From e58aee019739e3e855caae1cf35df736f1f06afc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 20 Oct 2023 22:59:41 +0000 Subject: [PATCH] Publish Advisories GHSA-fw9c-75hh-89p6 GHSA-h2rm-29ch-wfmh GHSA-j44v-mmf2-xvm9 GHSA-xfrj-6vvc-3xm2 GHSA-xfrj-6vvc-3xm2 --- .../GHSA-fw9c-75hh-89p6.json | 9 +- .../GHSA-h2rm-29ch-wfmh.json | 5 - .../GHSA-j44v-mmf2-xvm9.json | 24 ++-- .../GHSA-xfrj-6vvc-3xm2.json | 104 ++++++++++++++++++ .../GHSA-xfrj-6vvc-3xm2.json | 35 ------ 5 files changed, 121 insertions(+), 56 deletions(-) create mode 100644 advisories/github-reviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json delete mode 100644 advisories/unreviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json diff --git a/advisories/github-reviewed/2023/10/GHSA-fw9c-75hh-89p6/GHSA-fw9c-75hh-89p6.json b/advisories/github-reviewed/2023/10/GHSA-fw9c-75hh-89p6/GHSA-fw9c-75hh-89p6.json index 873e4625949..8363216b042 100644 --- a/advisories/github-reviewed/2023/10/GHSA-fw9c-75hh-89p6/GHSA-fw9c-75hh-89p6.json +++ b/advisories/github-reviewed/2023/10/GHSA-fw9c-75hh-89p6/GHSA-fw9c-75hh-89p6.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-fw9c-75hh-89p6", - "modified": "2023-10-17T20:23:50Z", + "modified": "2023-10-20T22:58:47Z", "published": "2023-10-16T09:30:19Z", "aliases": [ "CVE-2023-4822" ], "summary": "Grafana privilege escalation vulnerability", - "details": "Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.\n\nIt also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.\n\nThis means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.\n\nThe vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.\n\n", + "details": "Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.\n\nIt also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.\n\nThis means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.\n\nThe vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.", "severity": [ { "type": "CVSS_V3", @@ -20,11 +20,6 @@ "ecosystem": "Go", "name": "github.com/grafana/grafana" }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - }, "ranges": [ { "type": "ECOSYSTEM", diff --git a/advisories/github-reviewed/2023/10/GHSA-h2rm-29ch-wfmh/GHSA-h2rm-29ch-wfmh.json b/advisories/github-reviewed/2023/10/GHSA-h2rm-29ch-wfmh/GHSA-h2rm-29ch-wfmh.json index 6d47f399fb3..12601c6264c 100644 --- a/advisories/github-reviewed/2023/10/GHSA-h2rm-29ch-wfmh/GHSA-h2rm-29ch-wfmh.json +++ b/advisories/github-reviewed/2023/10/GHSA-h2rm-29ch-wfmh/GHSA-h2rm-29ch-wfmh.json @@ -20,11 +20,6 @@ "ecosystem": "Maven", "name": "com.xwiki.identity-oauth:identity-oauth-ui" }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - }, "ranges": [ { "type": "ECOSYSTEM", diff --git a/advisories/github-reviewed/2023/10/GHSA-j44v-mmf2-xvm9/GHSA-j44v-mmf2-xvm9.json b/advisories/github-reviewed/2023/10/GHSA-j44v-mmf2-xvm9/GHSA-j44v-mmf2-xvm9.json index 57b242f604b..71a64d71bd4 100644 --- a/advisories/github-reviewed/2023/10/GHSA-j44v-mmf2-xvm9/GHSA-j44v-mmf2-xvm9.json +++ b/advisories/github-reviewed/2023/10/GHSA-j44v-mmf2-xvm9/GHSA-j44v-mmf2-xvm9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j44v-mmf2-xvm9", - "modified": "2023-10-20T19:30:23Z", + "modified": "2023-10-20T22:59:02Z", "published": "2023-10-20T19:30:23Z", "aliases": [ "CVE-2023-45805" @@ -9,7 +9,10 @@ "summary": "PDM Trojan Lockfile", "details": "### Summary\nIt's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project.\n\n### Details\nProject `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be [parseable as a version](https://github.com/frostming/unearth/blob/eca170d9370ac5032f2e497ee9b1b63823d3fe0f/src/unearth/evaluator.py#L215-L229) (and the filename must be a prefix of the project name), but it's [not verified to match the version being installed](https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99). (Version `2-2` is also not a valid [normalized version per PEP 440](https://peps.python.org/pep-0440/#post-release-spelling).)\n\nMatching the project name exactly (not just prefix) would fix the issue. The version should also be verified to avoid version downgrade attacks.\n\n### PoC\nExample `pdm.lock` snippet to appear to depend on `foo` but actually install `foo-2`\n```\n\"foo 2.2.0\" = [\n url = \"https://files.pythonhosted.org/.../foo-2-2.tar.gz\n]\n```\n\n### Impact\nWhen installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -17,11 +20,6 @@ "ecosystem": "PyPI", "name": "pdm" }, - "ecosystem_specific": { - "affected_functions": [ - "" - ] - }, "ranges": [ { "type": "ECOSYSTEM", @@ -42,6 +40,10 @@ "type": "WEB", "url": "https://github.com/pdm-project/pdm/security/advisories/GHSA-j44v-mmf2-xvm9" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45805" + }, { "type": "WEB", "url": "https://github.com/pdm-project/pdm/commit/6853e2642dfa281d4a9958fbc6c95b7e32d84831" @@ -57,13 +59,17 @@ { "type": "WEB", "url": "https://github.com/pdm-project/pdm/blob/45d1dfa47d4900c14a31b9bb761e4c46eb5c9442/src/pdm/models/candidates.py#L98-L99" + }, + { + "type": "WEB", + "url": "https://peps.python.org/pep-0440/#post-release-spelling" } ], "database_specific": { "cwe_ids": [ - + "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-10-20T19:30:23Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json b/advisories/github-reviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json new file mode 100644 index 00000000000..a1493e9e45c --- /dev/null +++ b/advisories/github-reviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xfrj-6vvc-3xm2", + "modified": "2023-10-20T22:59:19Z", + "published": "2023-10-20T12:31:04Z", + "aliases": [ + "CVE-2023-44483" + ], + "summary": "Apache Santuario - XML Security for Java are vulnerable to private key disclosure", + "details": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.santuario:xmlsec" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.santuario:xmlsec" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.santuario:xmlsec" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44483" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/santuario-java" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55" + }, + { + "type": "WEB", + "url": "https://santuario.apache.org/secadv.data/CVE-2023-44483.txt.asc?version=1&modificationDate=1697782758000&api=v2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/10/20/5" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-20T22:59:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json b/advisories/unreviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json deleted file mode 100644 index 1a897e5ea2a..00000000000 --- a/advisories/unreviewed/2023/10/GHSA-xfrj-6vvc-3xm2/GHSA-xfrj-6vvc-3xm2.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xfrj-6vvc-3xm2", - "modified": "2023-10-20T12:31:04Z", - "published": "2023-10-20T12:31:04Z", - "aliases": [ - "CVE-2023-44483" - ], - "details": "All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44483" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/vmqbp9mfxtrf0kmbnnmbn3h9j6dr9q55" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-532" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file