diff --git a/advisories/github-reviewed/2024/08/GHSA-c77r-fh37-x2px/GHSA-c77r-fh37-x2px.json b/advisories/github-reviewed/2024/08/GHSA-c77r-fh37-x2px/GHSA-c77r-fh37-x2px.json new file mode 100644 index 00000000000..3a7787d34d3 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-c77r-fh37-x2px/GHSA-c77r-fh37-x2px.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c77r-fh37-x2px", + "modified": "2024-09-19T19:47:48Z", + "published": "2024-08-30T15:31:30Z", + "aliases": [ + "CVE-2024-8260" + ], + "summary": "OPA for Windows has an SMB force-authentication vulnerability", + "details": "A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/open-policy-agent/opa" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.68.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8260" + }, + { + "type": "WEB", + "url": "https://github.com/open-policy-agent/opa/commit/10f4d553e6bb6ae9c69611ecdd9a77dda857070e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/open-policy-agent/opa" + }, + { + "type": "WEB", + "url": "https://github.com/open-policy-agent/opa/releases/tag/v0.68.0" + }, + { + "type": "WEB", + "url": "https://www.tenable.com/security/research/tra-2024-36" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-294" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-19T19:47:47Z", + "nvd_published_at": "2024-08-30T13:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json b/advisories/github-reviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json similarity index 63% rename from advisories/unreviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json rename to advisories/github-reviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json index 4bc0762b61a..66e7c742b41 100644 --- a/advisories/unreviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json +++ b/advisories/github-reviewed/2024/09/GHSA-4xx7-2cx3-x473/GHSA-4xx7-2cx3-x473.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-4xx7-2cx3-x473", - "modified": "2024-09-19T18:30:52Z", + "modified": "2024-09-19T19:48:27Z", "published": "2024-09-19T18:30:52Z", "aliases": [ "CVE-2024-8698" ], + "summary": "Keycloak SAML signature validation flaw", "details": "A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L" } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-saml-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "25.0.6" + } + ] + } + ] + } ], "references": [ { @@ -29,9 +52,17 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311641" }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/blob/main/saml-core/src/main/java/org/keycloak/saml/processing/core/util/XMLSignatureUtil.java#L415" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/releases/tag/25.0.6" } ], "database_specific": { @@ -39,8 +70,8 @@ "CWE-347" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-19T19:48:27Z", "nvd_published_at": "2024-09-19T16:15:06Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json b/advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json similarity index 60% rename from advisories/unreviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json rename to advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json index 537b70f581c..29f45a27f5b 100644 --- a/advisories/unreviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json +++ b/advisories/github-reviewed/2024/09/GHSA-vvf8-2h68-9475/GHSA-vvf8-2h68-9475.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-vvf8-2h68-9475", - "modified": "2024-09-19T18:30:52Z", + "modified": "2024-09-19T19:48:17Z", "published": "2024-09-19T18:30:52Z", "aliases": [ "CVE-2024-8883" ], + "summary": "Keycloak Open Redirect vulnerability", "details": "A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.keycloak:keycloak-services" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "25.0.6" + } + ] + } + ] + } ], "references": [ { @@ -29,9 +52,17 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312511" }, + { + "type": "PACKAGE", + "url": "https://github.com/keycloak/keycloak" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java" + }, + { + "type": "WEB", + "url": "https://github.com/keycloak/keycloak/releases/tag/25.0.6" } ], "database_specific": { @@ -39,8 +70,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-19T19:48:16Z", "nvd_published_at": "2024-09-19T16:15:06Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-w69q-w4h4-2fx8/GHSA-w69q-w4h4-2fx8.json b/advisories/github-reviewed/2024/09/GHSA-w69q-w4h4-2fx8/GHSA-w69q-w4h4-2fx8.json similarity index 64% rename from advisories/unreviewed/2024/09/GHSA-w69q-w4h4-2fx8/GHSA-w69q-w4h4-2fx8.json rename to advisories/github-reviewed/2024/09/GHSA-w69q-w4h4-2fx8/GHSA-w69q-w4h4-2fx8.json index ac210bf7c08..64d1d8ea3f6 100644 --- a/advisories/unreviewed/2024/09/GHSA-w69q-w4h4-2fx8/GHSA-w69q-w4h4-2fx8.json +++ b/advisories/github-reviewed/2024/09/GHSA-w69q-w4h4-2fx8/GHSA-w69q-w4h4-2fx8.json @@ -1,20 +1,62 @@ { "schema_version": "1.4.0", "id": "GHSA-w69q-w4h4-2fx8", - "modified": "2024-09-19T18:30:52Z", + "modified": "2024-09-19T19:48:00Z", "published": "2024-09-19T18:30:52Z", "aliases": [ "CVE-2024-8375" ], + "summary": "Reverb use after free vulnerability", "details": "There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance. Afterwards, Reverb copies the content in tensor_content to the previously mentioned pre-allocated memory, which results in the bytes in tensor_content overwriting the vtable pointers of all the objects which were previously allocated. Reverb exposes 2 relevant gRPC endpoints: InsertStream and SampleStream. The attacker can insert this stream into the server’s database, then when the client next calls SampleStream they will unpack the tensor into RAM, and when any method on that object is called (including its destructor) the attacker gains control of the Program Counter. We recommend upgrading past git commit  https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "dm-reverb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.14.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "dm-reverb-nightly" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.15.0.dev20240214" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +70,10 @@ { "type": "WEB", "url": "https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25" + }, + { + "type": "PACKAGE", + "url": "https://github.com/google-deepmind/reverb" } ], "database_specific": { @@ -35,8 +81,8 @@ "CWE-502" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-19T19:47:59Z", "nvd_published_at": "2024-09-19T16:15:06Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-c77r-fh37-x2px/GHSA-c77r-fh37-x2px.json b/advisories/unreviewed/2024/08/GHSA-c77r-fh37-x2px/GHSA-c77r-fh37-x2px.json deleted file mode 100644 index e967045faa7..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-c77r-fh37-x2px/GHSA-c77r-fh37-x2px.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-c77r-fh37-x2px", - "modified": "2024-09-19T18:30:50Z", - "published": "2024-08-30T15:31:30Z", - "aliases": [ - "CVE-2024-8260" - ], - "details": "A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8260" - }, - { - "type": "WEB", - "url": "https://www.tenable.com/security/research/tra-2024-36" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-294" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-30T13:15:12Z" - } -} \ No newline at end of file