aswin1906/github-advisory-2020.csv huggingface dataset:
Exploitable inventory component chaining in PocketMine-MP
Advisory: GHSA-8jq6-w5cg-wm45 ()
Published: 2020-11-11T21:38:18Z

### Impact
Specially crafted `InventoryTransactionPacket`s sent by malicious clients were able to exploit the behaviour of `InventoryTransaction->findResultItem()` and cause it to take an abnormally long time to execute (causing an apparent server freeze).

The affected code is intended to compact conflicting `InventoryActions` which are in the same `InventoryTransaction` by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential.

The problem was fixed by bailing when ambiguities are detected.

**At the time of writing, this exploit is being used in the wild by attackers to deny service to servers.**

### Patches
Upgrade to 3.15.4 or newer.

### Workarounds
No practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to `DataPacketReceiveEvent`.

### References
c368ebb5e74632bc622534b37cd1447b97281e20

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)

Affected packages:
package: ecosystem: Packagist, name: pocketmine/pocketmine-mp, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.15.4
malicious SVG attachment causing stored XSS vulnerability
Advisory: GHSA-4q96-6xhq-ff43 (CVE-2020-15275)
Published: 2020-11-11T15:54:41Z

### Impact
An attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.

### Patches
Users are strongly advised to upgrade to a patched version.

MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

### Workarounds
It is not advised to work around this, but to upgrade MoinMoin to a patched version.

That said, a work around via a Content Security Policy in the web server might be possible.

Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.

### For more information
If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).

### Credits

This vulnerability was discovered by:

Catarina Leite from the Checkmarx SCA AppSec team

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: moin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.11
Prototype Pollution in systeminformation
Advisory: GHSA-4v2w-h9jm-mqjg (CVE-2020-26245)
Published: 2020-11-27T16:07:15Z

### Impact
command injection vulnerability by prototype pollution

### Patches
Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected packages:
package: ecosystem: npm, name: systeminformation, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.30.5
Arbitrary File Read in phantom-html-to-pdf
Advisory: GHSA-6h7f-qwqm-35pp (CVE-2020-7763)
Published: 2020-11-06T18:06:16Z

This affects the package phantom-html-to-pdf before 0.6.1.

### PoC
```js
var fs = require('fs') var conversion = require("phantom-html-to-pdf")();
conversion.allowLocalFilesAccess = false conversion({
    html: "document.write(window.location='c:/windows/win.ini')"
}, function(err, pdf) {
    var output = fs.createWriteStream('output.pdf') console.log(pdf.logs);
    console.log(pdf.numberOfPages);
    pdf.stream.pipe(output);
});
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: phantom-html-to-pdf, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.2, database_specific: last_known_affected_version_range: < 0.6.1
Persistent XSS in customer module in Shopware
Advisory: GHSA-6gv9-7q4g-pmvm ()
Published: 2020-11-13T15:47:36Z

### Impact
Persistent XSS in customer  module

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/shopware, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.6.9
Stored XSS by authenticated backend user with access to upload files
Advisory: GHSA-fx3v-553x-3c4q (CVE-2020-15249)
Published: 2020-11-23T19:47:59Z

### Impact
Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed.

### Patches
Issue has been patched in Build 469 (v1.0.469) & v1.1.0.

### Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0.

### References
Reported by [Hoan Hoang](https://github.com/hoanhp)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1107" alt="Screen Shot 2020-10-10 at 1 47 49 PM" src="https://user-images.githubusercontent.com/7253840/95663787-378f2b80-0aff-11eb-8dfc-b97d162939da.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/backend, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.469
Cross-Site Scripting in scratch-svg-renderer
Advisory: GHSA-j977-g5vj-j27g (CVE-2020-7750)
Published: 2020-11-09T14:21:17Z

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: scratch-svg-renderer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.0-prerelease.20201019174008, database_specific: last_known_affected_version_range: <= 0.2.0-prerelease.20201016121710
Denial of service attack due to invalid JSON
Advisory: GHSA-4mp3-385r-v63f (CVE-2020-26890)
Published: 2020-11-24T22:58:58Z

### Impact
A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state.

### Patches
At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks.

### Workarounds
There are no known workarounds.

### Upgrading notes
If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.

Affected packages:
package: ecosystem: PyPI, name: matrix-synapse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.20.0
Persistent XSS in newsletter module in Shopware
Advisory: GHSA-hrfh-fp4x-crrq ()
Published: 2020-11-13T18:26:06Z

### Impact
Persistent XSS in newsletter module

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/shopware, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.6.9
XML External Entity in Dashboard Widget
Advisory: GHSA-q9cp-mc96-m4w2 (CVE-2020-26229)
Published: 2020-11-23T21:18:44Z

### Problem
It has been discovered that RSS widgets are susceptible to XML external entity processing.
This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions.

At least with _libxml2_ version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed.

### Solution
Update to TYPO3 version 10.4.10 that fixes the problem described.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.4.0
fixed: 10.4.10
Use after free in CefSharp
Advisory: GHSA-gvqv-779r-4jgp (CVE-2020-16017)
Published: 2020-11-27T20:13:05Z

CVE-2020-16017: Use after free in site isolation

- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16017

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as `High` severity.

Affected packages:
package: ecosystem: NuGet, name: CefSharp.Common, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.Wpf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.WinForms, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.Wpf.HwndHost, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
Local File Inclusion by unauthenticated users
Advisory: GHSA-xwjr-6fj7-fc6h (CVE-2020-15246)
Published: 2020-11-23T19:48:12Z

### Impact
An attacker can exploit this vulnerability to read local files on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request.

### Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

### Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1105" alt="Screen Shot 2020-10-10 at 1 05 19 PM" src="https://user-images.githubusercontent.com/7253840/95663086-4ffc4780-0af9-11eb-9bb6-fd40cf11c033.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: october/cms, ranges: type: ECOSYSTEM, events: introduced: 1.0.421
fixed: 1.0.469
Segfault in `tf.quantization.quantize_and_dequantize`
Advisory: GHSA-rrfp-j2mp-hq9c (CVE-2020-15265)
Published: 2020-11-13T17:13:04Z

### Impact
An attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`:

```python
tf.quantization.quantize_and_dequantize(
    input=[2.5, 2.5], input_min=[0,0], input_max=[1,1], axis=10)
```

This results in accessing [a dimension outside the rank of the input tensor](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc19b87a02a2faaad9a53bc17/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L74) in the C++ kernel implementation:
```
const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
```

However, [`dim_size` only does a `DCHECK`](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc19b87a02a2faaad9a53bc17/tensorflow/core/framework/tensor_shape.cc#L292-L307) to validate the argument and then uses it to access the corresponding element of an array:
```
int64 TensorShapeBase<Shape>::dim_size(int d) const {
  DCHECK_GE(d, 0);
  DCHECK_LT(d, dims());
  DoStuffWith(dims_[d]);
}
```

Since in normal builds, `DCHECK`-like macros are no-ops, this results in segfault and access out of bounds of the array.

### Patches

We have patched the issue in eccb7ec454e6617738554a255d77f08e60ee0808 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in #42105

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
Cleartext storage of session identifier
Advisory: GHSA-954j-f27r-cj52 (CVE-2020-26228)
Published: 2020-11-23T21:18:36Z

User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.

### Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Helmut Hummel who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader as well as TYPO3 contributor Markus Klein who fixed the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.23
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.10
Inappropriate implementation in V8 in CefSharp
Advisory: GHSA-x7fx-mcc9-27j7 (CVE-2020-16013)
Published: 2020-11-27T20:12:55Z

High CVE-2020-16013: Inappropriate implementation in V8. 

- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16013

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as `High` severity.

Affected packages:
package: ecosystem: NuGet, name: CefSharp.Common, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.Wpf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.WinForms, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
package: ecosystem: NuGet, name: CefSharp.Wpf.HwndHost, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 86.0.241
Privilege escalation by backend users assigned to the default "Publisher" system role
Advisory: GHSA-rfjc-xrmf-5vvw (CVE-2020-15248)
Published: 2020-11-23T19:47:27Z

### Impact
Backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. 

### Patches
Issue has been patched in Build 470 (v1.0.470) & v1.1.1.

### Workarounds
Apply https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 to your installation manually if unable to upgrade to Build 470 or v1.1.1.

### References
Reported by [Hoan Hoang](https://github.com/hoanhp)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1098" alt="Screen Shot 2020-10-10 at 1 37 25 PM" src="https://user-images.githubusercontent.com/7253840/95663611-e6326c80-0afd-11eb-8a1e-8b767a7202fb.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: Packagist, name: october/backend, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.470
Reflected XSS with parameters in PostComment
Advisory: GHSA-58w4-w77w-qv3w (CVE-2020-26225)
Published: 2020-11-16T21:23:29Z

### Impact
An attacker could inject malicious web code into the users' web browsers by creating a malicious link.

### Patches
The problem is fixed in 4.2.0

### References
[Cross-site Scripting (XSS) - Reflected (CWE-79) ](https://cwe.mitre.org/data/definitions/79.html)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: prestashop/productcomments, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.2.0
Prototype Pollution in highlight.js
Advisory: GHSA-vfrc-7r7c-w9mx (CVE-2020-26237)
Published: 2020-11-24T22:58:41Z

### Impact

Affected versions of this package are vulnerable to Prototype Pollution.  A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.  If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. 

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. 

_If your website or application does not render user provided data it should be unaffected._

### Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability.  If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

### Workarounds

#### Patch your library

Manually patch your library to create null objects for both `languages` and `aliases`:

```js
const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);
```

#### Filter out bad data from end users:

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

### References

* [What is Prototype Pollution?](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)
* https://github.com/highlightjs/highlight.js/pull/2636

### For more information

If you have any questions or comments about this advisory:

* Please file an issue against [highlight.js](https://github.com/highlightjs/highlight.js/issues/)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: highlight.js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 9.18.2
package: ecosystem: npm, name: highlight.js, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.1.2
Open redirect in Jupyter Server
Advisory: GHSA-grfj-wjv9-4f9v (CVE-2020-26232)
Published: 2020-11-24T21:20:52Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.

All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.

This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh

### Patches

_Has the problem been patched? What versions should users upgrade to?_

jupyter_server 1.0.6

### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: zhuonan li of Alibaba Application Security Team

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: jupyter-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.6
Float cast overflow undefined behavior
Advisory: GHSA-xwhf-g6j5-j5gc (CVE-2020-15266)
Published: 2020-11-13T17:18:29Z

### Impact
When the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault.

### Patches

We have patched the issue in c0319231333f0f16e1cc75ec83660b01fedd4182 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in #42129

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
Secret disclosure when containing characters that become URI encoded
Advisory: GHSA-r2j6-p67h-q639 (CVE-2020-26226)
Published: 2020-11-18T21:19:14Z

### Impact

Secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL.

### Patches

Fixed in v17.2.3

### Workarounds

Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: semantic-release, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 17.2.3, database_specific: last_known_affected_version_range: <= 17.2.2
LDAP authentication bypass with empty password
Advisory: GHSA-5hmm-x8q8-w5jh (CVE-2020-26214)
Published: 2020-11-06T17:35:49Z

### Impact
Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider.

Only deployments where LDAP servers are configured to allow unauthenticated binds (eg. default on Active Directory) are affected.

### Patches
A fix has been implemented that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. See https://github.com/alerta/alerta/pull/1345

### Workarounds
LDAP administrators can disallow unauthenticated bind requests by clients.

### References
https://tools.ietf.org/html/rfc4513#section-5.1.2
https://pypi.org/project/alerta-server/8.1.0/

### For more information
If you have any questions or comments about this advisory:
* Add a comment to the issue [#1277](https://github.com/alerta/alerta/issues/1277)
* Email us at [admin@alerta.dev](mailto:admin@alerta.dev)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: alerta-server, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.1.0
package: ecosystem: PyPI, name: alerta-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.5.7
Edit feed settings  and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
Advisory: GHSA-wpww-4jf4-4hx8 (CVE-2020-15273)
Published: 2020-11-04T21:08:38Z

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit feed settings, Edit widget area, Sub site new registration, New category registration
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: baserproject/basercms, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.1
Prototype Pollution in json-logic-js
Advisory: GHSA-m9hw-7xfv-wqg7 ()
Published: 2020-11-12T19:36:14Z

Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Code Execution.

The following rule creates a popup when run from a browser:
```
{
  "method": [
    {
      "method": [
        {
          "var": "__proto__.constructor.is.__proto__"
        },
        "constructor",
        [
          "var x = 'SECURITY!'; console.log(x, window.fetch); alert(x)"
        ]
      ]
    },
    "call"
  ]
}
```

Affected packages:
package: ecosystem: npm, name: json-logic-js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Remote Code Execution in Apache Synapse
Advisory: GHSA-p694-23q3-rvrc (CVE-2017-15708)
Published: 2020-11-04T18:23:25Z

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.synapse:synapse-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.1
Web Cache Poisoning in find-my-way
Advisory: GHSA-jgrh-5m3h-9c5f (CVE-2020-7764)
Published: 2020-11-09T22:17:13Z

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: find-my-way, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.5
package: ecosystem: npm, name: find-my-way, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.5
Regression in JWT Signature Validation
Advisory: GHSA-58r4-h6v8-jcvm (CVE-2020-15240)
Published: 2020-11-03T02:31:38Z

### Overview
Versions after and including `2.3.0` are improperly validating the JWT token signature when using the `JWTValidator.verify` method.  Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and authorization.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using `omniauth-auth0`.
- You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow.

### How to fix that?
Upgrade to version `2.4.1`.

### Will this update impact my users?
The fix provided in this version will not affect your users.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: omniauth-auth0, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.4.1
Authorization bypass in Spree
Advisory: GHSA-m2jr-hmc3-qmpr (CVE-2020-26223)
Published: 2020-11-13T17:18:22Z

### Impact
The perpetrator could query the [API v2 Order Status](https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint with an empty string passed as an Order token

### Patches
Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

### References
Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: RubyGems, name: spree_api, ranges: type: ECOSYSTEM, events: introduced: 3.7.0
fixed: 3.7.13
package: ecosystem: RubyGems, name: spree_api, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.0.5
package: ecosystem: RubyGems, name: spree_api, ranges: type: ECOSYSTEM, events: introduced: 4.1.0
fixed: 4.1.12
Open redirect in Jupyter Notebook
Advisory: GHSA-c7vm-f5p4-8fqh (CVE-2020-26215)
Published: 2020-11-18T21:06:36Z

[localhost](http://localhost:8888)

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a notebook server could redirect the browser to a different website.

All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

Patched in notebook 6.1.5


### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: zhuonan li of Alibaba Application Security Team

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
Affected packages:
package: ecosystem: PyPI, name: notebook, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.5, database_specific: last_known_affected_version_range: <= 6.1.4
Incorrect Provision of Specified Functionality in qutebrowser
Advisory: GHSA-4rcq-jv2f-898j (CVE-2020-11054)
Published: 2020-05-08T19:05:05Z

# Description

After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (`colors.statusbar.url.warn.fg`). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (`colors.statusbar.url.success_https`). While the user already has seen a certificate error prompt at this point (or set `content.ssl_strict` to `false` which is not recommended), this could still provide a false sense of security.

# Affected versions and patches

All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested.

The issue is fixed in qutebrowser v1.11.1 (pending release) and v1.12.0 (unreleased). Backported patches for older versions are available, but no further releases are planned.

# Mitigation

If you are unable to upgrade:

- Treat any host with a certificate exception as insecure, ignoring the URL color
- Or set `content.ssl_strict` to `True` (instead of `'ask'`), preventing certificate exceptions

# References

- qutebrowser issue: https://github.com/qutebrowser/qutebrowser/issues/5403
- Fix (master branch): https://github.com/qutebrowser/qutebrowser/commit/021ab572a319ca3db5907a33a59774f502b3b975
- Related issue for KDE Falkon: https://bugs.kde.org/show_bug.cgi?id=420902
- Related issue for eric6 Web Browser: https://tracker.die-offenbachs.homelinux.org/eric/issue328 (fixed in eric6 20.6)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: qutebrowser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.1
path traversal in Jooby
Advisory: GHSA-px9h-x66r-8mpc (CVE-2020-7647)
Published: 2020-05-13T16:29:26Z

### Impact
Access to sensitive information available from classpath. 

### Patches
Patched version: 1.6.7 and 2.8.2

Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References

Latest 1.x version: 1.6.6

#### Arbitrary class path resource access 1
When sharing a *File System* directory as in:

``` java
assets("/static/**", Paths.get("static"));
```

The class path is also searched for the file (`org.jooby.handlers.AssetHandler.loader`):
[jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub](https://github.com/jooby-project/jooby/blob/1.x/jooby/src/main/java/org/jooby/handlers/AssetHandler.java)

``` java
  private static Loader loader(final Path basedir, final ClassLoader classloader) {
    if (Files.exists(basedir)) {
      return name -> {
        Path path = basedir.resolve(name).normalize();
        if (Files.exists(path) && path.startsWith(basedir)) {
          try {
            return path.toUri().toURL();
          } catch (MalformedURLException x) {
            // shh
          }
        }
        return classloader.getResource(name);
      };
    }
    return classloader::getResource;
  }
```

If we send `/static/WEB-INF/web.xml` it will fail to load it from the file system but will go into `classloader.getResource(name)` where name equals `/WEB-INF/web.xml` so will succeed and return the requested file. This way we can get any configuration file or even the application class files

If assets are configured for a certain extension we can still bypass it. eg:

```java
assets("/static/**/*.js", Paths.get("static"));
```

We can send:

```
http://localhost:8080/static/io/yiss/App.class.js
```

#### Arbitrary class path resource access 2
This vulnerability also affects assets configured to access resources from the root of the class path. eg:

```java
assets("/static/**");
```

In this case we can traverse `static` by sending:

```
http://localhost:8080/static/..%252fio/yiss/App.class
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jooby](https://github.com/jooby-project/jooby/issues)
* Email us at [support@jooby.io](mailto:support@jooby.io)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: io.jooby:jooby, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.2
package: ecosystem: Maven, name: org.jooby:jooby, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.2
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-v3xw-c963-f5hc (CVE-2020-11111)
Published: 2020-05-15T18:58:50Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Remote code execution in Apache Commons Configuration
Advisory: GHSA-7qx4-pp76-vrqh (CVE-2020-1953)
Published: 2020-05-21T19:08:08Z

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.commons:commons-configuration2, ranges: type: ECOSYSTEM, events: introduced: 2.2
fixed: 2.7
HTTP Smuggling via Transfer-Encoding Header in Puma
Advisory: GHSA-w64w-qqph-5gxm (CVE-2020-11077)
Published: 2020-05-22T14:55:09Z

### Impact
This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. 

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.12.6
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.5
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-rf6r-2c4q-2vwg (CVE-2020-10968)
Published: 2020-05-15T18:58:54Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Apache ActiveMQ webconsole admin GUI is open to XSS
Advisory: GHSA-cc94-3v9c-7rm8 (CVE-2020-1941)
Published: 2020-05-21T21:08:56Z

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.activemq:activemq-web-console, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.15.12
CRLF injection in httplib2
Advisory: GHSA-gg84-qgv9-w4pq (CVE-2020-11078)
Published: 2020-05-20T15:55:47Z

### Impact
Attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.

Impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.

### Patches
Problem has been fixed in 0.18.0
Space, CR, LF characters are now quoted before any use.
This solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.

### Workarounds
Create URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.

```diff
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
-uri = "https://api.server/?q={}".format(user_input)
+uri = urllib.parse.urlunsplit(("https", "api.server", "/v1", urllib.parse.urlencode({"q": user_input}), ""))
http.request(uri)
```

### References
https://cwe.mitre.org/data/definitions/93.html
https://docs.python.org/3/library/urllib.parse.html

Thanks to Recar https://github.com/Ciyfly for finding vulnerability and discrete notification.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)
* Email [current maintainer at 2020-05](mailto:temotor@gmail.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: httplib2, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.18.0
HTTP Smuggling via Transfer-Encoding Header in Puma
Advisory: GHSA-x7jg-6pwg-fx5h (CVE-2020-11076)
Published: 2020-05-22T14:55:05Z

### Impact

By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

Originally reported by @ZeddYu, who has our thanks for the detailed report.

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.12.5
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.4
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-q93h-jc49-78gg (CVE-2020-9547)
Published: 2020-05-15T18:59:10Z

FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` (aka `ibatis-sqlmap`).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.11.6
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.7.9.7
Cross-Site Scripting in Kaminari
Advisory: GHSA-r5jw-62xg-j433 (CVE-2020-11082)
Published: 2020-05-28T21:10:11Z

### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.

### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.

```ruby
module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```

### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Affected packages:
package: ecosystem: RubyGems, name: kaminari, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.1
Improper Certificate Validation in Apache Beam
Advisory: GHSA-2m7g-9q74-9m3q (CVE-2020-1929)
Published: 2020-05-06T20:49:04Z

The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.beam:beam-sdks-java-io-mongodb, ranges: type: ECOSYSTEM, events: introduced: 2.10.0
fixed: 2.17.0, database_specific: last_known_affected_version_range: <= 2.16.0
Ability to forge per-form CSRF tokens in Rails
Advisory: GHSA-jp5v-5gx4-jmj9 (CVE-2020-8166)
Published: 2020-05-26T15:11:13Z

It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.

Impact
------

Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: actionpack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.4.3, database_specific: last_known_affected_version_range: <= 5.2.4.2
package: ecosystem: RubyGems, name: actionpack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3.1, database_specific: last_known_affected_version_range: <= 6.0.3
Information disclosure issue in Active Resource
Advisory: GHSA-46j2-xjgp-jrfm (CVE-2020-8151)
Published: 2020-05-21T21:09:38Z

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: RubyGems, name: activeresource, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.1.1