From fb0d5b37041aaef7c22231c8d246a268a939e1b9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 20:59:57 +0000 Subject: [PATCH] Publish Advisories GHSA-67m4-qxp3-j6hh GHSA-h3q2-8whx-c29h --- .../GHSA-67m4-qxp3-j6hh.json | 65 ++++++++++++++++++ .../GHSA-h3q2-8whx-c29h.json | 68 +++++++++++++++++++ 2 files changed, 133 insertions(+) create mode 100644 advisories/github-reviewed/2024/01/GHSA-67m4-qxp3-j6hh/GHSA-67m4-qxp3-j6hh.json create mode 100644 advisories/github-reviewed/2024/01/GHSA-h3q2-8whx-c29h/GHSA-h3q2-8whx-c29h.json diff --git a/advisories/github-reviewed/2024/01/GHSA-67m4-qxp3-j6hh/GHSA-67m4-qxp3-j6hh.json b/advisories/github-reviewed/2024/01/GHSA-67m4-qxp3-j6hh/GHSA-67m4-qxp3-j6hh.json new file mode 100644 index 00000000000..f620f61b354 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-67m4-qxp3-j6hh/GHSA-67m4-qxp3-j6hh.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-67m4-qxp3-j6hh", + "modified": "2024-01-30T20:57:59Z", + "published": "2024-01-30T20:57:59Z", + "aliases": [ + "CVE-2024-23838" + ], + "summary": "TrueLayer.Client SSRF when fetching payment or payment provider", + "details": "### Impact\nThe vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure.\n\n### Patches\nVersions of TrueLayer.Client `v1.6.0` and later are not affected.\n\n### Workarounds\nThe issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the TrueLayer.Client library.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "TrueLayer.Client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23838" + }, + { + "type": "WEB", + "url": "https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TrueLayer/truelayer-dotnet" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T20:57:59Z", + "nvd_published_at": "2024-01-30T17:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-h3q2-8whx-c29h/GHSA-h3q2-8whx-c29h.json b/advisories/github-reviewed/2024/01/GHSA-h3q2-8whx-c29h/GHSA-h3q2-8whx-c29h.json new file mode 100644 index 00000000000..7a6a2664d4a --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-h3q2-8whx-c29h/GHSA-h3q2-8whx-c29h.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h3q2-8whx-c29h", + "modified": "2024-01-30T20:57:52Z", + "published": "2024-01-30T20:57:52Z", + "aliases": [ + "CVE-2024-23840" + ], + "summary": "`goreleaser release --debug` shows secrets", + "details": "### Summary\nHello 👋 \n\n`goreleaser release --debug` log shows secret values used in the in the custom publisher.\n\n\nHow to reproduce the issue:\n\n- Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env` \n\n```\n#.goreleaser.yml \npublishers:\n - name: my-publisher\n # IDs of the artifacts we want to sign\n ids:\n - linux_archives\n - linux_package\n cmd: \"./build/package/linux_notarize.sh\"\n env:\n - VERSION={{ .Version }}\n - SECRET_1={{.Env.SECRET_1}}\n - SECRET_2={{.Env.SECRET_2}}\n```\n\n- run `goreleaser release --debug`\n\nYou should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`\n\nExample:\n\n```\nrunning cmd= ....\nSECRET_1=secret_value\n```\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/goreleaser/goreleaser" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.23.0" + }, + { + "fixed": "1.24.0" + } + ] + } + ], + "versions": [ + "1.23.0" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23840" + }, + { + "type": "WEB", + "url": "https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/goreleaser/goreleaser" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T20:57:52Z", + "nvd_published_at": "2024-01-30T17:15:11Z" + } +} \ No newline at end of file