From e2d91fa44eb9bbaef2ce8f2b8e85c75b3f7619ce Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 10 Jun 2025 14:53:16 +0000 Subject: [PATCH] Publish Advisories GHSA-pg7h-5qx3-wjr3 GHSA-6q3q-6v5j-h6vg GHSA-g9gf-g5jq-9h3v --- .../2024/04/GHSA-pg7h-5qx3-wjr3/GHSA-pg7h-5qx3-wjr3.json | 6 +++++- .../2024/11/GHSA-6q3q-6v5j-h6vg/GHSA-6q3q-6v5j-h6vg.json | 4 ++-- .../2025/01/GHSA-g9gf-g5jq-9h3v/GHSA-g9gf-g5jq-9h3v.json | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/advisories/github-reviewed/2024/04/GHSA-pg7h-5qx3-wjr3/GHSA-pg7h-5qx3-wjr3.json b/advisories/github-reviewed/2024/04/GHSA-pg7h-5qx3-wjr3/GHSA-pg7h-5qx3-wjr3.json index 11bb3cee8c2..918c21eeaf1 100644 --- a/advisories/github-reviewed/2024/04/GHSA-pg7h-5qx3-wjr3/GHSA-pg7h-5qx3-wjr3.json +++ b/advisories/github-reviewed/2024/04/GHSA-pg7h-5qx3-wjr3/GHSA-pg7h-5qx3-wjr3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pg7h-5qx3-wjr3", - "modified": "2024-07-25T10:11:09Z", + "modified": "2025-06-10T14:52:02Z", "published": "2024-04-17T21:30:48Z", "aliases": [ "CVE-2024-31583" @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://gist.github.com/1047524396/43e19a41f2b36503a4a228c32cdbc176" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2024-251.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/pytorch/pytorch" diff --git a/advisories/github-reviewed/2024/11/GHSA-6q3q-6v5j-h6vg/GHSA-6q3q-6v5j-h6vg.json b/advisories/github-reviewed/2024/11/GHSA-6q3q-6v5j-h6vg/GHSA-6q3q-6v5j-h6vg.json index 65121ab6f43..ecd218144ca 100644 --- a/advisories/github-reviewed/2024/11/GHSA-6q3q-6v5j-h6vg/GHSA-6q3q-6v5j-h6vg.json +++ b/advisories/github-reviewed/2024/11/GHSA-6q3q-6v5j-h6vg/GHSA-6q3q-6v5j-h6vg.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6q3q-6v5j-h6vg", - "modified": "2024-12-16T21:26:12Z", + "modified": "2025-06-10T14:52:54Z", "published": "2024-11-27T19:00:53Z", "aliases": [ "CVE-2024-49203" ], "summary": "Querydsl vulnerable to HQL injection trough orderBy", - "details": "### Summary\nThe order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier **CVE-2024-49203**.\n\n### Details\nVulnerable code may look as follows:\n```\n@GetMapping\npublic List getProducts(@RequestParam(\"orderBy\") String orderBy) {\n JPAQuery query = new JPAQuery(entityManager).from(test);\n PathBuilder pathBuilder = new PathBuilder<>(Test.class, \"test\");\n\n OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n JPAQuery orderedQuery = query.orderBy(order);\n return orderedQuery.fetch();\n}\n```\nWhere vulnerability is either caused by ```pathBuilder.get(orderBy)``` or the ```orderBy(order)``` method itself, based on where the security checks are expected.\n\n### PoC\nFull POC code is available in repository:\nhttps://github.com/CSIRTTrizna/CVE-2024-49203/\nWhen we take a look at source code shown in Details section the functionality is as follows:\n\n1) Create JPAQuery object instance:\n```\nJPAQuery query = new JPAQuery(entityManager).from(test);\n```\n\n2) Create OrderSpecifier object instance:\n```\nPathBuilder pathBuilder = new PathBuilder<>(Test.class, \"test\");\nOrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n```\nWhere orderBy variable is user provided input.\n\n3) order and run the query\n```\nJPAQuery orderedQuery = query.orderBy(order);\norderedQuery.fetch();\n```\n\nWhen user goes to URL \n```/products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))='2'+ORDER+BY+t.id```\nThe generated query will look something like this:\n```\nselect test \nfrom Test test\norder by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))='2' ORDER BY t.id asc\n```\n\n#### Environment\n\nLibrary versions used in proof of concept to reproduce the vulnerability:\n```\nquerydsl-jpa: 6.8.0\nquerydsl-apt: 6.8.0\nhibernate-core: 6.1.1.Final\njakarta.persistence-api: 3.1.0\npostgresql: 42.7.4\n```\n\n### Impact\nThe vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.\n", + "details": "### Summary\nThe order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier **CVE-2024-49203**.\n\n### Details\nVulnerable code may look as follows:\n```\n@GetMapping\npublic List getProducts(@RequestParam(\"orderBy\") String orderBy) {\n JPAQuery query = new JPAQuery(entityManager).from(test);\n PathBuilder pathBuilder = new PathBuilder<>(Test.class, \"test\");\n\n OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n JPAQuery orderedQuery = query.orderBy(order);\n return orderedQuery.fetch();\n}\n```\nWhere vulnerability is either caused by ```pathBuilder.get(orderBy)``` or the ```orderBy(order)``` method itself, based on where the security checks are expected.\n\n### PoC\nFull POC code is available in repository:\nhttps://github.com/CSIRTTrizna/CVE-2024-49203/\nWhen we take a look at source code shown in Details section the functionality is as follows:\n\n1) Create JPAQuery object instance:\n```\nJPAQuery query = new JPAQuery(entityManager).from(test);\n```\n\n2) Create OrderSpecifier object instance:\n```\nPathBuilder pathBuilder = new PathBuilder<>(Test.class, \"test\");\nOrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n```\nWhere orderBy variable is user provided input.\n\n3) order and run the query\n```\nJPAQuery orderedQuery = query.orderBy(order);\norderedQuery.fetch();\n```\n\nWhen user goes to URL \n```/products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))='2'+ORDER+BY+t.id```\nThe generated query will look something like this:\n```\nselect test \nfrom Test test\norder by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))='2' ORDER BY t.id asc\n```\n\n#### Environment\n\nLibrary versions used in proof of concept to reproduce the vulnerability:\n```\nquerydsl-jpa: 6.8.0\nquerydsl-apt: 6.8.0\nhibernate-core: 6.1.1.Final\njakarta.persistence-api: 3.1.0\npostgresql: 42.7.4\n```\n\n### Impact\nThe vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/01/GHSA-g9gf-g5jq-9h3v/GHSA-g9gf-g5jq-9h3v.json b/advisories/github-reviewed/2025/01/GHSA-g9gf-g5jq-9h3v/GHSA-g9gf-g5jq-9h3v.json index c4526e9b673..fa2d7feafe5 100644 --- a/advisories/github-reviewed/2025/01/GHSA-g9gf-g5jq-9h3v/GHSA-g9gf-g5jq-9h3v.json +++ b/advisories/github-reviewed/2025/01/GHSA-g9gf-g5jq-9h3v/GHSA-g9gf-g5jq-9h3v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g9gf-g5jq-9h3v", - "modified": "2025-05-28T21:43:57Z", + "modified": "2025-06-10T14:52:09Z", "published": "2025-01-22T00:33:36Z", "aliases": [ "CVE-2024-45479"