From f4a6aa8f0859293461a359fa1c8e8cefb717b59a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 15 Jan 2025 21:26:53 +0000 Subject: [PATCH] Publish Advisories GHSA-45v9-w9fh-33j6 GHSA-7pq6-v88g-wf3w GHSA-c873-wfhp-wx5m GHSA-45v9-w9fh-33j6 --- .../GHSA-45v9-w9fh-33j6.json | 146 ++++++++++++++++++ .../GHSA-7pq6-v88g-wf3w.json | 65 ++++++++ .../GHSA-c873-wfhp-wx5m.json | 48 ++++++ .../GHSA-45v9-w9fh-33j6.json | 36 ----- 4 files changed, 259 insertions(+), 36 deletions(-) create mode 100644 advisories/github-reviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-7pq6-v88g-wf3w/GHSA-7pq6-v88g-wf3w.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-c873-wfhp-wx5m/GHSA-c873-wfhp-wx5m.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json diff --git a/advisories/github-reviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json b/advisories/github-reviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json new file mode 100644 index 00000000000..d72661f5f5a --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json @@ -0,0 +1,146 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-45v9-w9fh-33j6", + "modified": "2025-01-15T21:25:35Z", + "published": "2025-01-15T18:30:58Z", + "aliases": [ + "CVE-2025-20088" + ], + "summary": "Mattermost fails to properly validate post props", + "details": "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.2.0" + }, + { + "fixed": "10.2.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0" + }, + { + "fixed": "10.1.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0.0" + }, + { + "fixed": "10.0.4" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.0.3" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.11.0" + }, + { + "fixed": "9.11.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.11.5" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0-20241127161322-25ff7a3779a5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20088" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-15T21:25:35Z", + "nvd_published_at": "2025-01-15T17:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-7pq6-v88g-wf3w/GHSA-7pq6-v88g-wf3w.json b/advisories/github-reviewed/2025/01/GHSA-7pq6-v88g-wf3w/GHSA-7pq6-v88g-wf3w.json new file mode 100644 index 00000000000..87459f58a4f --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-7pq6-v88g-wf3w/GHSA-7pq6-v88g-wf3w.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7pq6-v88g-wf3w", + "modified": "2025-01-15T21:25:27Z", + "published": "2025-01-15T21:25:27Z", + "aliases": [ + "CVE-2025-22146" + ], + "summary": "Sentry's improper authentication on SAML SSO process allows user impersonation", + "details": "### Impact\nA critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.\n\nThe vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.\n\n### Patches\n- [Sentry SaaS](https://sentry.io): The fix was deployed on Jan 14, 2025.\n- [Self-Hosted Sentry](https://github.com/getsentry/self-hosted): If only a single organization is allowed (`SENTRY_SINGLE_ORGANIZATION = True`), then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher.\n\n### Workarounds\nNo known workarounds.\n\n### References\n- https://github.com/getsentry/sentry/pull/83407", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "sentry" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "21.12.0" + }, + { + "fixed": "25.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w" + }, + { + "type": "WEB", + "url": "https://github.com/getsentry/sentry/pull/83407" + }, + { + "type": "WEB", + "url": "https://github.com/getsentry/sentry/commit/6db508f7949d117c7dff748a3c82c3a272bf7cfd" + }, + { + "type": "PACKAGE", + "url": "https://github.com/getsentry/sentry" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-01-15T21:25:27Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-c873-wfhp-wx5m/GHSA-c873-wfhp-wx5m.json b/advisories/github-reviewed/2025/01/GHSA-c873-wfhp-wx5m/GHSA-c873-wfhp-wx5m.json new file mode 100644 index 00000000000..b93dc9a6ade --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-c873-wfhp-wx5m/GHSA-c873-wfhp-wx5m.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c873-wfhp-wx5m", + "modified": "2025-01-15T21:25:54Z", + "published": "2025-01-15T21:25:54Z", + "aliases": [], + "summary": " SP1 has missing verifier checks and fiat-shamir observations", + "details": "In SP1’s STARK verifier, the prover provided `chip_ordering` is used to fetch the index of the chips that have preprocessed columns. Prior to v4.0.0, the validation that this `chip_ordering` correctly provides these indexes was missing. In v4.0.0, this was fixed by adding a check that the indexed chip’s name is equal to the name stored in the verifying key’s chip information. \n\nIn the recursive verifier, every verifier program is generated beforehand and later checked for correctness by requiring a merkle proof to the precomputed merkle root of valid verifier keys. Therefore, the recursive verifier and the on-chain verifier were not affected by this vulnerability. \n\nThis code was audited twice, once as a part of the audit by KALOS and once by Cantina for v1.0.0. This bug was found by the Succinct team during preparation of v4.0.0. Out of abundance of caution, we will be deprecating all previous versions and freeze the corresponding verifiers.\n\nFurthermore, in the recursive verifier, the `is_complete` boolean flag is used to flag a proof of complete execution. Prior to v4.0.0, this flag was underconstrained in parts of our recursive verifier, such as the first layer of the recursion. In v4.0.0, this bug was fixed by adding appropriate calls to the `assert_complete` function, which constrains the correctness of the `is_complete` flag. This code was a part of the audit for v3.0.0. This bug affects the soundness of the Rust SDK for verifying compressed proofs, and the soundness of on-chain verifier for deferred proofs. \n\nThis issue was found by a combined effort from Aligned, LambdaClass and 3MI Labs, and was also independently found by Succinct during the preparation of v4.0.0. \n\nLastly, SP1’s STARK verifier relied on logic inside Plonky3, one SP1's core dependencies, to check that the polynomial evaluation claims are correct using a FRI-based polynomial commitment scheme. To batch this check, multiple polynomial evaluation claims are combined using a random linear combination. Prior to v4.0.0, the individual evaluation claims were not observed into the challenger before sampling the coefficient for the random linear combination.In v4.0.0, this was fixed by observing all the evaluation claims into the challenger correctly inside of Plonky3.\n\nThis bug was found by external researchers, and we have worked closely with the Plonky3 team to mitigate this vulnerability. We will be deprecating all previous versions and freezing their verifiers to ensure that versions with the vulnerability will not be used in production.", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "sp1-stark" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/succinctlabs/sp1/security/advisories/GHSA-c873-wfhp-wx5m" + }, + { + "type": "PACKAGE", + "url": "https://github.com/succinctlabs/sp1" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-15T21:25:54Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json b/advisories/unreviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json deleted file mode 100644 index 75fee455d99..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-45v9-w9fh-33j6", - "modified": "2025-01-15T18:30:58Z", - "published": "2025-01-15T18:30:58Z", - "aliases": [ - "CVE-2025-20088" - ], - "details": "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20088" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-1287" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-15T17:15:19Z" - } -} \ No newline at end of file