From e01cfdc6252bf2a9476b048b1c21863b0501ee6b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 9 Sep 2024 20:20:46 +0000 Subject: [PATCH] Publish Advisories GHSA-6j75-5wfj-gh66 GHSA-9wv6-86v2-598j GHSA-m9gf-397r-hwpg GHSA-mqm9-c95h-x2p6 --- .../GHSA-6j75-5wfj-gh66.json | 111 ++++++++++++++++++ .../GHSA-9wv6-86v2-598j.json | 88 ++++++++++++++ .../GHSA-m9gf-397r-hwpg.json | 39 +++++- .../GHSA-mqm9-c95h-x2p6.json | 39 +++++- 4 files changed, 265 insertions(+), 12 deletions(-) create mode 100644 advisories/github-reviewed/2024/09/GHSA-6j75-5wfj-gh66/GHSA-6j75-5wfj-gh66.json create mode 100644 advisories/github-reviewed/2024/09/GHSA-9wv6-86v2-598j/GHSA-9wv6-86v2-598j.json rename advisories/{unreviewed => github-reviewed}/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json (55%) rename advisories/{unreviewed => github-reviewed}/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json (56%) diff --git a/advisories/github-reviewed/2024/09/GHSA-6j75-5wfj-gh66/GHSA-6j75-5wfj-gh66.json b/advisories/github-reviewed/2024/09/GHSA-6j75-5wfj-gh66/GHSA-6j75-5wfj-gh66.json new file mode 100644 index 00000000000..8a0d3ec9440 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-6j75-5wfj-gh66/GHSA-6j75-5wfj-gh66.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6j75-5wfj-gh66", + "modified": "2024-09-09T20:19:26Z", + "published": "2024-09-09T20:19:26Z", + "aliases": [ + "CVE-2024-45411" + ], + "summary": "Twig has a possible sandbox bypass", + "details": "### Description\n\nUnder some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.\n\nThe security issue happens when all these conditions are met:\n\n * The sandbox is disabled globally;\n * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance;\n * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled).\n\n### Resolution\n\nThe patch ensures that the sandbox security checks are always run at runtime.\n\n### Credits\n\nWe would like to thank Fabien Potencier for reporting and fixing the issue.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "twig/twig" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.44.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "twig/twig" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.16.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "twig/twig" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.14.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66" + }, + { + "type": "WEB", + "url": "https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6" + }, + { + "type": "WEB", + "url": "https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de" + }, + { + "type": "WEB", + "url": "https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233" + }, + { + "type": "PACKAGE", + "url": "https://github.com/twigphp/Twig" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-09T20:19:26Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-9wv6-86v2-598j/GHSA-9wv6-86v2-598j.json b/advisories/github-reviewed/2024/09/GHSA-9wv6-86v2-598j/GHSA-9wv6-86v2-598j.json new file mode 100644 index 00000000000..3796764a3d0 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-9wv6-86v2-598j/GHSA-9wv6-86v2-598j.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9wv6-86v2-598j", + "modified": "2024-09-09T20:19:15Z", + "published": "2024-09-09T20:19:15Z", + "aliases": [ + "CVE-2024-45296" + ], + "summary": "path-to-regexp outputs backtracking regular expressions", + "details": "### Impact\n\nIn certain cases, `path-to-regexp` will output a regular expression that can be exploited to cause poor performance.\n\n### Patches\n\nFor users of 0.1, upgrade to `0.1.10`. All other users should upgrade to `8.0.0`. \n\nVersion 0.1.10 adds backtracking protection when a custom regular expression is not provided, so it's still possible to manually create a ReDoS vulnerability if you are providing custom regular expressions.\n\nVersion 8.0.0 removes all features that can cause a ReDoS and stops exposing the regular expression directly.\n\n### Workarounds\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b` to `/:a-:b([^-/]+)`.\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.\n\n### Details\n\nBecause JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.\n\nThe bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b` will produce the regular expression `/^\\/([^\\/]+?)-([^\\/]+?)\\/?$/`. This can be exploited by a path such as `/a${'-a'.repeat(8_000)}/a`. [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) has a good example of why this occurs, but the TL;DR is the `/a` at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the `:a-:b` on the repeated 8,000 `-a`.\n\n### References\n\n* [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n* [Detailed blog post](https://blakeembrey.com/posts/2024-09-web-redos/)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "path-to-regexp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "path-to-regexp" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.2.0" + }, + { + "fixed": "8.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j" + }, + { + "type": "WEB", + "url": "https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f" + }, + { + "type": "WEB", + "url": "https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pillarjs/path-to-regexp" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-09T20:19:15Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json b/advisories/github-reviewed/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json similarity index 55% rename from advisories/unreviewed/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json rename to advisories/github-reviewed/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json index 4401fd51c2c..78fc856dca5 100644 --- a/advisories/unreviewed/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json +++ b/advisories/github-reviewed/2024/09/GHSA-m9gf-397r-hwpg/GHSA-m9gf-397r-hwpg.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-m9gf-397r-hwpg", - "modified": "2024-09-09T15:30:41Z", + "modified": "2024-09-09T20:19:45Z", "published": "2024-09-09T15:30:41Z", "aliases": [ "CVE-2024-8372" ], - "details": "Improper sanitization of the value of the '[srcset]' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .", + "summary": "AngularJS allows attackers to bypass common image source restrictions", + "details": "Improper sanitization of the value of the `[srcset]` attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects AngularJS versions 1.3.0-rc.4 and greater.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "angular" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.3.0-rc.4" + }, + { + "last_affected": "1.8.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +48,10 @@ "type": "WEB", "url": "https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017" }, + { + "type": "PACKAGE", + "url": "https://github.com/angular/angular.js" + }, { "type": "WEB", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-8372" @@ -34,9 +61,9 @@ "cwe_ids": [ "CWE-1289" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-09-09T20:19:45Z", "nvd_published_at": "2024-09-09T15:15:12Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json b/advisories/github-reviewed/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json similarity index 56% rename from advisories/unreviewed/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json rename to advisories/github-reviewed/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json index 565ebfd280e..8600f5549f3 100644 --- a/advisories/unreviewed/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json +++ b/advisories/github-reviewed/2024/09/GHSA-mqm9-c95h-x2p6/GHSA-mqm9-c95h-x2p6.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-mqm9-c95h-x2p6", - "modified": "2024-09-09T15:30:41Z", + "modified": "2024-09-09T20:19:49Z", "published": "2024-09-09T15:30:41Z", "aliases": [ "CVE-2024-8373" ], - "details": "Improper sanitization of the value of the '[srcset]' attribute in '' HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects all versions of AngularJS.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .", + "summary": "AngularJS allows attackers to bypass common image source restrictions", + "details": "Improper sanitization of the value of the `[srcset]` attribute in `` HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing .\n\nThis issue affects all versions of AngularJS.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "angular" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.8.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +48,10 @@ "type": "WEB", "url": "https://codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b" }, + { + "type": "PACKAGE", + "url": "https://github.com/angular/angular.js" + }, { "type": "WEB", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-8373" @@ -34,9 +61,9 @@ "cwe_ids": [ "CWE-791" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-09-09T20:19:49Z", "nvd_published_at": "2024-09-09T15:15:12Z" } } \ No newline at end of file