netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-fw9c-75hh-89p6
GHSA-h2rm-29ch-wfmh
GHSA-j44v-mmf2-xvm9
GHSA-xfrj-6vvc-3xm2
GHSA-xfrj-6vvc-3xm2
This commit is contained in:
advisory-database[bot]
2023-10-20 22:59:41 +00:00
parent b15b9e7eca
commit e58aee0197
5 changed files with 121 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/10/GHSA-fw9c-75hh-89p6/GHSA-fw9c-75hh-89p6.json
+2 -7
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fw9c-75hh-89p6",
"modified": "2023-10-17T20:23:50Z",
"modified": "2023-10-20T22:58:47Z",
"published": "2023-10-16T09:30:19Z",
"aliases": [
"CVE-2023-4822"
],
"summary": "Grafana privilege escalation vulnerability",
"details": "Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.\n\nIt also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.\n\nThis means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.\n\nThe vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.\n\n",
"details": "Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.\n\nIt also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.\n\nThis means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.\n\nThe vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.",
"severity": [
{
"type": "CVSS_V3",
@@ -20,11 +20,6 @@
"ecosystem": "Go",
"name": "github.com/grafana/grafana"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
advisories/github-reviewed/2023/10/GHSA-h2rm-29ch-wfmh/GHSA-h2rm-29ch-wfmh.json
-5
View File
@@ -20,11 +20,6 @@
"ecosystem": "Maven",
"name": "com.xwiki.identity-oauth:identity-oauth-ui"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
advisories/github-reviewed/2023/10/GHSA-j44v-mmf2-xvm9/GHSA-j44v-mmf2-xvm9.json
+15 -9
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j44v-mmf2-xvm9",
"modified": "2023-10-20T19:30:23Z",
"modified": "2023-10-20T22:59:02Z",
"published": "2023-10-20T19:30:23Z",
"aliases": [
"CVE-2023-45805"
@@ -9,7 +9,10 @@
"summary": "PDM Trojan Lockfile",
"details": "### Summary\nIt's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project.\n\n### Details\nProject `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be [parseable as a version](https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229) (and the filename must be a prefix of the project name), but it's [not verified to match the version being installed](https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99). (Version `2-2` is also not a valid [normalized version per PEP 440](https://peps.python.org/pep-0440/#post-release-spelling).)\n\nMatching the project name exactly (not just prefix) would fix the issue. The version should also be verified to avoid version downgrade attacks.\n\n### PoC\nExample `pdm.lock` snippet to appear to depend on `foo` but actually install `foo-2`\n```\n\"foo 2.2.0\" = [\n url = \"https://files.pythonhosted.org/.../foo-2-2.tar.gz\n]\n```\n\n### Impact\nWhen installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
@@ -17,11 +20,6 @@
"ecosystem": "PyPI",
"name": "pdm"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -42,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45805"
},
{
"type": "WEB",
"url": "https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831"
@@ -57,13 +59,17 @@
{
"type": "WEB",
"url": "https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99"
},
{
"type": "WEB",
"url": "https://peps.python.org/pep-0440/#post-release-spelling"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2023-10-20T19:30:23Z",
"nvd_published_at": null
advisories/github-reviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json
+104
View File
@@ -0,0 +1,104 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xfrj-6vvc-3xm2",
"modified": "2023-10-20T22:59:19Z",
"published": "2023-10-20T12:31:04Z",
"aliases": [
"CVE-2023-44483"
],
"summary": "Apache Santuario - XML Security for Java are vulnerable to private key disclosure",
"details": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.\n",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.santuario:xmlsec"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.santuario:xmlsec"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.santuario:xmlsec"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44483"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/santuario-java"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55"
},
{
"type": "WEB",
"url": "https://santuario.apache.org/secadv.data/CVE-2023-44483.txt.asc?version=1&modificationDate=1697782758000&api=v2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/5"
}
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-10-20T22:59:19Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xfrj-6vvc-3xm2",
"modified": "2023-10-20T12:31:04Z",
"published": "2023-10-20T12:31:04Z",
"aliases": [
"CVE-2023-44483"
],
"details": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44483"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55"
}
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}