netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-f4c9-cqv8-9v98
GHSA-4mgg-fqfq-64hg
GHSA-5m3j-pxh7-455p
GHSA-6pff-fmh2-4mmf
GHSA-4mgg-fqfq-64hg
GHSA-5m3j-pxh7-455p
GHSA-6pff-fmh2-4mmf
This commit is contained in:
advisory-database[bot]
2024-07-19 18:35:57 +00:00
parent ec42b2945c
commit e18df025ca
7 changed files with 318 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-f4c9-cqv8-9v98/GHSA-f4c9-cqv8-9v98.json
+4 -3
View File
@@ -1,13 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f4c9-cqv8-9v98",
"modified": "2024-07-17T16:50:06Z",
"modified": "2024-07-19T18:34:30Z",
"published": "2022-05-24T17:42:20Z",
"withdrawn": "2024-07-19T18:34:30Z",
"aliases": [
"CVE-2021-20066"
],
"summary": "Insufficient Granularity of Access Control in JSDom",
"details": "JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.",
"summary": "Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom",
"details": "# Withdrawn Advisory\n\nThis advisory has been withdrawn because the user must configure jsdom to allow access to local files.\n\n# Original Description\n\nJSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.",
"severity": [
{
"type": "CVSS_V3",
advisories/github-reviewed/2024/07/GHSA-4mgg-fqfq-64hg/GHSA-4mgg-fqfq-64hg.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mgg-fqfq-64hg",
"modified": "2024-07-19T18:34:56Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-41172"
],
"summary": "Apache CXF allows unrestricted memory consumption in CXF HTTP clients",
"details": "In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-transports-http"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-transports-http"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6.0"
},
{
"fixed": "3.6.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41172"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/cxf"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-07-19T18:34:56Z",
"nvd_published_at": "2024-07-19T09:15:05Z"
}
}
advisories/github-reviewed/2024/07/GHSA-5m3j-pxh7-455p/GHSA-5m3j-pxh7-455p.json
+115
View File
@@ -0,0 +1,115 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5m3j-pxh7-455p",
"modified": "2024-07-19T18:34:43Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-29736"
],
"summary": "Apache CXF: SSRF vulnerability via WADL stylesheet parameter",
"details": "A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-rs-service-description"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-rs-service-description"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6.0"
},
{
"fixed": "3.6.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-rs-service-description"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29736"
},
{
"type": "WEB",
"url": "https://github.com/apache/cxf/commit/378afe1acb7503315bc63555c8743db0f55d8312"
},
{
"type": "WEB",
"url": "https://github.com/apache/cxf/commit/bafb0cadf723fc3962031c34f1f20dc0e8b7a36b"
},
{
"type": "WEB",
"url": "https://github.com/apache/cxf/commit/df2241c59481a57aebb1c0693b778a35baaf5570"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/cxf"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-07-19T18:34:43Z",
"nvd_published_at": "2024-07-19T09:15:04Z"
}
}
advisories/github-reviewed/2024/07/GHSA-6pff-fmh2-4mmf/GHSA-6pff-fmh2-4mmf.json
+115
View File
@@ -0,0 +1,115 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6pff-fmh2-4mmf",
"modified": "2024-07-19T18:34:49Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-32007"
],
"summary": "Apache CXF Denial of Service vulnerability in JOSE",
"details": "An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-rs-security-jose"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-rs-security-jose"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6.0"
},
{
"fixed": "3.6.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.cxf:cxf-rt-rs-security-jose"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32007"
},
{
"type": "WEB",
"url": "https://github.com/apache/cxf/commit/20793d3fed2e73e2785a58ec5b47403306ae4a5c"
},
{
"type": "WEB",
"url": "https://github.com/apache/cxf/commit/2d2baa3455db7439bf1ed4e00edfc5a7106edf7d"
},
{
"type": "WEB",
"url": "https://github.com/apache/cxf/commit/d1d77c34c199c2c87ebcfe23e3c81dccfe2e2473"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/cxf"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-07-19T18:34:49Z",
"nvd_published_at": "2024-07-19T09:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-4mgg-fqfq-64hg/GHSA-4mgg-fqfq-64hg.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mgg-fqfq-64hg",
"modified": "2024-07-19T09:32:06Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-41172"
],
"details": "In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41172"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T09:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-5m3j-pxh7-455p/GHSA-5m3j-pxh7-455p.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5m3j-pxh7-455p",
"modified": "2024-07-19T09:32:06Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-29736"
],
"details": "A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29736"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T09:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-6pff-fmh2-4mmf/GHSA-6pff-fmh2-4mmf.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6pff-fmh2-4mmf",
"modified": "2024-07-19T09:32:06Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-32007"
],
"details": "An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32007"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T09:15:04Z"
}
}