From f737e957970fb4c3a8145b2aa2d9eba8262093cc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 7 Feb 2025 20:33:13 +0000 Subject: [PATCH] Publish Advisories GHSA-432c-wxpg-m4q3 GHSA-vj7w-3m8c-6vpx --- .../GHSA-432c-wxpg-m4q3.json | 59 +++++++++++++ .../GHSA-vj7w-3m8c-6vpx.json | 86 +++++++++++++++++++ 2 files changed, 145 insertions(+) create mode 100644 advisories/github-reviewed/2025/02/GHSA-432c-wxpg-m4q3/GHSA-432c-wxpg-m4q3.json create mode 100644 advisories/github-reviewed/2025/02/GHSA-vj7w-3m8c-6vpx/GHSA-vj7w-3m8c-6vpx.json diff --git a/advisories/github-reviewed/2025/02/GHSA-432c-wxpg-m4q3/GHSA-432c-wxpg-m4q3.json b/advisories/github-reviewed/2025/02/GHSA-432c-wxpg-m4q3/GHSA-432c-wxpg-m4q3.json new file mode 100644 index 00000000000..c120fb93c10 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-432c-wxpg-m4q3/GHSA-432c-wxpg-m4q3.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-432c-wxpg-m4q3", + "modified": "2025-02-07T20:32:27Z", + "published": "2025-02-07T20:32:27Z", + "aliases": [], + "summary": "xml2rfc has file inclusion irregularities", + "details": "Version [3.12.0](https://github.com/ietf-tools/xml2rfc/blob/main/CHANGELOG.md#3120---2021-12-08) changed `xml2rfc` so that it would not access local files without the presence of its new `--allow-local-file-access` flag.\nThis prevented XML External Entity (XXE) injection attacks with `xinclude` and XML entity references.\n\nIt was discovered that `xml2rfc` does not respect `--allow-local-file-access` when a local file is specified as `src` in `artwork` or `sourcecode` elements. Furthermore, XML entity references can include any file inside the source dir and below without using the `--allow-local-file-access` flag. \n\nThe `xml2rfc <= 3.26.0` behaviour:\n\n| | `xinclude` | XML entity reference | `artwork src=` | `sourcecode src=` |\n|---|---|---|---|---|\n| without `--allow-local-file-access` flag | No filesystem access | Any file in xml2rfc templates dir and below, any file in source directory and below | Access source directory and below | Access source directory and below |\n| with `--allow-local-file-access` flag | Access any file on filesystem[^1] | Access any file on filesystem[^1] | Access source directory and below | Access source directory and below | Access source directory and below |\n\n [^1]: Access any file of the filesystem with the permissions of the user running `xml2rfc` can access.\n\n### Impact\n\nAnyone running `xml2rfc` as a service that accepts input from external users is impacted by this issue.\nSpecifying a file in `src` attribute in `artwork` or `sourcecode` elements will cause the contents of that file to appear in xml2rfc’s output results.\nBut that file has to be inside the same directory as the XML input source file.\nFor `artwork` and `sourcecode`, `xml2rfc` will not look above the source file directory.\n\n### The proposed new behaviour\n- Generalize file access checks.\n- Only allow access to files within src dir and below. (xml entity include can access templates dir).\n- Always allow access to `templates_dir` for XML entity includes.\n\nNew behaviour:\n\n| | `xinclude` | XML entity reference | `artwork src=` | `sourcecode src=` |\n|---|---|---|---|---|\n| without `--allow-local-file-access` flag | No filesystem access | No filesystem access _(except for `templates_dir`)_ | No filesystem access | No filesystem access |\n| with `--allow-local-file-access` flag | Access source directory and below | Access source directory and below _(Can access`templates_dir`)._ | Access source directory and below | Access source directory and below |\n\n### Workarounds\n\nUse a secure temporary directory to process un-trusted XML files, and do not reuse it for processing other XML documents.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "xml2rfc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.12.0" + }, + { + "fixed": "3.27.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ietf-tools/xml2rfc/security/advisories/GHSA-432c-wxpg-m4q3" + }, + { + "type": "WEB", + "url": "https://github.com/ietf-tools/xml2rfc/commit/ec98f9cb4b9a8658222117df037dda473ca3f4e4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ietf-tools/xml2rfc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-07T20:32:27Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-vj7w-3m8c-6vpx/GHSA-vj7w-3m8c-6vpx.json b/advisories/github-reviewed/2025/02/GHSA-vj7w-3m8c-6vpx/GHSA-vj7w-3m8c-6vpx.json new file mode 100644 index 00000000000..ddef37b4b16 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-vj7w-3m8c-6vpx/GHSA-vj7w-3m8c-6vpx.json @@ -0,0 +1,86 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vj7w-3m8c-6vpx", + "modified": "2025-02-07T20:31:22Z", + "published": "2025-02-07T20:31:22Z", + "aliases": [ + "CVE-2025-24366" + ], + "summary": "SFTPGo has insufficient sanitization of user provided rsync command", + "details": "### Impact\nSFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`: it is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends.\n\nDue to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. \n\n### Patches\nThis issue was fixed in version v2.6.5 by checking the client provided arguments.\n\nhttps://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/drakkan/sftpgo/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.9.5" + }, + { + "fixed": "2.6.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.6.4" + } + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/drakkan/sftpgo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.9.5" + }, + { + "fixed": "2.6.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.6.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-vj7w-3m8c-6vpx" + }, + { + "type": "WEB", + "url": "https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drakkan/sftpgo" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-07T20:31:22Z", + "nvd_published_at": null + } +} \ No newline at end of file