Publish Advisories

GHSA-5hc5-fxr9-5frc
GHSA-fpmr-m242-xm7x
GHSA-j7jw-28jm-whr6

advisories/github-reviewed/2024/09/GHSA-5hc5-fxr9-5frc/GHSA-5hc5-fxr9-5frc.json

@@ -1,13 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5hc5-fxr9-5frc",
-  "modified": "2024-09-19T16:06:11Z",
+  "modified": "2025-02-21T21:43:09Z",
   "published": "2024-09-19T00:31:32Z",
-  "aliases": [
-    "CVE-2022-25770"
-  ],
-  "summary": "Mautic has insufficient authentication in upgrade flow",
-  "details": "Mautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.",
+  "withdrawn": "2025-02-21T21:43:09Z",
+  "aliases": [],
+  "summary": "Duplicate Advisory: Mautic has insufficient authentication in upgrade flow",
+  "details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qf6m-6m4g-rmrc. This link is maintained to preserve external references.\n\n# Original Description\nMautic allows you to update the application via an upgrade script.\n\nThe upgrade logic isn't shielded off correctly, which may lead to vulnerable situation.\n\nThis vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2025/02/GHSA-j7jw-28jm-whr6/GHSA-j7jw-28jm-whr6.json

@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j7jw-28jm-whr6",
+  "modified": "2025-02-21T21:43:16Z",
+  "published": "2025-02-21T21:43:16Z",
+  "aliases": [
+    "CVE-2025-27100"
+  ],
+  "summary": "lakeFS allows an authenticated user to cause a crash by exhausting server memory",
+  "details": "### Impact\n\nAn authenticated user can crash lakeFS by exhausting server memory.  This is an authenticated denial-of-service issue.\n\n### Patches\nThis problem has been patched and exists in versions 1.49.1 and below\n\n### Workarounds\n\nOn S3 backends, configure\n```yaml\n# ...\nblockstore:\n  s3:\n    disable_pre_signed_multipart: true\n```\nor set environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true`.\n\n### References\n_Are there any links users can visit to find out more?_",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/treeverse/lakefs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.50.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-j7jw-28jm-whr6"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27100"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/treeverse/lakeFS/commit/3a625752acdf3f8e137bec20451e71d0f9fa82f2"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/treeverse/lakeFS"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-21T21:43:16Z",
+    "nvd_published_at": "2025-02-21T00:15:09Z"
+  }
+}