aswin1906/github-advisory-2020.csv huggingface dataset:
Possible Strong Parameters Bypass in ActionPack
Advisory: GHSA-8727-m6gj-mc37 (CVE-2020-8164)
Published: 2020-05-26T15:09:16Z

There is a strong parameters bypass vector in ActionPack.

Versions Affected:  rails <= 6.0.3
Not affected:       rails < 5.0.0
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------
In some cases user supplied information can be inadvertently leaked from
Strong Parameters.  Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters.  Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

```
def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end

def clean_up_params
   params.each { |k, v|  SomeModel.check(v) if k == :name }
end
```

Note the mistaken use of `each` in the `clean_up_params` method in the above
example.

Workarounds
-----------
Do not use the return values of `each`, `each_value`, or `each_pair` in your
application.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: RubyGems, name: actionpack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.4.3, database_specific: last_known_affected_version_range: <= 5.2.4.2
package: ecosystem: RubyGems, name: actionpack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3.1, database_specific: last_known_affected_version_range: <= 6.0.3
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-fqwf-pjwf-7vqv (CVE-2020-10673)
Published: 2020-05-15T18:59:04Z

FasterXML jackson-databind 2.x before 2.9.10.4 and 2.6.7.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.9.10.4
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.6.7.4
Insecure Deserialization in Backend User Settings in TYPO3 CMS
Advisory: GHSA-2wj9-434x-9hvp (CVE-2020-11067)
Published: 2020-05-13T23:29:04Z

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-005

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.17
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.2
Pillow Temporary file name leakage
Advisory: GHSA-r854-96gq-rfg3 (CVE-2014-1933)
Published: 2020-05-18T17:41:19Z

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Affected packages:
package: ecosystem: PyPI, name: Pillow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.1
Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.
Advisory: GHSA-h98h-8mxr-m8gx (CVE-2018-21233)
Published: 2020-05-13T16:01:35Z

TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.7.0
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
Advisory: GHSA-j7vx-8mqj-cqp9 (CVE-2020-10187)
Published: 2020-05-07T21:11:07Z

### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: RubyGems, name: doorkeeper, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.0.3
package: ecosystem: RubyGems, name: doorkeeper, ranges: type: ECOSYSTEM, events: introduced: 5.1.0
fixed: 5.1.1, versions: 5.1.0
package: ecosystem: RubyGems, name: doorkeeper, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.5
package: ecosystem: RubyGems, name: doorkeeper, ranges: type: ECOSYSTEM, events: introduced: 5.3.0
fixed: 5.3.2
Improper Validation of Certificate with Host Mismatch in Java-WebSocket
Advisory: GHSA-gw55-jm4h-x339 (CVE-2020-11050)
Published: 2020-05-08T18:54:39Z

The Java-WebSocket Client does not perform hostname verification.

 - This means that SSL certificates of other hosts are accepted as long as they are trusted. To exploit this vulnerability an attacker has to perform a man-in-the-middle (MITM) attack between a Java application using the Java-WebSocket Client and an WebSocket server it's connecting to.
 - TLS normally protects users and systems against MITM attacks, it cannot if certificates from other trusted hosts are accepted by the client.

For more information see: CWE-297: Improper Validation of Certificate with Host Mismatch - https://cwe.mitre.org/data/definitions/297.html

## Important note

The OWASP Dependency-Check (https://jeremylong.github.io/DependencyCheck/index.html) may report that a dependency of your project is affected by this security vulnerability, but you don't use this lib.
This is caused by the fuzzy search in the OWASP implementation.
Check out this issue (https://github.com/TooTallNate/Java-WebSocket/issues/1019#issuecomment-628507934) for more information and a way to suppress the warning.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.java-websocket:Java-WebSocket, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.5.0, database_specific: last_known_affected_version_range: <= 1.4.1
Backend Same-Site Request Forgery in TYPO3 CMS
Advisory: GHSA-pqg8-crx9-g8m4 (CVE-2020-11069)
Published: 2020-05-13T23:40:09Z

> ### Meta
> * CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
> * CWE-352
> * CWE-346

### Problem
It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.

In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it’s actually a same-origin request forgery.

Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.

The attacked victim requires an active and valid backend or install tool user sessions at the time of the attack to be successful.

### Solution
Update to TYPO3 versions 9.5.17 or 10.4.2 that mitigates the problem described.

### Additional Considerations

The deployment of additional mitigation techniques is suggested as described below.

#### Sudo Mode Extension

This TYPO3 extension intercepts modifications to security relevant database tables, e.g. those storing user accounts or storages of the file abstraction layer. Modifications need to confirmed by again by the acting user with providing their password again - this technique is known as "sudo mode". This way unintended actions happening in the background can be mitigated.

* https://github.com/FriendsOfTYPO3/sudo-mode
* https://extensions.typo3.org/extension/sudo_mode

#### Content Security Policy

[Content Security Policies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) tell (modern) browsers how resources served a particular site are handled - it also it possible to disallow script executions for specific locations. In a TYPO3 context it is suggested to disallow direct script execution at least for locations `/fileadmin/` and `/uploads/`.

```
# in fileadmin/.htaccess
<IfModule mod_headers.c>
	Header add Content-Security-Policy "default-src 'self'; script-src 'none';"
</IfModule>
```

### Credits
Thanks to Matteo Bonaker who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-006

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.17
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.2
Cross-Site Scripting in jquery
Advisory: GHSA-q4m3-2j7h-f7xw (CVE-2020-7656)
Published: 2020-05-20T16:18:01Z

Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `<script>` HTML tags that contain a whitespace character, i.e: `</script >`, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.9.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0
package: ecosystem: NuGet, name: jQuery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0
package: ecosystem: RubyGems, name: jquery-rails, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.0
package: ecosystem: Maven, name: org.webjars.npm:jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0
Potential Observable Timing Discrepancy in Wagtail
Advisory: GHSA-jjjr-3jcw-f8v6 (CVE-2020-11037)
Published: 2020-05-07T18:04:53Z

### Impact
A potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. (This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ).)

Privacy settings that restrict access to pages / documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.

### Patches
Patched versions have been released as Wagtail 2.7.3 (for the LTS 2.7 branch), Wagtail 2.8.2 and Wagtail 2.9.

### Workarounds
Site owners who are unable to upgrade to the new versions can use [user- or group-based privacy restrictions](https://docs.wagtail.io/en/stable/advanced_topics/privacy.html) to restrict access to sensitive information; these are unaffected by this vulnerability.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: wagtail, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.7.2
package: ecosystem: PyPI, name: wagtail, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.2
Insufficient output escaping of attachment names in PHPMailer
Advisory: GHSA-f7hx-fqxw-rvvj (CVE-2020-13625)
Published: 2020-05-27T16:37:02Z

### Impact
CWE-116: Incorrect output escaping.

An attachment added like this (note the double quote within the attachment name, which is entirely valid):

    $mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg');

Will result in a message containing these headers:

    Content-Type: application/octet-stream; name="filename.html";.jpg"
    Content-Disposition: attachment; filename="filename.html";.jpg"

The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this.

Note that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods.

### Patches
Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this:

    Content-Type: application/octet-stream; name="filename.html\";.jpg"
    Content-Disposition: attachment; filename="filename.html\";.jpg"

### Workarounds
Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`.

### References
[CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625).
[PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.6
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-p43x-xfjf-5jhr (CVE-2020-9548)
Published: 2020-05-15T18:59:01Z

FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.11.6
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.7.9.7
Code execution vulnerability in HtmlUnit
Advisory: GHSA-5mh9-r3rr-9597 (CVE-2020-5529)
Published: 2020-05-21T21:08:33Z

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: net.sourceforge.htmlunit:htmlunit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.37.0
Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka
Advisory: GHSA-6jmf-mxwf-r3jc (CVE-2019-12399)
Published: 2020-05-12T00:39:27Z

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.kafka:kafka, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.2, database_specific: last_known_affected_version_range: <= 2.0.1
package: ecosystem: Maven, name: org.apache.kafka:kafka, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2, database_specific: last_known_affected_version_range: <= 2.1.1
package: ecosystem: Maven, name: org.apache.kafka:kafka, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.2, database_specific: last_known_affected_version_range: <= 2.2.1
package: ecosystem: Maven, name: org.apache.kafka:kafka, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Improper Restriction of Excessive Authentication Attempts in Sorcery
Advisory: GHSA-jc8m-cxhj-668x (CVE-2020-11052)
Published: 2020-05-07T21:16:46Z

### Impact
Brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout.

### Patches
Patched as of version `0.15.0`.

### Workarounds
Currently no workarounds, other than monkey patching the authenticate method provided by Sorcery or upgrading to version `0.15.0`.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: RubyGems, name: sorcery, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.15.0
XSS in Apache Airflow
Advisory: GHSA-rjvg-q57v-mjjc (CVE-2019-12398)
Published: 2020-05-06T19:51:02Z

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.5
XSS in Dolibarr
Advisory: GHSA-cxvr-r92m-q9hw (CVE-2020-13094)
Published: 2020-05-21T21:08:47Z

Dolibarr before 11.0.4 allows XSS.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: dolibarr/dolibarr, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.0.4
False-negative validation results in MINT transactions with invalid baton
Advisory: GHSA-4w97-57v2-3w44 (CVE-2020-11072)
Published: 2020-05-12T00:45:24Z

### Impact
Users could experience false-negative validation outcomes for [MINT](https://github.com/simpleledger/slp-specifications/blob/master/slp-token-type-1.md#mint---extended-minting-transaction) transaction operations.  A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

### Patches
npm package [slp-validate](https://www.npmjs.com/package/slp-validate) has been patched and published as version 1.2.1.

### Workarounds
Upgrade to slp-validate 1.2.1.

### References
* slp-validate [commit](https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [slp-validate](https://github.com/simpleledger/slp-validate/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: slp-validate, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.1
Exposure of Sensitive Information to an Unauthorized Actor in AEgir
Advisory: GHSA-qfcv-5whw-7pcw (CVE-2020-11059)
Published: 2020-05-27T21:09:15Z

### Impact
`aegir publish` and `aegir build` may leak secrets from environmental variables in the browser bundle published to npm.

### Patches
The code has been patched, users should upgrade to >= 21.10.1

### Workarounds
Run `printenv` to check your environment variables and revoke any secrets.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [aegir](https://github.com/ipfs/aegir)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: aegir, ranges: type: ECOSYSTEM, events: introduced: 21.7.0
fixed: 21.10.1
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Advisory: GHSA-2p68-f74v-9wc6 (CVE-2020-8165)
Published: 2020-05-26T14:49:24Z

In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

```
data = cache.fetch("demo", raw: true) { untrusted_string }
```
Versions Affected:  rails < 5.2.5, rails < 6.0.4
Not affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
  
Impact
------
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds
-----------
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the `raw` argument should be double-checked to ensure that they conform to the expected format.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: activesupport, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.4.3, database_specific: last_known_affected_version_range: <= 5.2.4.2
package: ecosystem: RubyGems, name: activesupport, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3.1, database_specific: last_known_affected_version_range: <= 6.0.3
Improper Verification of Cryptographic Signature in PySAML2
Advisory: GHSA-qf7v-8hj3-4xw7 (CVE-2020-5390)
Published: 2020-05-06T19:41:29Z

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertions that have been signed.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: pysaml2, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.0.0
Cross-Site Scripting in TYPO3 CMS Link Handling
Advisory: GHSA-4j77-gg36-9864 (CVE-2020-11065)
Published: 2020-05-13T23:18:12Z

It has been discovered that link tags generated by `typolink` functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-003

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.5.12
fixed: 9.5.17
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.2.0
fixed: 10.4.2
Command Injection in hot-formula-parser
Advisory: GHSA-rc77-xxq6-4mff (CVE-2020-6836)
Published: 2020-05-06T19:32:33Z

Versions of `hot-formula-parser` prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the  `parse` function and concatenates it in an `eval` call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands in the server.  
Parsing the following formula creates a `test` file in the present directory:  
`"SUM([(function(){require('child_process').execSync('touch test')})(),2])"`


## Recommendation

Upgrade to version 3.0.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: hot-formula-parser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.1
curlrequest allows execution of arbitrary commands
Advisory: GHSA-m8xj-5v73-3hh8 (CVE-2020-7646)
Published: 2020-05-13T16:29:43Z

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the `options` values.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: curlrequest, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.0.1
XSS in TinyMCE
Advisory: GHSA-c78w-2gw7-gjv3 (CVE-2019-1010091)
Published: 2020-05-11T20:00:15Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in: the core parser and `media` plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.9 or lower and TinyMCE 5.2.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.10 and 5.2.2 by improved HTML parsing and sanitization logic.

### Workarounds
The workarounds available are:
- disable the media plugin and manually sanitize CDATA content (see below)
or
- upgrade to either TinyMCE 4.9.10 or TinyMCE 5.2.2

#### Example: Manually strip CDATA elements
```js
setup: function(editor) {
  editor.on('PreInit', function() {
    editor.parser.addNodeFilter('#cdata', function(nodes) {
      for (var i = 0; i < nodes.length; i++) {
        nodes[i].remove();
      }
    });
  });
}
```

### Acknowledgements
Tiny Technologies would like to thank Michał Bentkowski and [intivesec](https://github.com/intivesec) for discovering these vulnerabilities.

### References
https://www.tiny.cloud/docs/release-notes/release-notes522/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

Affected packages:
package: ecosystem: npm, name: tinymce, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.9.10
package: ecosystem: npm, name: tinymce, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.2
Apache Camel Netty enables Java deserialization by default
Advisory: GHSA-h79p-32mx-fjj9 (CVE-2020-11973)
Published: 2020-05-21T21:09:04Z

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.camel:camel-netty, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.2.0
Class destructors causing side-effects when being unserialized in TYPO3 CMS
Advisory: GHSA-2rxh-h6h9-qrqc (CVE-2020-11066)
Published: 2020-05-13T23:18:38Z

Calling unserialize() on malicious user-submitted content can result in the following scenarios:
- trigger deletion of arbitrary directory in file system (if writable for web server)
- trigger message submission via email using identity of web site (mail relay)

Another insecure deserialization vulnerability is required to actually exploit mentioned aspects.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-004

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.17
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.2
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-27xj-rqx5-2255 (CVE-2020-11619)
Published: 2020-05-15T18:58:44Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Command injection in node-dns-sync
Advisory: GHSA-wh69-wc6q-7888 (CVE-2020-11079)
Published: 2020-05-28T18:42:59Z

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: dns-sync, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.1
Circumvention of file size limits in ActiveStorage
Advisory: GHSA-m42x-37p3-fv5w (CVE-2020-8162)
Published: 2020-05-26T15:09:48Z

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user.

Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: activestorage, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.4.3, database_specific: last_known_affected_version_range: <= 5.2.4.2
package: ecosystem: RubyGems, name: activestorage, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3.1, database_specific: last_known_affected_version_range: <= 6.0.3
Polymorphic deserialization of malicious object in jackson-databind
Advisory: GHSA-qmqc-x3r4-6v39 (CVE-2019-14893)
Published: 2020-05-15T18:59:07Z

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10
False-negative validation results in MINT transactions with invalid baton
Advisory: GHSA-jc83-cpf9-q7c6 (CVE-2020-11071)
Published: 2020-05-12T00:39:03Z

### Impact
Users could experience false-negative validation outcomes for [MINT](https://github.com/simpleledger/slp-specifications/blob/master/slp-token-type-1.md#mint---extended-minting-transaction) transaction operations.  A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

### Patches
npm package [slpjs](https://www.npmjs.com/package/slpjs) has been patched and published as version 0.27.2.


### Workarounds
Upgrade to slpjs 0.27.2.

### References
* slpjs [commit](https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [slp-validate](https://github.com/simpleledger/slp-validate/issues) or [slpjs](https://github.com/simpleledger/slpjs/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: slpjs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.27.2
Information Disclosure in Password Reset
Advisory: GHSA-347x-877p-hcwx (CVE-2020-11063)
Published: 2020-05-13T22:19:21Z

In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts.

This has been fixed in 10.4.2.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-001

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.4.0
fixed: 10.4.2, database_specific: last_known_affected_version_range: <= 10.4.1
Cross-Site Scripting in SVG Sanitizer
Advisory: GHSA-59cf-m7v5-wh5w (CVE-2020-11070)
Published: 2020-05-13T22:17:34Z

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting.

An updated version 1.0.3 is available from the TYPo3 extension manager and at https://extensions.typo3.org/extension/download/svg_sanitizer/1.0.3/zip/
Users of the extension are advised to update the extension as soon as possible.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: t3g/svg-sanitizer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.3
Polymorphic deserialization of malicious object in jackson-databind
Advisory: GHSA-cf6r-3wgc-h863 (CVE-2019-14892)
Published: 2020-05-15T18:58:58Z

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5, and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.7.3, database_specific: last_known_affected_version_range: <= 2.6.7.2
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.8.11.5, database_specific: last_known_affected_version_range: <= 2.8.11.4
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10
Potential Code Injection in Sprout Forms
Advisory: GHSA-px8v-hxxx-2rgh (CVE-2020-11056)
Published: 2020-05-08T21:00:02Z

### Impact

A potential Server-Side Template Injection vulnerability exists in Sprout Forms which could lead to the execution of Twig code.

### Patches

The problem is fixed in`barrelstrength/sprout-forms:v3.9.0` which upgrades to `barrelstrength/sprout-base-email:v1.2.7`

### Workarounds

Users unable to upgrade should update any Notification Emails to use the "Basic Notification (Sprout Email)" template and avoid using the "Basic Notification (Sprout Forms)" template or any custom templates that display Form Fields.

### References

- See the release notes in the [CHANGELOG](https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical)
- Credits to Paweł Hałdrzyński, Daniel Kalinowski from [ISEC.PL](https://isec.pl/) for discovery and responsible disclosure

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Sprout Forms repo](https://github.com/barrelstrength/craft-sprout-forms/issues)
* Email us at [sprout@barrelstrengthdesign.com](mailto:sprout@barrelstrengthdesign.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: Packagist, name: barrelstrength/sprout-base-email, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.7
package: ecosystem: Packagist, name: barrelstrength/sprout-forms, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.9.0
Private key leak in Apache CXF
Advisory: GHSA-42f2-f9vc-6365 (CVE-2019-12423)
Published: 2020-05-22T19:23:04Z

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter `rs.security.keystore.type` to `jwk`. For this case all keys are returned in this file &quot;as is&quot;, including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. `oct` keys, which contain secret keys, are not returned at all.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.cxf:apache-cxf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.12
package: ecosystem: Maven, name: org.apache.cxf:apache-cxf, ranges: type: ECOSYSTEM, events: introduced: 3.3.0
fixed: 3.3.5
package: ecosystem: Maven, name: org.apache.cxf:cxf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.12
package: ecosystem: Maven, name: org.apache.cxf:cxf, ranges: type: ECOSYSTEM, events: introduced: 3.3.0
fixed: 3.3.5
Cross-Site Scripting in BookStack
Advisory: GHSA-5vf7-q87h-pg6w (CVE-2020-11055)
Published: 2020-05-07T21:10:26Z

### Impact

A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines.

This most impacts scenarios where not-trusted users are given permission to create comments.

### Patches

The issue was addressed in BookStack v0.29.2.

After upgrading, The command `php artisan bookstack:regenerate-comment-content` should be ran to remove any pre-existing dangerous content. 

### Workarounds

Comments can be disabled in the system settings to prevent them being shown to users. Alternatively, comment creation permissions can be altered as required to only those who are trusted but this will not address existing exploitation of this vulnerability. 

### References

* [BookStack Beta v0.29.2](https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2)
* JVN#41035278
* [BookStack Blog Post](https://bookstackapp.com/blog/beta-release-v0-29-2/)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the BookStack GitHub repository](BookStackApp/BookStack/issues).
* Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).
* Follow the [BookStack Security Advice](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: Packagist, name: ssddanbrown/bookstack, ranges: type: ECOSYSTEM, events: introduced: 0.18.0
fixed: 0.29.2
Cross-Site Scripting in TYPO3 CMS Form Engine
Advisory: GHSA-43gj-mj2w-wh46 (CVE-2020-11064)
Published: 2020-05-13T23:17:48Z

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML `placeholder` attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-002

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.17
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.2
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-9vvp-fxw6-jcxr (CVE-2020-11113)
Published: 2020-05-15T18:58:47Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Arbitrary file write in actionpack-page_caching gem
Advisory: GHSA-mg5p-95m9-rmfp (CVE-2020-8159)
Published: 2020-05-13T16:28:46Z

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: actionpack-page_caching, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.1
Potential remote code execution in Apache Tomcat
Advisory: GHSA-344f-f5vg-2jfj (CVE-2020-9484)
Published: 2020-05-21T18:52:29Z

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.tomcat:tomcat-catalina, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 10.0.0-M1
fixed: 10.0.0-M5, database_specific: last_known_affected_version_range: <= 10.0.0-M4
package: ecosystem: Maven, name: org.apache.tomcat:tomcat-catalina, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.0.35
package: ecosystem: Maven, name: org.apache.tomcat:tomcat-catalina, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.5.55
package: ecosystem: Maven, name: org.apache.tomcat:tomcat-catalina, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.0.104