aswin1906/github-advisory-2020.csv huggingface dataset:
Jupyter Server open redirect vulnerability
Advisory: GHSA-9f66-54xg-pc2c (CVE-2020-26275)
Published: 2020-12-21T18:01:41Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.

All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

Patched in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix:

```
jupyter server --ServerApp.base_url=/jupyter/
```

### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: Yaniv Nizry from CxSCA group at Checkmarx

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: jupyter-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.1
Information exposure via query strings in URL
Advisory: GHSA-cq6h-w3mc-57f4 ()
Published: 2020-12-21T18:01:16Z

### Impact

Information exposure via query strings in URL

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

### Credits
We would like to thank <a rel="noopener" href="https://www.vater-it.de/">Oliver Herrmann</a> for reporting this issue.

Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.4.1, database_specific: last_known_affected_version_range: <= 6.3.4.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.4.1, database_specific: last_known_affected_version_range: <= 6.3.4.0
Denial of service attack via incorrect parameters in Matrix Synapse
Advisory: GHSA-hxmp-pqch-c8mm (CVE-2020-26257)
Published: 2020-12-09T18:21:29Z

### Impact

A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request.

This can lead to a denial of service in which future events will not be correctly sent to other servers over federation.

This affects any server which accepts federation requests from untrusted servers.

### Patches

Issue is resolved by https://github.com/matrix-org/synapse/pull/8776.

### Workarounds

Homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: matrix-synapse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.23.1
Inappropriate implementation in V8
Advisory: GHSA-m7mf-48hp-5qmr (CVE-2020-16009)
Published: 2020-12-02T18:28:47Z

CVE-2020-16009: Inappropriate implementation in V8

- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16009

Google is aware of reports that exploits for CVE-2020-16009 exist in the wild.

Allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

There is currently little to no public information on the issue other than it has been flagged as `High` severity.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: NuGet, name: CefSharp.Common, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.Wpf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.WinForms, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.Wpf.HwndHost, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
Denial of Service in ecstatic
Advisory: GHSA-jc84-3g44-wf2q (CVE-2019-10775)
Published: 2020-12-15T16:52:17Z

ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.

Affected packages:
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.1.3
Code Injection in mquery
Advisory: GHSA-45q2-34rf-mr94 (CVE-2020-35149)
Published: 2020-12-18T18:23:43Z

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: npm, name: mquery, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.3
Parse Server stores password in plain text
Advisory: GHSA-4w46-w44m-3jq3 (CVE-2020-26288)
Published: 2020-12-28T16:33:17Z

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext.
This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: parse-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.5.0
RSA weakness in tslite-ng
Advisory: GHSA-wvcv-832q-fjg7 (CVE-2020-26263)
Published: 2020-12-21T16:56:37Z

### Impact
The code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant.
In particular, code in current (as of 0.8.0-alpha38) master
https://github.com/tlsfuzzer/tlslite-ng/blob/0812ed60860fa61a6573b2c0e18771414958f46d/tlslite/utils/rsakey.py#L407-L441
and code in 0.7.5 branch
https://github.com/tlsfuzzer/tlslite-ng/blob/acdde3161124d6ae37c506b3476aea9996d12e97/tlslite/utils/rsakey.py#L394-L425
has multiple ways in which it leaks information (for one, it aborts as soon as the plaintext doesn't start with 0x00, 0x02) about the decrypted ciphertext (both the bit length of the decrypted message as well as where the first unexpected byte lays).

All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable.

All previous versions of tlslite-ng are vulnerable.

### Patches
The patches to fix it are proposed in 
https://github.com/tlsfuzzer/tlslite-ng/pull/438
https://github.com/tlsfuzzer/tlslite-ng/pull/439

Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not be the case: https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/
As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the [security policy](https://github.com/tlsfuzzer/tlslite-ng/blob/master/SECURITY.md) of tlslite-ng.

### Workarounds
There is no way to workaround this issue.

### References
https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/

### For more information
If you have any questions or comments about this advisory please open an issue in [tlslite-ng](https://github.com/tlsfuzzer/tlslite-ng/issues).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: tlslite-ng, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.6
XSS in Vega
Advisory: GHSA-r2qc-w64x-6j54 (CVE-2020-26296)
Published: 2020-12-30T23:09:21Z

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package.
In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could
execute arbitrary javascript on a victim's machine.

This is fixed in version 5.17.3

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: vega, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.17.3
Denial of Service in i18n
Advisory: GHSA-hfvc-g252-rp4g (CVE-2020-7791)
Published: 2020-12-14T19:50:22Z

This affects the package i18n before version 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: NuGet, name: i18n, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.1.15
Disabled Hostname Verification in Opencast
Advisory: GHSA-44cw-p2hm-gpf6 (CVE-2020-26234)
Published: 2020-12-08T22:37:59Z

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests.

Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks.

### Patches

This problem is fixed in Opencast 7.9 and Opencast 8.9

### Self-Signed Certificates

Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate e.g. from [Let's Encrypt](https://letsencrypt.org).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.9
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.9
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
Advisory: GHSA-qqgx-2p2h-9c37 (CVE-2020-7788)
Published: 2020-12-10T16:53:45Z

### Overview
The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.

If an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.

### Patches

This has been patched in 1.3.6.

### Steps to reproduce

payload.ini
```
[__proto__]
polluted = "polluted"
```

poc.js:
```
var fs = require('fs')
var ini = require('ini')

var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)
```

```
> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: ini, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.6
MPXJ path Traversal vulnerability
Advisory: GHSA-p9j6-4pjr-gp48 (CVE-2020-35460)
Published: 2020-12-18T18:28:23Z

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: net.sf.mpxj:mpxj, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.3.5
Command Injection Vulnerability in systeminformation
Advisory: GHSA-m57p-p67h-mq74 (CVE-2020-26274)
Published: 2020-12-16T19:25:00Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetLatency()

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: systeminformation, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.31.1
Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability
Advisory: GHSA-hm45-mgqm-gjm4 (CVE-2020-26249)
Published: 2020-12-08T23:55:54Z

### Impact
A RCE exploit has been discovered in the Red Discord Bot - Dashboard Webserver: this exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code.  By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This high severity exploit has been fixed on version `0.1.7a`.

### Workarounds
There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue

### References
- 99d88b8
- a6b9785

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-Dashboard](https://github.com/Cog-Creators/Red-Dashboard/issues/new/choose)
* Over on the official [Red Server](https://discord.gg/red) or at the Third Party Server [Toxic Layer](https://discord.gg/vQZTdB9)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: red-dashboard, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.7a, database_specific: last_known_affected_version_range: <= 0.1.6a
CHECK-fail in LSTM with zero-length input in TensorFlow
Advisory: GHSA-m648-33qf-v3gp (CVE-2020-26270)
Published: 2020-12-10T19:07:31Z

### Impact
Running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a `CHECK` failure when using the CUDA backend.

This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer.

### Patches
We have patched the issue in GitHub commit [14755416e364f17fb1870882fa778c7fec7f16e3](https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.5
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.5
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.4
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.3
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.5
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.4
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.3
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.2
Apache Airflow logs passwords in plaintext
Advisory: GHSA-cvcq-gmc3-q6m8 (CVE-2020-17511)
Published: 2020-12-17T21:00:56Z

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. The same happenes when creating a Connection with a password field.

Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.13
Validation Bypass in schema-inspector
Advisory: GHSA-r24h-634p-m72x (CVE-2019-10781)
Published: 2020-06-10T20:02:47Z

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: schema-inspector, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.6.9
Deserialization of untrusted data in Jackson Databind
Advisory: GHSA-mc6h-4qgp-37qh (CVE-2020-14195)
Published: 2020-06-18T14:44:43Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.5, database_specific: last_known_affected_version_range: <= 2.9.10.4
Deserialization of Untrusted Data in jackson-databind
Advisory: GHSA-wrr7-33fx-rcvj ()
Published: 2020-06-15T18:44:56Z
Withdrawn: 2020-06-16T20:28:06Z

**Withdrawn:** Duplicate of GHSA-cjjf-94ff-43w7

Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.9.4, database_specific: last_known_affected_version_range: <= 2.7.9.3
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.11.2, database_specific: last_known_affected_version_range: <= 2.8.11.1
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.6
Arbitrary File Read in Snyk Broker
Advisory: GHSA-9xv2-548x-5h79 (CVE-2020-7648)
Published: 2020-06-03T22:02:19Z

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: snyk-broker, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.72.2
Denial of Service in Netty
Advisory: GHSA-mm9x-g8pc-w292 (CVE-2020-11612)
Published: 2020-06-15T19:36:16Z

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: io.netty:netty-handler, ranges: type: ECOSYSTEM, events: introduced: 4.1.0
fixed: 4.1.46
Reflected XSS when importing CSV in OctoberCMS
Advisory: GHSA-gg6x-xx78-448c (CVE-2020-5298)
Published: 2020-06-03T21:58:32Z

### Impact
A user with the ability to use the import functionality of the `ImportExportController` behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/backend, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Command Injection in Limdu
Advisory: GHSA-77qv-gh6f-pgh4 (CVE-2020-4066)
Published: 2020-06-22T15:24:06Z

### Impact
The `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

### Patches
Patched in version 0.9.5.

### Workarounds
Do not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost

### References
No

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: limdu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.9.5, database_specific: last_known_affected_version_range: <= 0.9.4
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-58pp-9c76-5625 (CVE-2020-11112)
Published: 2020-06-10T21:12:41Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Information Exposure in Snyk Broker
Advisory: GHSA-mgh5-4h95-qj4p (CVE-2020-7654)
Published: 2020-06-03T22:02:14Z

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: snyk-broker, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.73.1
Denial of service in Netty
Advisory: GHSA-9959-6p3m-wxpc (CVE-2014-3488)
Published: 2020-06-30T21:01:31Z

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

Affected packages:
package: ecosystem: Maven, name: io.netty:netty-handler, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.9.2
Timing attack on django-basic-auth-ip-whitelist
Advisory: GHSA-m38j-pmg3-v5x5 (CVE-2020-4071)
Published: 2020-06-23T19:58:27Z

### Impact

Potential timing attack exists on websites where the basic authentication is used or configured, i.e. `BASIC_AUTH_LOGIN` and `BASIC_AUTH_PASSWORD` is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located.

Sites protected by IP address whitelisting only are unaffected by this vulnerability.

### Patches
This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package.

### Workarounds
Stop using basic authentication and use the IP whitelisting component only. It can be achieved by not setting `BASIC_AUTH_LOGIN` and `BASIC_AUTH_PASSWORD` in Django project settings.

### References

- [Django mailing list discussion](https://groups.google.com/forum/#!msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue at https://github.com/tm-kn/django-basic-auth-ip-whitelist/issues
* Email us at the email specified on the [security policy](https://github.com/tm-kn/django-basic-auth-ip-whitelist/security/policy).

### Acknowledgements

Thanks to Thibaud Colas for reporting this.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: django-basic-auth-ip-whitelist, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.4
DoS via malicious record IDs in WatermelonDB
Advisory: GHSA-38f9-m297-6q9g (CVE-2020-4035)
Published: 2020-06-03T21:57:53Z

## Impact

Medium severity 5.9 https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

A maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to become unusable.

This may happen in apps that don't validate IDs (valid IDs are `/^[a-zA-Z0-9_-.]+$/`) and use Watermelon Sync or low-level `database.adapter.destroyDeletedRecords` method.

The integrity risk is low due to the fact that maliciously deleted records won't synchronize, so logout-login will restore all data, although some local changes may be lost if the malicious deletion causes the sync process to fail to proceed to push stage.

No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated, because it's not possible to nest an insert/update query inside a delete query in SQLite, and it's not possible to pass a semicolon-separated second query. There's also no known practicable way to breach confidentiality by selectively deleting records, because those records will not be synchronized.

It's theoretically possible that selective record deletion could cause an app to behave insecurely if lack of a record is used to make security decisions by the app. 

## Patches

Patched versions include:

- 0.15.1
- 0.16.2
- 0.16.1-fix
	- this is actually the same as 0.16.0, but with the patch applied - as 0.16.1 is causing issues for some users
- `924c7ae2a8d` commit id contains the patch

## Workarounds

1. Ensure that your backend service sanitizes record IDs sent in the `pull sync` endpoint, such that only IDs matching `/^[a-zA-Z0-9_-.]+$/` are returned. This could also be done in JavaScript `pullChanges` function passed to `synchronize()`
2. If you use `destroyDeletedRecords` directly, validate all IDs passed the same way

## For more information

If you have any questions about this advisory, contact @radex.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected packages:
package: ecosystem: npm, name: @nozbe/watermelondb, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.15.1
package: ecosystem: npm, name: @nozbe/watermelondb, ranges: type: ECOSYSTEM, events: introduced: 0.16.0
fixed: 0.16.2
The filename of uploaded files vulnerable to stored XSS
Advisory: GHSA-68q3-7wjp-7q3j (CVE-2020-4041)
Published: 2020-06-09T00:25:34Z

### Impact

The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. 

Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.

### Patches

This is fixed in Bolt 3.7.1.

### References

Related issue: https://github.com/bolt/bolt/pull/7853

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: bolt/bolt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.7.1
Denial of service in Apache Xerces2
Advisory: GHSA-vmqm-g3vh-847m (CVE-2012-0881)
Published: 2020-06-15T18:51:38Z

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: xerces:xercesImpl, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.12.0
Denial of Service in Spring Framework
Advisory: GHSA-ffvq-7w96-97p7 (CVE-2018-15756)
Published: 2020-06-15T19:34:50Z

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: org.springframework:spring-core, ranges: type: ECOSYSTEM, events: introduced: 5.1
fixed: 5.1.1
package: ecosystem: Maven, name: org.springframework:spring-core, ranges: type: ECOSYSTEM, events: introduced: 5.0
fixed: 5.0.10
package: ecosystem: Maven, name: org.springframework:spring-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.3.20
Uncontrolled Resource Consumption in Indy Node
Advisory: GHSA-3gw4-m5w7-v89c (CVE-2020-11090)
Published: 2020-06-11T00:04:15Z

# Summary
Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network.

# Discovery
On May 18, Evernym's monitoring of Sovrin StagingNet showed a report of StagingNet losing sufficient consensus to validate write transactions. The problem resolved itself within a few minutes. On May 20th we saw the alert multiple times, and we began analyzing the logs of our steward node. On May 21st we continued to see the alerts with increasing frequency.

It appears that someone is unknowingly sending a malformed transaction, and retrying when the transaction fails. The cause of the errors appear to be the TAA acceptance.

# Proposed actions
* Reproduce problem in integration tests and create a fix
* Do a hotfix release branching from last stable (current master have some things merged that are too risky)
* Upgrade BuilderNet, StagingNet and MainNet as soon as possible
* Improve testing strategy on Indy Node to reduce probability of such bugs

# Notes
* The journalctl logs also show an out-of-memory problem on the Australia node. We need to evaluate if this should be raised as a separate issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: indy-node, ranges: type: ECOSYSTEM, events: introduced: 1.12.2
fixed: 1.12.3, versions: 1.12.2
Arbitrary File Read in Snyk Broker
Advisory: GHSA-x7m2-6g99-84w5 (CVE-2020-7652)
Published: 2020-06-03T22:02:24Z

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: snyk-broker, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.80.0
JHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.0
Advisory: GHSA-j3rh-8vwq-wh84 (CVE-2019-16303)
Published: 2020-06-26T16:48:13Z

JHipster Kotlin is using an insecure source of randomness to generate all of its random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.

From the documentation:

> Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.
> \- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html

Here are the examples of JHipster Kotlin's use of an insecure PRNG:

https://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32

## Proof Of Concepts Already Exist

There has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.

https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd

POC Repository: https://github.com/alex91ar/randomstringutils


## Potential Impact Technical

All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.

## Potential Impact Scale

Not as large as for the original jhipster project as the kotlin blueprint is not that widely used.

### Patches

Update your generated applications to > 1.2.0

### Workarounds

Change the content of `RandomUtil.kt` like this:

```kotlin
import java.security.SecureRandom
import org.apache.commons.lang3.RandomStringUtils

private const val DEF_COUNT = 20

object RandomUtil {
    private val secureRandom: SecureRandom = SecureRandom()

    init {
        secureRandom.nextBytes(byteArrayOf(64.toByte()))
    }

    private fun generateRandomAlphanumericString(): String {
        return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)
    }

    /**
    * Generate a password.
    *
    * @return the generated password.
    */
    fun generatePassword(): String = generateRandomAlphanumericString()
}
```

Important is to exchange **every** call of `RandomStringUtils.randomAlphaNumeric`.



### For more information

If you have any questions or comments about this advisory:
* Open an issue in [JHipster Kotlin](https://github.com/jhipster/jhipster-kotlin)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: generator-jhipster-kotlin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.0
Deserialization of Untrusted Data in jackson-databind
Advisory: GHSA-w3f4-3q6j-rh82 (CVE-2018-5968)
Published: 2020-06-30T20:40:50Z

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 2.8.11
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.4
Django Rest Framework jwt allows obtaining new token from notionally invalidated token
Advisory: GHSA-fpjm-rp2g-3r4c (CVE-2020-10594)
Published: 2020-06-05T16:09:34Z

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: drf-jwt, ecosystem_specific: affected_functions: rest_framework_jwt.utils.check_payload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.1
Signature wrapping vulnerability in Spring Security
Advisory: GHSA-48rw-j489-928m (CVE-2020-5407)
Published: 2020-06-05T16:13:29Z

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.4
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 5.3.0
fixed: 5.3.2
Data leakage via cache key collision in Django
Advisory: GHSA-wpjr-j57x-wxfw (CVE-2020-13254)
Published: 2020-06-05T16:20:44Z

An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.2.13
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.7
Local File read vulnerability in OctoberCMS
Advisory: GHSA-r23f-c2j5-rx2f (CVE-2020-5295)
Published: 2020-06-03T21:58:16Z

### Impact
An attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-03-31 at 2 37 53 PM" src="https://user-images.githubusercontent.com/7253840/78072989-44b3ac80-735d-11ea-8676-09c69f0409c4.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/cms, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Potential CSV Injection vector in OctoberCMS
Advisory: GHSA-4rhm-m2fp-hx7q (CVE-2020-5299)
Published: 2020-06-03T21:58:35Z

### Impact
Any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 

1. Have found a vulnerability in the victim's spreadsheet software of choice.
2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim.
3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.

### References
Reported by @chrisvidal initially & [Sivanesh Ashok](https://stazot.com/) later.

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of the project. Thus, this has been rated low severity as it requires vulnerabilities to also exist in other software used by any potential victims as well as successful social engineering attacks.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/backend, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Arbitrary code execution in Apache Commons BeanUtils
Advisory: GHSA-p66x-2cv9-qq3v (CVE-2014-0114)
Published: 2020-06-10T23:38:01Z

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Affected packages:
package: ecosystem: Maven, name: commons-beanutils:commons-beanutils, ranges: type: ECOSYSTEM, events: introduced: 1.8.0
fixed: 1.9.2
Command Injection in umount
Advisory: GHSA-6q48-vjq2-mwcj (CVE-2020-7628)
Published: 2020-06-10T20:28:03Z

All versions of `umount ` are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `umount` function . This may allow attackers to execute arbitrary code in the system if the `device` value passed to the function is user-controlled.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: umount, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.1.6
Information disclosure in JBoss Weld
Advisory: GHSA-338v-3958-8v8r (CVE-2014-8122)
Published: 2020-06-10T20:54:15Z

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

Affected packages:
package: ecosystem: Maven, name: org.jboss.weld:weld-core-bom, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.8
Arbitrary File Read in Snyk Broker
Advisory: GHSA-4vj3-f849-5r48 (CVE-2020-7653)
Published: 2020-06-03T22:02:21Z

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: snyk-broker, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.80.0
django-nopassword stores secrets in cleartext 
Advisory: GHSA-37cf-r3w2-gjfw (CVE-2019-10682)
Published: 2020-06-05T16:09:19Z

django-nopassword before 5.0.0 stores cleartext secrets in the database.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: django-nopassword, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.0.0
Information disclosure in SSB-DB
Advisory: GHSA-mpgr-2cx9-327h (CVE-2020-4045)
Published: 2020-06-11T21:09:04Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Servers running SSB-DB 20.0.0 (which is packaged with SSB-Server 16.0.0) must upgrade immediately.

**There is no evidence that other SSB apps are vulnerable or that this problem has been exploited in the wild.**

The `get()` method is supposed to only decrypt messages when you explicitly ask it to, but there's a bug where it's decrypting any message that it can. This means that it's returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around `get()` to anonymous peers.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, please upgrade to SSB-DB 20.0.1 (or SSB-Server 16.0.1) immediately.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You may be able to disable the most obvious attack vector, SSB-OOO, by disabling the plugin, but you should upgrade immediately anyway.

### For more information

If you have any questions or comments about this advisory, open an issue in [SSB-DB](https://github.com/ssbc/ssb-db/)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: ssb-db, ranges: type: ECOSYSTEM, events: introduced: 20.0.0
fixed: 20.0.1, versions: 20.0.0