aswin1906/github-advisory-2020.csv huggingface dataset:
Information Exposure in Netty
Advisory: GHSA-xfv3-rrfm-f2rv (CVE-2015-2156)
Published: 2020-06-30T21:01:21Z

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: io.netty:netty-parent, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.0.28.Final
package: ecosystem: Maven, name: org.jboss.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.9.8.Final
package: ecosystem: Maven, name: org.jboss.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 3.10.0
fixed: 3.10.3.Final
package: ecosystem: Maven, name: io.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 3.10.0
fixed: 3.10.3.Final
package: ecosystem: Maven, name: io.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.9.8.Final
Deserialization of untrusted data in Jackson Databind
Advisory: GHSA-c265-37vj-cwcc (CVE-2020-14062)
Published: 2020-06-18T14:44:48Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.5, database_specific: last_known_affected_version_range: <= 2.9.10.4
RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
Advisory: GHSA-q3gh-5r98-j4h3 (CVE-2020-14968)
Published: 2020-06-26T16:26:50Z

### Impact
Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value with prepending zeros as a valid signature.

- If you are not use RSA-PSS signature validation, this vulnerability is not affected. 
- Risk to accept a forged or crafted message to be signed is low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.

### Patches
Users using RSA-PSS signature validation should upgrade to 8.0.17.

### Workarounds
Reject RSA-PSS signatures with unnecessary prepending zeros.

### References
https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3
[https://github.com/kjur/jsrsasign/issues/438](https://github.com/kjur/jsrsasign/issues/438)
https://nvd.nist.gov/vuln/detail/CVE-2020-14968
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968
https://vuldb.com/?id.157125
https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS



Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jsrsasign, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 8.0.17, database_specific: last_known_affected_version_range: < 8.0.16
Denial of Service in Google Guava
Advisory: GHSA-mvr2-9pj6-7w5j (CVE-2018-10237)
Published: 2020-06-15T20:35:11Z

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: com.google.guava:guava, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 11.0
fixed: 24.1.1
package: ecosystem: Maven, name: com.google.guava:guava-jdk5, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 17.0
package: ecosystem: Maven, name: com.googlecode.guava-osgi:guava-osgi, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 11.0.1
package: ecosystem: Maven, name: de.mhus.ports:vaadin-shared-deps, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 7.4.0
package: ecosystem: Maven, name: org.hudsonci.lib.guava:guava, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 14.0.1-h-3
package: ecosystem: Maven, name: org.sonatype.sisu:sisu-guava, ecosystem_specific: affected_functions: , versions: 0.11.1
File system access via H2 in Apache Ignite
Advisory: GHSA-5wm5-8q42-rhxg (CVE-2020-1963)
Published: 2020-06-05T16:11:02Z

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.ignite:ignite-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.1
Untrusted users can run pending migrations in production in Rails
Advisory: GHSA-c6qr-h5vq-59jc (CVE-2020-8185)
Published: 2020-06-24T17:40:33Z

There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.

This vulnerability has been assigned the CVE identifier CVE-2020-8185.

Versions Affected:  6.0.0 < rails < 6.0.3.2
Not affected:       Applications with `config.action_dispatch.show_exceptions = false` (this is not a default setting in production)
Fixed Versions:     rails >= 6.0.3.2

Impact
------

Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run.

Workarounds
-----------

Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production environment via a line such as this one in their config/environment/production.rb:

`config.middleware.delete ActionDispatch::ActionableExceptions`

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: RubyGems, name: actionpack, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3.2, database_specific: last_known_affected_version_range: <= 6.0.3.1
Regular Expression Denial of Service in websocket-extensions (NPM package)
Advisory: GHSA-g78m-2chm-r7qv (CVE-2020-7662)
Published: 2020-06-05T16:16:12Z

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.

### Patches

Users should upgrade to version 0.1.4.

### Workarounds

There are no known work-arounds other than disabling any public-facing
WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected packages:
package: ecosystem: npm, name: websocket-extensions, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.4
RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
Advisory: GHSA-xxxq-chmp-67g4 (CVE-2020-14967)
Published: 2020-06-26T16:27:08Z

### Impact
Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability.

- If you don't use RSA PKCS1-v1_5 or RSA-OAEP decryption, this vulnerability is not affected.
- Risk to forge contents of encrypted message is very low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.

### Patches
Users using RSA PKCS1-v1_5 or RSA-OAEP decryption should upgrade to 8.0.18.

### Workarounds
Reject RSA PKCS1-v1_5 or RSA-OAEP encrypted message with unnecessary prepending zeros.

### References
https://nvd.nist.gov/vuln/detail/CVE-2020-14967
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967
https://vuldb.com/?id.157124
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt
https://github.com/kjur/jsrsasign/issues/439





Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jsrsasign, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.0.18
Cross-site Scripting in dijit editor's LinkDialog plugin 
Advisory: GHSA-cxjc-r2fp-7mq6 (CVE-2020-4051)
Published: 2020-06-15T21:53:12Z

### Impact
XSS possible for users of the Dijit Editor's LinkDialog plugin

### Patches
Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3

### Workarounds
Users may apply the patch made in these releases.


### For more information
If you have any questions or comments about this advisory, open an issue in [dojo/dijit](https://github.com/dojo/dijit/)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: dijit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.11
package: ecosystem: npm, name: dijit, ranges: type: ECOSYSTEM, events: introduced: 1.12.0
fixed: 1.12.9
package: ecosystem: npm, name: dijit, ranges: type: ECOSYSTEM, events: introduced: 1.13.0
fixed: 1.13.8
package: ecosystem: npm, name: dijit, ranges: type: ECOSYSTEM, events: introduced: 1.14.0
fixed: 1.14.7
package: ecosystem: npm, name: dijit, ranges: type: ECOSYSTEM, events: introduced: 1.15.0
fixed: 1.15.4
package: ecosystem: npm, name: dijit, ranges: type: ECOSYSTEM, events: introduced: 1.16.0
fixed: 1.16.3
Directory traversal outside of SENDFILE_ROOT in django-sendfile2
Advisory: GHSA-6r3c-8xf3-ggrr ()
Published: 2020-06-24T17:15:26Z

django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).

This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.

When upgrading, you will need to make sure `SENDFILE_ROOT` is set in your settings module if it wasn't already.

Affected packages:
package: ecosystem: PyPI, name: django-sendfile2, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.0
Log Forging in generator-jhipster-kotlin
Advisory: GHSA-pfxf-wh96-fvjc (CVE-2020-4072)
Published: 2020-06-25T20:02:51Z

### Impact

We log the mail for invalid password reset attempts. 
As the email is provided by a user and the api is public this can be used by an attacker to forge log entries.
This is vulnerable to https://cwe.mitre.org/data/definitions/117.html

This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable.

### Patches

version 1.7.0.

### Workarounds

In `AccountResource.kt` you should change the line

```kotlin
 log.warn("Password reset requested for non existing mail '$mail'");
```

to 

```kotlin
 log.warn("Password reset requested for non existing mail");
```

### References

* https://cwe.mitre.org/data/definitions/117.html
* https://owasp.org/www-community/attacks/Log_Injection
* https://www.baeldung.com/jvm-log-forging

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jhipster kotlin](https://github.com/jhipster/jhipster-kotlin)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: npm, name: generator-jhipster-kotlin, ranges: type: ECOSYSTEM, events: introduced: 1.6.0
fixed: 1.7.0, versions: 1.6.0
Deserialization of Untrusted Data
Advisory: GHSA-6wqp-v4v6-c87c (CVE-2018-12023)
Published: 2020-06-15T18:44:51Z

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.9.4, database_specific: last_known_affected_version_range: <= 2.7.9.3
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.11.2, database_specific: last_known_affected_version_range: <= 2.8.11.1
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.6
SQL Injection in Geocoder
Advisory: GHSA-864j-6qpp-cmrr (CVE-2020-7981)
Published: 2020-06-10T20:03:02Z

sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when `within_bounding_box` is used in conjunction with untrusted `sw_lat`, `sw_lng`, `ne_lat`, or `ne_lng` data.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: geocoder, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.6.1
Denial of service in Apache Xerces2
Advisory: GHSA-334p-wv2m-w3vp (CVE-2009-2625)
Published: 2020-06-15T18:51:30Z

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Affected packages:
package: ecosystem: Maven, name: xerces:xercesImpl, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.10.0
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
Advisory: GHSA-p8c3-7rj8-q963 (CVE-2020-14966)
Published: 2020-06-26T16:54:15Z

### Impact
Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as:

- wrong multi-byte ASN.1 length of TLV (ex. 0x820045 even though 0x45 is correct)
- prepending zeros with ASN.1 INTEGER value (ex. 0x00000123 even though 0x0123 is correct)
- appending zeros to signature of ASN.1 TLV (ex. 0x3082....1fbc000000 even though 0x3082....1fbc, appending zeros are ignored.)

This vulnerability was fixed by strict ASN.1 DER checking. 

Here is an assessment of this vulnerability:

- If you are not use ECDSA signature validation, this vulnerability is not affected.
- Not ASN.1 format signature like just concatenation of R and S value is not affected such as Bitcoin.
- This vulnerability is affected to all ECC curve parameters.
- Risk to accept a forged or crafted message to be signed is low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.
- ECDSA signatures semantically the same to valid one may be accepted as valid. There are many malleable variants.

As discussed [here](https://crypto.stackexchange.com/questions/24862/ber-or-der-x9-62-for-ecdsa-signature), there is no standards like X9.62 which requires ASN.1 DER. So ASN.1 BER can be applied to ECDSA however most of implementations like OpenSSL do strict ASN.1 DER checking.

### Patches
Users using ECDSA signature validation should upgrade to 8.0.19.

### Workarounds
Do strict ASN.1 DER checking for ASN.1 encoded ECDSA signature value.

### References
https://nvd.nist.gov/vuln/detail/CVE-2020-14966
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966
https://vuldb.com/?id.157123
https://github.com/kjur/jsrsasign/issues/437
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html
https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER
https://www.itu.int/rec/T-REC-X.690



Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: jsrsasign, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 8.0.19
Regular Expression Denial of Service in websocket-extensions (RubyGem)
Advisory: GHSA-g6wq-qcwm-j5g2 (CVE-2020-7663)
Published: 2020-06-05T14:21:29Z

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process incoming requests by sending a WebSocket handshake request containing a header of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. The parser takes exponential time to reject this header as invalid, and this will block the processing of any other work on the same thread. Thus if you are running a single-threaded server, such a request can render your service completely unavailable.

### Patches

Users should upgrade to version 0.1.5.

### Workarounds

There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected packages:
package: ecosystem: RubyGems, name: websocket-extensions, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.5
CSRF issue on preview pages in Bolt CMS
Advisory: GHSA-2q66-6cc3-6xm8 (CVE-2020-4040)
Published: 2020-06-09T00:25:41Z

### Impact

Bolt CMS lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview.

### Patches

This has been fixed in Bolt 3.7.1

### References

Related issue: https://github.com/bolt/bolt/pull/7853

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: bolt/bolt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.7.1
Prototype Pollution in ini-parser
Advisory: GHSA-96r7-mrqf-jhcc (CVE-2020-7617)
Published: 2020-06-10T20:27:53Z

All versions of `ini-parser` are vulnerable to prototype pollution. The `parse` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ini-parser, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.0.2
Command injection in mversion
Advisory: GHSA-qjg4-w4c6-f6c6 (CVE-2020-4059)
Published: 2020-06-18T19:23:17Z

### Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

### Patches
Patched by version 2.0.0. Previous releases are deprecated in npm.

### Workarounds
Make sure to escape git commit messages when using the commitMessage option for the update function.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: mversion, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Denial of Service in Tomcat
Advisory: GHSA-qcxh-w3j9-58qr (CVE-2019-0199)
Published: 2020-06-15T18:51:09Z

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.0.16
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.5.38
Authorization bypass in express-jwt
Advisory: GHSA-6g6m-m6h5-w9gf (CVE-2020-15084)
Published: 2020-06-30T16:05:24Z

### Overview
Versions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration.
When **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. 

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

You are using express-jwt
AND 
You do not have **algorithms**  configured in your express-jwt configuration.
AND
You are using libraries such as jwks-rsa as the **secret**. 

### How to fix that?
Specify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration

``` 
const checkJwt = jwt({
  secret: jwksRsa.expressJwtSecret({
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://${DOMAIN}/.well-known/jwks.json`
  }),
  // Validate the audience and the issuer.
  audience: process.env.AUDIENCE,
  issuer: `https://${DOMAIN}/`,
  // restrict allowed algorithms
  algorithms: ['RS256']
}); 
```

### Will this update impact my users?
The fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. 


### Credit
IST Group

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: express-jwt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.0.0, database_specific: last_known_affected_version_range: <= 5.3.3
Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
Advisory: GHSA-c8wh-6jw4-2h79 (CVE-2020-11094)
Published: 2020-06-03T23:19:12Z

### Impact
The debugbar contains a perhaps little known feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed.

### Patches
Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.

### Workarounds
Apply https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 to your installation manually if unable to upgrade to v3.1.0.

### For more information
If you have any questions or comments about this advisory:
* Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

### Acknowledgements

Thanks to [Freddie Poser](https://twitter.com/vogonjeltz101) for reporting the issue to the RainLab team.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: rainlab/debugbar-plugin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.0
Insecure Deserialization in Apache Commons Collection
Advisory: GHSA-6hgm-866r-3cjv (CVE-2015-6420)
Published: 2020-06-15T20:36:20Z

Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.

Affected packages:
package: ecosystem: Maven, name: org.apache.commons:commons-collections4, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.1
package: ecosystem: Maven, name: commons-collections:commons-collections, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.2
package: ecosystem: Maven, name: net.sourceforge.collections:collections-generic, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 4.0.1
package: ecosystem: Maven, name: org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 4.01
package: ecosystem: Maven, name: org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 3.2.1
Insecure Deserialization in Apache Commons Beanutils
Advisory: GHSA-6phf-73q6-gh87 (CVE-2019-10086)
Published: 2020-06-15T20:36:17Z

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: Maven, name: commons-beanutils:commons-beanutils, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.4
Reflected Cross-Site Scripting in Apache CXF
Advisory: GHSA-f93p-f762-vr53 (CVE-2019-17573)
Published: 2020-06-10T20:02:33Z

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.cxf:apache-cxf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.12
package: ecosystem: Maven, name: org.apache.cxf:apache-cxf, ranges: type: ECOSYSTEM, events: introduced: 3.3.0
fixed: 3.3.5
package: ecosystem: Maven, name: org.apache.cxf:cxf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.12
package: ecosystem: Maven, name: org.apache.cxf:cxf, ranges: type: ECOSYSTEM, events: introduced: 3.3.0
fixed: 3.3.5
ECDSA signature vulnerability of Minerva timing attack in jsrsasign
Advisory: GHSA-g753-jx37-7xwh ()
Published: 2020-06-30T16:05:08Z

### Impact
ECDSA side-channel attack named [Minerava](https://minerva.crocs.fi.muni.cz/) have been found and it was found that it affects to jsrsasign.

Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.13 or later, execution time of EC point and scalar multiplication is almost constant and fixed for the issue.

- Minerva is one of timing attack or side channel attack for EC.
- If you don't use ECDSA class, you are not affected the vulnerability.
- The vulnerability is that attacker may guess private key by checking processing time of EC key generation or ECDSA signing.
- The cause issue is that point multiplication processing time in ECDSA signing is depends on private key value.
- After 8.0.13, processing time of point multiplication in ECDSA signing have become constant for key value in theory.

### Patches
Users using ECDSA signature generation should upgrade to 8.0.13 or later.

### Workarounds
There is no workarounds in jsrsasign. Update jsrsasign or use other ECDSA library.

### ACKNOWLEDGEMENT
Thanks to Jan Jancar @J08nY, Petr Svenda and Vladimir Sedlacek of Masaryk University in Czech Republic to find and report this vulnerability.

### References
https://minerva.crocs.fi.muni.cz/
https://www.npmjs.com/advisories/1505
https://github.com/kjur/jsrsasign/issues/411

Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected packages:
package: ecosystem: npm, name: jsrsasign, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 8.0.13
Arbitrary File Read in Snyk Broker
Advisory: GHSA-2fmp-7xwf-wvwr (CVE-2020-7650)
Published: 2020-06-03T22:02:16Z

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: snyk-broker, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.73.1
Deserialization of untrusted data in Jackson Databind
Advisory: GHSA-j823-4qch-3rgm (CVE-2020-14060)
Published: 2020-06-18T14:44:46Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.5, database_specific: last_known_affected_version_range: <= 2.9.10.4
Regular expression denial of service in url-regex
Advisory: GHSA-v4rh-8p82-6h5w (CVE-2020-7661)
Published: 2020-06-22T14:39:03Z

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: url-regex, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 5.0.0
XML External Entity Injection in XStream
Advisory: GHSA-rgh3-987h-wpmw (CVE-2016-3674)
Published: 2020-06-30T22:48:14Z

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: com.thoughtworks.xstream:xstream, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.9
Directory traversal attack in Spring Cloud Config
Advisory: GHSA-32xf-jwmv-9hf3 (CVE-2020-5410)
Published: 2020-06-05T16:13:20Z

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.springframework.cloud:spring-cloud-config-server, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.9
package: ecosystem: Maven, name: org.springframework.cloud:spring-cloud-config-server, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.3
Cross site scripting in Angular
Advisory: GHSA-mhp6-pxh8-r675 (CVE-2020-7676)
Published: 2020-06-18T14:19:58Z

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping `<option>` elements in `<select>` ones changes parsing behavior, leading to possibly unsanitizing code.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: angular, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.8.0
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
Advisory: GHSA-j6w9-fv6q-3q52 (CVE-2020-8184)
Published: 2020-06-24T17:15:00Z

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: rack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.1.4
package: ecosystem: RubyGems, name: rack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.3
Upload whitelisted files to any directory in OctoberCMS
Advisory: GHSA-9722-rr68-rfpg (CVE-2020-5297)
Published: 2020-06-03T21:58:27Z

### Impact
An attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1241" alt="Screen Shot 2020-03-31 at 12 21 10 PM" src="https://user-images.githubusercontent.com/7253840/78061230-255f5400-734a-11ea-92b4-1120f6960505.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/cms, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Privilege Escalation in Hibernate Validator
Advisory: GHSA-xxgp-pcfc-3vgc (CVE-2017-7536)
Published: 2020-06-15T19:57:48Z

In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.hibernate:hibernate-validator, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.5.Final, database_specific: last_known_affected_version_range: <= 5.2.4.Final
package: ecosystem: Maven, name: org.hibernate:hibernate-validator, ranges: type: ECOSYSTEM, events: introduced: 5.3.0
fixed: 5.3.6.Final, database_specific: last_known_affected_version_range: <= 5.3.5.Final
package: ecosystem: Maven, name: org.hibernate:hibernate-validator, ranges: type: ECOSYSTEM, events: introduced: 5.4.0
fixed: 5.4.2.Final, database_specific: last_known_affected_version_range: <= 5.4.1.Final
Denial of Service in Cryptacular
Advisory: GHSA-x64g-4xx9-fh6x (CVE-2020-7226)
Published: 2020-06-10T20:02:58Z

CiphertextHeader.java in Cryptacular before 1.2.4, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with &quot;new byte&quot; may depend on untrusted input within the header of encoded data.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: org.cryptacular:cryptacular, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.4
package: ecosystem: Maven, name: org.cryptacular:cryptacular, ranges: type: ECOSYSTEM, events: introduced: 1.2.0
fixed: 1.2.4
Arbitrary File Deletion vulnerability in OctoberCMS
Advisory: GHSA-jv6v-fvvx-4932 (CVE-2020-5296)
Published: 2020-06-03T21:58:21Z

### Impact
An attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1241" alt="Screen Shot 2020-03-31 at 12 16 53 PM" src="https://user-images.githubusercontent.com/7253840/78060872-89354d00-7349-11ea-8c2b-5881b0a50736.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: october/cms, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Improper Input Validation in jackson-databind
Advisory: GHSA-f3j5-rmmp-3fc5 (CVE-2019-17267)
Published: 2020-06-15T18:44:48Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 and 2.8.11.5. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.11.5
dom4j allows External Entities by default which might enable XXE attacks
Advisory: GHSA-hwj3-m3p6-hj38 (CVE-2020-10683)
Published: 2020-06-05T16:13:36Z

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts.  To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.dom4j:dom4j, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.3
package: ecosystem: Maven, name: org.dom4j:dom4j, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.3
package: ecosystem: Maven, name: dom4j:dom4j, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.6.1
Arbitrary File Read in Snyk Broker
Advisory: GHSA-45hw-29x7-9x95 (CVE-2020-7651)
Published: 2020-06-03T22:02:11Z

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: snyk-broker, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.79.0
Arbitrary shell command execution in logkitty
Advisory: GHSA-v8v8-6859-qxm4 (CVE-2020-8149)
Published: 2020-06-05T14:47:02Z

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: logkitty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.1
Improper Privilege Management in Tomcat
Advisory: GHSA-c9hw-wf7x-jp9j (CVE-2020-1938)
Published: 2020-06-15T18:51:21Z

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: returning arbitrary files from anywhere in the web application, processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.0.31
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.5.51
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.0.100
XSS in Django
Advisory: GHSA-2m34-jcjv-45xf (CVE-2020-13596)
Published: 2020-06-05T16:24:28Z

An issue was discovered in Django version 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: django, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.2.13
package: ecosystem: PyPI, name: django, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.7
Denial of service in XStream
Advisory: GHSA-7hwc-46rm-65jh (CVE-2017-7957)
Published: 2020-06-30T22:48:24Z

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: com.thoughtworks.xstream:xstream, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.10
Deserialization of untrusted data in Jackson Databind
Advisory: GHSA-c2q3-4qrh-fm48 (CVE-2020-14061)
Published: 2020-06-18T14:44:50Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.5, database_specific: last_known_affected_version_range: <= 2.9.10.4
Use of insecure jQuery version in OctoberCMS
Advisory: GHSA-v73w-r9xg-7cr9 ()
Published: 2020-06-05T19:37:49Z

### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

### Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

### Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

### References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory:
* Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Moderate by the @jquery team.

### Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.

Affected packages:
package: ecosystem: Packagist, name: october/october, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
package: ecosystem: Packagist, name: october/system, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Insecure Deserialization in Apache XML-RPC
Advisory: GHSA-6vwp-35w3-xph8 (CVE-2019-17570)
Published: 2020-06-10T20:02:39Z

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Apache XML-RPC is no longer maintained and this issue will not be fixed.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.xmlrpc:xmlrpc, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 3.1.3