Publish Advisories

GHSA-pwf9-q62p-v7wc
GHSA-vqqr-fgmh-f626

advisories/github-reviewed/2025/03/GHSA-pwf9-q62p-v7wc/GHSA-pwf9-q62p-v7wc.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pwf9-q62p-v7wc",
-  "modified": "2025-03-16T06:30:23Z",
+  "modified": "2025-03-18T21:06:13Z",
   "published": "2025-03-16T06:30:23Z",
   "aliases": [
     "CVE-2024-58103"
   ],
+  "summary": "Wire has Uncontrolled Recursion on Nested Groups",
   "details": "Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "com.squareup.wire:wire-runtime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.2.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -23,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/square/wire"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/square/wire/compare/5.1.0...5.2.0"
@@ -33,8 +58,8 @@
       "CWE-674"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-18T21:06:13Z",
     "nvd_published_at": "2025-03-16T04:15:12Z"
   }
 }

advisories/github-reviewed/2025/03/GHSA-vqqr-fgmh-f626/GHSA-vqqr-fgmh-f626.json

@@ -0,0 +1,97 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vqqr-fgmh-f626",
+  "modified": "2025-03-18T21:07:17Z",
+  "published": "2025-03-18T21:07:17Z",
+  "aliases": [
+    "CVE-2025-29790"
+  ],
+  "summary": "Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads",
+  "details": "### Impact\n\nUsers can upload SVG files with malicious code, which is then executed in the back end and/or front end.\n\n### Patches\n\nUpdate to Contao 4.13.54, 5.3.30 or 5.5.6.\n\n### Workarounds\n\nRemove `svg,svgz` from the allowed upload file types in the system settings and from `contao.editable_files` in the `config.yaml`.\n\n### References\n\nhttps://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core-bundle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0"
+            },
+            {
+              "fixed": "4.13.54"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core-bundle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.3.0"
+            },
+            {
+              "fixed": "5.3.30"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core-bundle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "5.4.0"
+            },
+            {
+              "fixed": "5.5.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/contao/contao"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-18T21:07:17Z",
+    "nvd_published_at": null
+  }
+}