRwLock` should either be marked as `unsafe` or `MbccRwLock` should be changed to private or pub(crate).\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T17:42:08Z",
|
||||
"published": "2021-08-25T21:00:23Z",
|
||||
"withdrawn": "2021-08-24T17:42:08Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Assumed memory layout of std::net::SocketAddr",
|
||||
"details": "The [`socket2`](https://crates.io/crates/socket2) crate has assumed `std::net::SocketAddrV4`\nand `std::net::SocketAddrV6` have the same memory layout as the system C representation\n`sockaddr`. It has simply casted the pointers to convert the socket addresses to the\nsystem representation. The standard library does not say anything about the memory\nlayout, and this will cause invalid memory access if the standard library\nchanges the implementation. No warnings or errors will be emitted once the\nchange happens.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore",
|
||||
"details": "### Impact\nData Object CSV import allows formular injection. \n\n### Patches\nProblem is patched in 10.1.1\n\n### Workarounds\nApply https://github.com/pimcore/pimcore/pull/9992.patch\n\n### References\nhttps://cwe.mitre.org/data/definitions/1236.html\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-prqf-xr2j-xf65",
|
||||
"modified": "2021-08-23T17:05:11Z",
|
||||
"published": "2021-08-23T19:41:41Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`",
|
||||
"details": "### Impact\n\nThis is pro-active fix. No know exploits exist. \n\nImpacted:\n\n* You're running Kubernetes >= v1.19\n* You're running Argo Server\n* It is configured to with `--auth-mode=client`\n* Is not configured with `--auth-mode=server`\n* You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.\n* You're using client key to authenticate on the server. \n* The server has more permissions that the connecting client's account.\n\nThe client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.\n\n### Patches\n\nhttps://github.com/argoproj/argo-workflows/pull/6506\n\n### Workarounds\n\nNone.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T17:58:36Z",
|
||||
"published": "2021-08-25T21:00:13Z",
|
||||
"withdrawn": "2021-08-24T17:58:36Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Queue<T> should have a Send bound on its Send/Sync traits",
|
||||
"details": "Affected versions of this crate unconditionally implements `Send`/`Sync` for `Queue<T>`.\n\nThis allows (1) creating data races to a `T: !Sync` and (2) sending `T: !Send` to other threads, resulting in memory corruption or other undefined behavior.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -4,14 +4,10 @@
|
||||
"modified": "2021-08-24T17:44:58Z",
|
||||
"published": "2021-08-25T21:00:11Z",
|
||||
"withdrawn": "2021-08-24T17:44:58Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Singleton lacks bounds on Send and Sync.",
|
||||
"details": "`Singleton<T>` is meant to be a static object that can be initialized lazily. In\norder to satisfy the requirement that `static` items must implement `Sync`,\n`Singleton` implemented both `Sync` and `Send` unconditionally.\n\nThis allows for a bug where non-`Sync` types such as `Cell` can be used in\nsingletons and cause data races in concurrent programs.\n\nThe flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring\nthe contaiend type to implement `Sync`.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user