From e7b58b91babbc322e0d842c71b28fc2aa4033e7a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 18 Sep 2024 17:43:34 +0000 Subject: [PATCH] Publish Advisories GHSA-68g8-c275-xf2m GHSA-jhg6-6qrx-38mr --- .../GHSA-68g8-c275-xf2m.json | 127 ++++++++++++++++++ .../GHSA-jhg6-6qrx-38mr.json | 65 +++++++++ 2 files changed, 192 insertions(+) create mode 100644 advisories/github-reviewed/2024/09/GHSA-68g8-c275-xf2m/GHSA-68g8-c275-xf2m.json create mode 100644 advisories/github-reviewed/2024/09/GHSA-jhg6-6qrx-38mr/GHSA-jhg6-6qrx-38mr.json diff --git a/advisories/github-reviewed/2024/09/GHSA-68g8-c275-xf2m/GHSA-68g8-c275-xf2m.json b/advisories/github-reviewed/2024/09/GHSA-68g8-c275-xf2m/GHSA-68g8-c275-xf2m.json new file mode 100644 index 00000000000..4ee22f5663e --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-68g8-c275-xf2m/GHSA-68g8-c275-xf2m.json @@ -0,0 +1,127 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-68g8-c275-xf2m", + "modified": "2024-09-18T17:42:05Z", + "published": "2024-09-18T17:42:05Z", + "aliases": [ + "CVE-2024-46990" + ], + "summary": "Directus vulnerable to SSRF Loopback IP filter bypass", + "details": "### Impact\nIf you're relying on blocking access to localhost using the default `0.0.0.0` filter this can be bypassed using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`)\n\n### Workaround\nYou can block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "directus" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.13.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "directus" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.1.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@directus/api" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "21.0.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@directus/api" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "22.0.0" + }, + { + "fixed": "22.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/directus/directus/security/advisories/GHSA-68g8-c275-xf2m" + }, + { + "type": "WEB", + "url": "https://github.com/directus/directus/commit/8cbf943b65fd4a763d09a5fdbba8996b1e7797ff" + }, + { + "type": "WEB", + "url": "https://github.com/directus/directus/commit/c1f3ccc681595038d094ce110ddeee38cb38f431" + }, + { + "type": "PACKAGE", + "url": "https://github.com/directus/directus" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284", + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-18T17:42:05Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-jhg6-6qrx-38mr/GHSA-jhg6-6qrx-38mr.json b/advisories/github-reviewed/2024/09/GHSA-jhg6-6qrx-38mr/GHSA-jhg6-6qrx-38mr.json new file mode 100644 index 00000000000..132e48738b1 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-jhg6-6qrx-38mr/GHSA-jhg6-6qrx-38mr.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jhg6-6qrx-38mr", + "modified": "2024-09-18T17:42:46Z", + "published": "2024-09-18T17:42:46Z", + "aliases": [ + "CVE-2024-46989" + ], + "summary": "SpiceDB having multiple caveats on resources of the same type may improperly result in no permission", + "details": "## Background\n\nMultiple caveats over the same indirect subject type on the same relation can result in no permission being returned when permission is expected\n\nFor example, given this schema:\n\n```\ndefinition user {}\n\ncaveat somecaveat(somefield int) {\n somefield == 42\n}\n\ndefinition group {\n relation member: user\n}\n\ndefinition resource {\n relation viewer: group#member with somecaveat\n permission view = folder->view\n}\n```\n\nIf the resource has multiple groups, and each group is caveated, it is possible for the returned permission to be \"no permission\" when permission is expected.\n\n## Impact\nPermission is returned as NO_PERMISSION when PERMISSION is expected on the CheckPermission API.\n\n## Workarounds\nDo not use caveats or do not use caveats on an indirect subject type with multiple entries", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/authzed/spicedb" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.35.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/authzed/spicedb/security/advisories/GHSA-jhg6-6qrx-38mr" + }, + { + "type": "WEB", + "url": "https://github.com/authzed/spicedb/commit/20855de75812bcbc975efebe7f76abf47c0f3edb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/authzed/spicedb" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-09-18T17:42:46Z", + "nvd_published_at": null + } +} \ No newline at end of file