From e4880d2fc6bcdeca159a40fdcf15d8c05ed1424f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 15 Oct 2024 19:57:32 +0000 Subject: [PATCH] Publish Advisories GHSA-2234-fmw7-43wr GHSA-cx95-q6gx-w4qp GHSA-f96h-pmfr-66vw GHSA-fmj7-7gfw-64pg GHSA-qcvh-p9jq-wp8v GHSA-r9mq-3c9r-fmjq --- .../GHSA-2234-fmw7-43wr.json | 8 +++++-- .../GHSA-cx95-q6gx-w4qp.json | 23 +++++++++++++++---- .../GHSA-f96h-pmfr-66vw.json | 12 ++++++++-- .../GHSA-fmj7-7gfw-64pg.json | 17 ++++++++++++-- .../GHSA-qcvh-p9jq-wp8v.json | 12 ++++++++-- .../GHSA-r9mq-3c9r-fmjq.json | 9 ++++++-- 6 files changed, 67 insertions(+), 14 deletions(-) diff --git a/advisories/github-reviewed/2024/10/GHSA-2234-fmw7-43wr/GHSA-2234-fmw7-43wr.json b/advisories/github-reviewed/2024/10/GHSA-2234-fmw7-43wr/GHSA-2234-fmw7-43wr.json index 499f27d94d2..c9343a690b9 100644 --- a/advisories/github-reviewed/2024/10/GHSA-2234-fmw7-43wr/GHSA-2234-fmw7-43wr.json +++ b/advisories/github-reviewed/2024/10/GHSA-2234-fmw7-43wr/GHSA-2234-fmw7-43wr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2234-fmw7-43wr", - "modified": "2024-10-15T17:43:50Z", + "modified": "2024-10-15T19:56:22Z", "published": "2024-10-15T17:43:50Z", "aliases": [ "CVE-2024-48913" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/honojs/hono/security/advisories/GHSA-2234-fmw7-43wr" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48913" + }, { "type": "WEB", "url": "https://github.com/honojs/hono/commit/aa50e0ab77b5af8c53c50fe3b271892f8eeeea82" @@ -60,6 +64,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-10-15T17:43:50Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-15T16:15:05Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-cx95-q6gx-w4qp/GHSA-cx95-q6gx-w4qp.json b/advisories/github-reviewed/2024/10/GHSA-cx95-q6gx-w4qp/GHSA-cx95-q6gx-w4qp.json index 6e711f48c0e..4f60fa9736f 100644 --- a/advisories/github-reviewed/2024/10/GHSA-cx95-q6gx-w4qp/GHSA-cx95-q6gx-w4qp.json +++ b/advisories/github-reviewed/2024/10/GHSA-cx95-q6gx-w4qp/GHSA-cx95-q6gx-w4qp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cx95-q6gx-w4qp", - "modified": "2024-10-15T14:04:27Z", + "modified": "2024-10-15T19:56:17Z", "published": "2024-10-15T14:04:27Z", "aliases": [ "CVE-2024-47876" @@ -9,7 +9,14 @@ "summary": "SAK-50571 Sakai Kernel users created with type roleview can login as a normal user", "details": "### Impact\nIllegal access can be granted to the system.\n\n### References\nsee https://sakaiproject.atlassian.net/browse/SAK-50571", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } ], "affected": [ { @@ -37,6 +44,10 @@ "type": "WEB", "url": "https://github.com/sakaiproject/sakai/security/advisories/GHSA-cx95-q6gx-w4qp" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47876" + }, { "type": "WEB", "url": "https://github.com/sakaiproject/sakai/commit/a9aadd9347cfb204515e89ac0163e1be9e56cc41" @@ -48,15 +59,19 @@ { "type": "PACKAGE", "url": "https://github.com/sakaiproject/sakai" + }, + { + "type": "WEB", + "url": "https://sakaiproject.atlassian.net/browse/SAK-50571" } ], "database_specific": { "cwe_ids": [ "CWE-285" ], - "severity": "CRITICAL", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-10-15T14:04:27Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-15T16:15:05Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json b/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json index 42573c1d11c..a1644816d5d 100644 --- a/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json +++ b/advisories/github-reviewed/2024/10/GHSA-f96h-pmfr-66vw/GHSA-f96h-pmfr-66vw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f96h-pmfr-66vw", - "modified": "2024-10-15T18:12:57Z", + "modified": "2024-10-15T19:56:06Z", "published": "2024-10-15T18:12:57Z", "aliases": [ "CVE-2024-47874" @@ -9,6 +9,10 @@ "summary": "Starlette Denial of service (DoS) via multipart/form-data", "details": "### Summary\nStarlette treats `multipart/form-data` parts without a `filename` as text form fields and buffers those in byte strings with no size limit. This allows an attacker to upload arbitrary large form fields and cause Starlette to both slow down significantly due to excessive memory allocations and copy operations, and also consume more and more memory until the server starts swapping and grinds to a halt, or the OS terminates the server process with an OOM error. Uploading multiple such requests in parallel may be enough to render a service practically unusable, even if reasonable request size limits are enforced by a reverse proxy in front of Starlette.\n\n### PoC\n\n```python\nfrom starlette.applications import Starlette\nfrom starlette.routing import Route\n\nasync def poc(request):\n async with request.form():\n pass\n\napp = Starlette(routes=[\n Route('/', poc, methods=[\"POST\"]),\n])\n```\n\n```sh\ncurl http://localhost:8000 -F 'big=