netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-47f6-5gq3-vx9c
GHSA-v9qv-c7wm-wgmf
GHSA-vvhj-v88f-5gxr
This commit is contained in:
advisory-database[bot]
2024-06-10 21:37:48 +00:00
parent 713d56f031
commit ef2e0456de
3 changed files with 230 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/06/GHSA-47f6-5gq3-vx9c/GHSA-47f6-5gq3-vx9c.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-47f6-5gq3-vx9c",
"modified": "2024-06-10T21:36:32Z",
"published": "2024-06-10T21:36:32Z",
"aliases": [
"CVE-2024-35241"
],
"summary": "Composer has a command injection via malicious git branch name",
"details": "### Impact\n\nThe `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code.\n\n### Patches\n\n2.2.24 for 2.2 LTS or 2.7.7 for mainline\n\n### Workarounds\n\nAvoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "composer/composer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0"
},
{
"fixed": "2.2.24"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "composer/composer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3"
},
{
"fixed": "2.7.7"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/composer/composer/security/advisories/GHSA-47f6-5gq3-vx9c"
},
{
"type": "WEB",
"url": "https://github.com/composer/composer/commit/b93fc6ca437da35ae73d667d0618749c763b67d4"
},
{
"type": "WEB",
"url": "https://github.com/composer/composer/commit/ee28354ca8d33c15949ad7de2ce6656ba3f68704"
},
{
"type": "PACKAGE",
"url": "https://github.com/composer/composer"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-06-10T21:36:32Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/06/GHSA-v9qv-c7wm-wgmf/GHSA-v9qv-c7wm-wgmf.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v9qv-c7wm-wgmf",
"modified": "2024-06-10T21:36:25Z",
"published": "2024-06-10T21:36:25Z",
"aliases": [
"CVE-2024-35242"
],
"summary": "Composer has multiple command injections via malicious git/hg branch names",
"details": "### Impact\n\nThe `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. So this requires cloning untrusted repositories.\n\n### Patches\n\n2.2.24 for 2.2 LTS or 2.7.7 for mainline\n\n### Workarounds\n\nAvoid cloning potentially compromised repositories.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "composer/composer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0"
},
{
"fixed": "2.2.24"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "composer/composer"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3"
},
{
"fixed": "2.7.7"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/composer/composer/security/advisories/GHSA-v9qv-c7wm-wgmf"
},
{
"type": "WEB",
"url": "https://github.com/composer/composer/commit/6bd43dff859c597c09bd03a7e7d6443822d0a396"
},
{
"type": "WEB",
"url": "https://github.com/composer/composer/commit/fc57b93603d7d90b71ca8ec77b1c8a9171fdb467"
},
{
"type": "PACKAGE",
"url": "https://github.com/composer/composer"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-06-10T21:36:25Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2024/06/GHSA-vvhj-v88f-5gxr/GHSA-vvhj-v88f-5gxr.json
+62
View File
@@ -0,0 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vvhj-v88f-5gxr",
"modified": "2024-06-10T21:36:48Z",
"published": "2024-06-10T21:36:48Z",
"aliases": [
"CVE-2024-37166"
],
"summary": "ghtml Cross-Site Scripting (XSS) vulnerability",
"details": "## Summary\n\nIt is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases.\n\n## Actions Taken\n\n- Updated the documentation to clarify that while `ghtml` escapes characters with special meaning in HTML, it does not provide comprehensive protection against all types of XSS attacks in every scenario. **_This aligns with the approach taken by other template engines. Developers should be cautious and take additional measures to sanitize user input and prevent potential vulnerabilities._** More reading: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n- The backtick character (`) is now also escaped to prevent the creation of strings in most cases where a malicious actor somehow gains the ability to write JavaScript. This does not provide comprehensive protection either.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ghtml"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/gurgunday/ghtml/security/advisories/GHSA-vvhj-v88f-5gxr"
},
{
"type": "WEB",
"url": "https://github.com/gurgunday/ghtml/commit/df1ea50fe8968a766fd2b9379a8f9806375227f8"
},
{
"type": "PACKAGE",
"url": "https://github.com/gurgunday/ghtml"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-80"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-06-10T21:36:48Z",
"nvd_published_at": null
}
}