diff --git a/advisories/github-reviewed/2024/10/GHSA-8v4w-f4r9-7h6x/GHSA-8v4w-f4r9-7h6x.json b/advisories/github-reviewed/2024/10/GHSA-8v4w-f4r9-7h6x/GHSA-8v4w-f4r9-7h6x.json new file mode 100644 index 00000000000..e09263dbb5b --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-8v4w-f4r9-7h6x/GHSA-8v4w-f4r9-7h6x.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8v4w-f4r9-7h6x", + "modified": "2024-10-03T16:53:20Z", + "published": "2024-10-03T16:53:20Z", + "aliases": [ + "CVE-2024-8037" + ], + "summary": "Vulnerable juju hook tool abstract UNIX domain socket", + "details": "### Impact\nWhen combined with an attack of `JUJU_CONTEXT_ID`, any user on the local system with access to the default network namespace may connect to the `@/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket` and perform actions that are normally reserved to a juju charm.\n\n### Patches\nPatch: https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206\nPatched in:\n- 3.5.4\n- 3.4.6\n- 3.3.7\n- 3.1.10\n- 2.9.51\n\n### Workarounds\nNo workarounds available.\n\n### References\n[GHSA-mh98-763h-m9v4](https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4)\nhttps://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20240820065804-2f2ec128ef5a" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8037" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206" + }, + { + "type": "PACKAGE", + "url": "https://github.com/juju/juju" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:53:20Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-r7pg-v2c8-mfg3/GHSA-r7pg-v2c8-mfg3.json b/advisories/github-reviewed/2024/10/GHSA-r7pg-v2c8-mfg3/GHSA-r7pg-v2c8-mfg3.json new file mode 100644 index 00000000000..bbabc44adc6 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-r7pg-v2c8-mfg3/GHSA-r7pg-v2c8-mfg3.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r7pg-v2c8-mfg3", + "modified": "2024-10-03T16:52:52Z", + "published": "2024-10-03T12:30:48Z", + "aliases": [ + "CVE-2024-47561" + ], + "summary": "Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)", + "details": "Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.avro:avro-parent" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/avro" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:52:52Z", + "nvd_published_at": "2024-10-03T11:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-x5q3-c8rm-w787/GHSA-x5q3-c8rm-w787.json b/advisories/github-reviewed/2024/10/GHSA-x5q3-c8rm-w787/GHSA-x5q3-c8rm-w787.json new file mode 100644 index 00000000000..c608878f686 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-x5q3-c8rm-w787/GHSA-x5q3-c8rm-w787.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5q3-c8rm-w787", + "modified": "2024-10-03T16:53:07Z", + "published": "2024-10-03T16:53:07Z", + "aliases": [ + "CVE-2024-9313" + ], + "summary": "PAM module may allow accessing with the credentials of another user", + "details": "Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.\n\nThis is possible using tools such as `su`, `sudo` or `ssh` (and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction.\n\nAuthd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack.\n\n`su` version that will include https://github.com/util-linux/util-linux/pull/3206 will not be affected\n`ssh` version that will include https://github.com/openssh/openssh-portable/pull/521 will not be affected\n`sudo` version that will include https://github.com/sudo-project/sudo/pull/412 will not be affected\n`login` not affected\n`passwd` not affected\n\n
\nOld report\n\n### Summary\n\nAn user can access as another user using its own credentials\n\n### Details\n\nI feel we’ve a security issue that is due to the fact that we allow changing the user in the cases in which that’s already provided by PAM, I’ve not tested this using the entra-id broker but it’s reproducible with the example one, but unless I’m missing something it should be independent from the broker in use.\n\nBasically, by going to the user selection page we allow to login as any user by entering the use own credentials.\n\nSee for example: https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf or https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo \n\nBasically it’s possible to logging in as `user1` using the credentials of `user2` or `user3`.\n\nThe issue doesn’t affect login or passwd, but it does affect `su` and `sshd`, since in both cases they don’t check if the `PAM_USER` changed before the final authentication.\n\nNow, while those tools should likely be fixed to only read the PAM_USER once pam gave them the final ok, I think authd should not allow changing the user at all when it has been provided by PAM.\n
", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/ubuntu/authd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20240930103526-63e527496b01" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ubuntu/authd/security/advisories/GHSA-x5q3-c8rm-w787" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9313" + }, + { + "type": "WEB", + "url": "https://github.com/ubuntu/authd/commit/63e527496b013bed46904c1c58be593c13ebdce5" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ubuntu/authd" + }, + { + "type": "WEB", + "url": "https://www.cve.org/CVERecord?id=CVE-2024-9313" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:53:07Z", + "nvd_published_at": "2024-10-03T11:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-xwgj-vpm9-q2rq/GHSA-xwgj-vpm9-q2rq.json b/advisories/github-reviewed/2024/10/GHSA-xwgj-vpm9-q2rq/GHSA-xwgj-vpm9-q2rq.json new file mode 100644 index 00000000000..7ff460b27e9 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-xwgj-vpm9-q2rq/GHSA-xwgj-vpm9-q2rq.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwgj-vpm9-q2rq", + "modified": "2024-10-03T16:53:26Z", + "published": "2024-10-03T16:53:26Z", + "aliases": [ + "CVE-2024-8038" + ], + "summary": "Vulnerable juju introspection abstract UNIX domain socket", + "details": "### Impact\nAn abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.\n\nOn a juju controller agent, denial of service can be performed by using the `/leases/revoke` endpoint. Revoking leases in juju can cause availability issues.\n\nOn a juju machine agent that is hosting units, disabling the unit component can be performed using the `/units` endpoint with a \"stop\" action.\n\n### Patches\nPatch: https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b\nPatched in:\n- 3.5.4\n- 3.4.6\n- 3.3.7\n- 3.1.10\n- 2.9.51\n\n### Workarounds\nNo workaround.\n\n### References\nhttps://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/juju/juju" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20240829052008-43f0fc59790d" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8038" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/juju/juju" + }, + { + "type": "WEB", + "url": "https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-03T16:53:26Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-r7pg-v2c8-mfg3/GHSA-r7pg-v2c8-mfg3.json b/advisories/unreviewed/2024/10/GHSA-r7pg-v2c8-mfg3/GHSA-r7pg-v2c8-mfg3.json deleted file mode 100644 index 46d70da2b7e..00000000000 --- a/advisories/unreviewed/2024/10/GHSA-r7pg-v2c8-mfg3/GHSA-r7pg-v2c8-mfg3.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-r7pg-v2c8-mfg3", - "modified": "2024-10-03T12:30:48Z", - "published": "2024-10-03T12:30:48Z", - "aliases": [ - "CVE-2024-47561" - ], - "details": "Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47561" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-10-03T11:15:13Z" - } -} \ No newline at end of file