Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
behavior of the CodeBuild project or the Lambda function, they would be able to escalate their privileges. Prior to version 4.0.0, the bootstrap CodeBuild role provides access to the `sts:AssumeRole` operation without further restrictions. Therefore, it is able to assume into any AWS Account in the AWS Organization with the elevated privileges provided by the cross-account access role. By default, this role is not restricted when it is created by AWS Organizations, providing Administrator level access to the AWS resources in the AWS Account. The patches for this issue are included in `aws-deployment-framework` version 4.0.0. As a temporary mitigation, add a permissions boundary to the roles
ncluded in `aws-deployment-framework` version 4.0.0. As a temporary mitigation, add a permissions boundary to the roles created by ADF in the management account. The permissions boundary should deny all IAM and STS actions. This permissions boundary should be in place until you upgrade ADF or bootstrap a new account. While the permissions boundary is in place, the account management and bootstrapping of accounts are unable to create, update, or assume into roles. This mitigates the privilege escalation risk, but also disables ADF's ability to create, manage, and bootstrap accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aw
ccounts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/awslabs/aws-deployment-framework/security/advisories/GHSA-mcj7-ppmv-h6jr - https://github.com/awslabs/aws-deployment-framework/pull/732 - https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html - https://github.com/awslabs/aws-deployment-framework/releases/tag/v4.0.0
CVE ID: CVE-2024-37294 State: PUBLISHED Published: 2024-06-11T14:16:29.756Z Last Updated: 2024-08-02T03:50:55.957Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: aimeos Products: aimeos-core Problem Types: CWE-270 Description: Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/aimeos-co
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p
CVE ID: CVE-2024-37295 State: PUBLISHED Published: 2024-06-11T14:38:17.416Z Last Updated: 2024-08-02T03:50:56.094Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: aimeos Products: aimeos-core Problem Types: CWE-73 Description: Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/aimeo
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c
CVE ID: CVE-2024-37296 State: PUBLISHED Published: 2024-06-11T14:43:39.391Z Last Updated: 2024-08-02T03:50:56.097Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: aimeos Products: ai-client-html Problem Types: CWE-841, CWE-862 Description: The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue. Additional Analyst Notes: -
eed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7 - https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83 - https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214 - https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975 - https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409 - https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99
ommit/7f01d2f4fbc67f5231fd84adeb835d28252b8409 - https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0
CVE ID: CVE-2024-37297 State: PUBLISHED Published: 2024-06-12T15:05:46.468Z Last Updated: 2024-08-02T03:50:56.092Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: woocommerce Products: woocommerce Problem Types: CWE-79, CWE-80 Description: WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the s
ctims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrf - https://github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4 - https://github.com/woocommer
ttps://github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4 - https://github.com/woocommerce/woocommerce/commit/915e32a42762916b745a7e663c8b69a698da8b67 - https://developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0
CVE ID: CVE-2024-37298 State: PUBLISHED Published: 2024-07-01T18:27:33.952Z Last Updated: 2024-08-02T03:50:55.675Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gorilla Products: schema Problem Types: CWE-770 Description: gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains
struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gorilla/schema/security/advisories/GHSA-3669-72x9-r9p3 - https://github.com/gorilla/schema/commit/cd59f2f12cbdfa9c06aa63e425d1fe4a806967ff - https://github.com/gorilla/schema/blob/main/decoder.go#L223
CVE ID: CVE-2024-37299 State: PUBLISHED Published: 2024-07-30T14:22:36.367Z Last Updated: 2024-08-02T03:50:55.878Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source discussion platform. Prior to 3.2.5 and 3.3.0.beta5, crafting requests to submit very long tag group names can reduce the availability of a Discourse instance. This vulnerability is fixed in 3.2.5 and 3.3.0.beta5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-4j6h-9pjp-5476 - https://github.com/disco
References: - https://github.com/discourse/discourse/security/advisories/GHSA-4j6h-9pjp-5476 - https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210 - https://github.com/discourse/discourse/commit/76f06f6b1491db6bd09a4017d2c5591431b3b16e
CVE ID: CVE-2024-37300 State: PUBLISHED Published: 2024-06-12T15:20:20.363Z Last Updated: 2024-08-02T03:50:55.855Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: jupyterhub Products: oauthenticator Problem Types: CWE-863 Description: OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`.
e precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jupyterhub/oau
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-gprj-3p75-f996 - https://github.com/jupyterhub/oauthenticator/commit/d1aea05fa89f2beae15ab0fa0b0d071030f79654 - https://jupyterhub.readthedocs.io/en/stable/howto/upgrading-v5.html#authenticator-allow-all-and-allow-existing-users
CVE ID: CVE-2024-37301 State: PUBLISHED Published: 2024-06-11T18:34:38.374Z Last Updated: 2024-08-02T03:50:56.118Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: adfinis Products: document-merge-service Problem Types: CWE-1336 Description: Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed. Additional A
ystem. As of time of publication, no patched version exists, nor have any known workarounds been disclosed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6 - https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074
CVE ID: CVE-2024-37302 State: PUBLISHED Published: 2024-12-03T17:04:15.839Z Last Updated: 2024-12-03T18:56:17.082Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: element-hq Products: synapse Problem Types: CWE-770 Description: Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending
ce, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-4mhg-xv73-xq2x
CVE ID: CVE-2024-37303 State: PUBLISHED Published: 2024-12-03T17:06:02.467Z Last Updated: 2024-12-03T18:51:29.590Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: element-hq Products: synapse Problem Types: CWE-306 Description: Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant p
an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxr - https://github.com/matrix-org/matrix-spec-proposals/pull/3916
CVE ID: CVE-2024-37304 State: PUBLISHED Published: 2024-06-12T14:27:40.184Z Last Updated: 2024-08-02T03:50:55.991Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: NuGet Products: NuGetGallery Problem Types: CWE-79 Description: NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javas
oit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javascript:alert(1)>`, the link is rendered without proper sanitization. This means that the JavaScript code within the autolink can be executed by the browser, leading to an XSS attack. Version 2024.05.28 contains a patch for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-gwjh-c548-f787 - https://github.com/NuGet/NuGetGallery/pull/9836 - https://github.com/NuGet/NuGetGallery/commit/c52b023659f4ad7b626874c1063f2b5e878a4fe0
CVE ID: CVE-2024-37305 State: PUBLISHED Published: 2024-06-17T19:42:22.091Z Last Updated: 2024-08-02T03:50:56.102Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: open-quantum-safe Products: oqs-provider Problem Types: CWE-120, CWE-130, CWE-190, CWE-680, CWE-805 Description: oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODE_UINT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. Unchecked length values are lat
NT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. Unchecked length values are later used for memory reads and writes; malformed input can lead to crashes or information leakage. Handling of plain/non-hybrid PQ key operation is not affected. This issue has been patched in in v0.6.1. All users are advised to upgrade. There are no workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open-quantum-safe/oqs-provider/security/advisories/GHSA-pqvr-5cr8-v6fx - https://github.com/open-quantum-safe/oqs-provider/pull/416
CVE ID: CVE-2024-37306 State: PUBLISHED Published: 2024-06-13T14:18:28.853Z Last Updated: 2024-08-02T03:50:55.964Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: cvat-ai Products: cvat Problem Types: CWE-352 Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2.14.3, if an attacker can trick a logged-in CVAT user into visiting a malicious URL, they can initiate a dataset export or a backup from a project, task or job that the victim user has permission to export into a cloud storage that the victim user has access to. The name of the resulting
victim user has permission to export into a cloud storage that the victim user has access to. The name of the resulting file can be chosen by the attacker. This implies that the attacker can overwrite arbitrary files in any cloud storage that the victim can access and, if the attacker has read access to the cloud storage used in the attack, they can obtain media files, annotations, settings and other information from any projects, tasks or jobs that the victim has permission to export. Version 2.14.3 contains a fix for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cvat-ai/cvat/secur
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cvat-ai/cvat/security/advisories/GHSA-jpf9-646h-4px7 - https://github.com/cvat-ai/cvat/commit/5d36d10e493d92e893d7eae595544bcbe9cce1ce
CVE ID: CVE-2024-37307 State: PUBLISHED Published: 2024-06-13T16:09:22.378Z Last Updated: 2024-08-19T17:04:31.162Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: cilium Products: cilium Problem Types: CWE-200 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.0 and prior to versions 1.13.7, 1.14.12, and 1.15.6, the output of `cilium-bugtool` can contain sensitive data when the tool is run (with the `--envoy-dump` flag set) against Cilium deployments with the Envoy proxy enabled. Users of the TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka ne
proxy enabled. Users of the TLS inspection, Ingress with TLS termination, Gateway API with TLS termination, and Kafka network policies with API key filtering features are affected. The sensitive data includes the CA certificate, certificate chain, and private key used by Cilium HTTP Network Policies, and when using Ingress/Gateway API and the API keys used in Kafka-related network policy. `cilium-bugtool` is a debugging tool that is typically invoked manually and does not run during the normal operation of a Cilium cluster. This issue has been patched in Cilium v1.15.6, v1.14.12, and v1.13.17. There is no workaround to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP
14.12, and v1.13.17. There is no workaround to this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-wh78-7948-358j - https://github.com/cilium/cilium/commit/0191b1ebcfdd61cefd06da0315a0e7d504167407 - https://github.com/cilium/cilium/commit/224e288a5bf40d0bb0f16c9413693b319633431a - https://github.com/cilium/cilium/commit/9299c0fd0024e33397cffc666ff851e82af28741 - https://github.com/cilium/cilium/commit/958d7b77274bf2c272d8cdfd812631d644250653 - https://github.com/cilium/cilium/commit/9eb25ba40391a9b035d7e66401b862818f4aac4b - https://github.com/cilium/cilium/commit/bf9a1ae1b2d2b2c9cca32
m/cilium/commit/9eb25ba40391a9b035d7e66401b862818f4aac4b - https://github.com/cilium/cilium/commit/bf9a1ae1b2d2b2c9cca329d7aa96aa4858032a61
CVE ID: CVE-2024-37308 State: PUBLISHED Published: 2024-06-13T13:46:14.254Z Last Updated: 2024-08-02T03:50:56.116Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: XjSv Products: Cooked Problem Types: CWE-79 Description: The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A
ess and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/XjSv/Cooked/security/advisories/GHSA-9vfv-c966-jwrv - https://github.com/XjSv/Cooked/commit/8cf88f334ccbf11134080bbb655c66f1cfe77026
CVE ID: CVE-2024-37309 State: PUBLISHED Published: 2024-06-13T13:59:05.807Z Last Updated: 2024-08-02T03:50:56.120Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: crate Products: crate Problem Types: CWE-770 Description: CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint (port 4200) permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of security parameters during an ongoing TLS session. This flaw could lead to excessive consumption of CPU resources, resulting in potential server overload and servic
ssion. This flaw could lead to excessive consumption of CPU resources, resulting in potential server overload and service disruption. The vulnerability was confirmed using an openssl client where the command `R` initiates renegotiation, followed by the server confirming with `RENEGOTIATING`. This vulnerability allows an attacker to perform a denial of service attack by exhausting server CPU resources through repeated TLS renegotiations. This impacts the availability of services running on the affected server, posing a significant risk to operational stability and security. TLS 1.3 explicitly forbids renegotiation, since it closes a window of opportunity for an attack. Version 5.7.2 of CrateD
TLS 1.3 explicitly forbids renegotiation, since it closes a window of opportunity for an attack. Version 5.7.2 of CrateDB contains the fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/crate/crate/security/advisories/GHSA-x268-qpg6-w9g2 - https://github.com/crate/crate/commit/1dde03bdf031a20886065195527e368e4a3218b3 - https://cratedb.com/docs/crate/reference/en/latest/appendices/release-notes/5.7.2.html