aswin1906/github-advisory-2022 huggingface dataset:
jsonwebtoken has insecure input validation in jwt.verify function
Advisory: GHSA-27h2-hvpr-p74q
Aliases: CVE-2022-23529
Published: 2022-12-22T03:31:28Z
Withdrawn: 2023-01-27T21:51:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

# Overview

For versions `<=8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) of the `jwt.verify()` function, they can gain remote code execution (RCE).

# Am I affected?

This security issue is a concern when the `jsonwebtoken` library is used in an insecure way. Users are affected only if they allow untrusted entities to modify the key retrieval parameter of the `jwt.verify()` on a host that you control. In this scenario, if all the prerequisites are met, the issue may be exploitable. The source of this risk in this scenario would be in the calling code, and not in the library itself.

# How do I fix it?

Users of jsonwebtoken 8.5.1 and earlier are encouraged to update to the latest version, 9.0.0, which presents safer code and important security checks that fixes this security flaw and others and prevents misuse of the package.
Jettison Out-of-bounds Write vulnerability
Advisory: GHSA-grr4-wv38-f68w
Aliases: CVE-2022-45693
Published: 2022-12-13T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison
Advisory: GHSA-5vw4-v588-pgv8
Aliases: CVE-2015-10004
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
XStream can cause a Denial of Service by injecting deeply nested objects raising a stack overflow
Advisory: GHSA-f8cc-g7j8-xxpm
Aliases: CVE-2022-40151
Published: 2022-12-30T16:58:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream.

### Patches
XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead.

### Workarounds
The only solution is to catch the StackOverflowError in the client code calling XStream.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2022-40151](https://x-stream.github.io/CVE-2022-40151.html).

### Credits
The vulnerability was discovered and reported by Henry Lin of the Google OSS-Fuzz team.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
OpenShift OSIN vulnerable to Observable Timing Discrepancy
Advisory: GHSA-m7qp-cj9p-gj85
Aliases: CVE-2021-4294
Published: 2022-12-28T18:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function `ClientSecretMatches/CheckClientSecret`. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.
usememos/memos vulnerable to improper access control
Advisory: GHSA-9v48-2h5x-fvpm
Aliases: CVE-2022-4685
Published: 2022-12-23T12:30:25Z

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Uncontrolled Recursion in Loofah
Advisory: GHSA-3x8r-x6xp-q4vm
Aliases: CVE-2022-23516
Published: 2022-12-13T17:40:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Loofah `>= 2.2.0, < 2.19.1` uses recursion for sanitizing `CDATA` sections, making it susceptible to stack exhaustion and raising a `SystemStackError` exception.  This may lead to a denial of service through CPU resource consumption.


## Mitigation

Upgrade to Loofah `>= 2.19.1`.

Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.


## Severity

The Loofah maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-674: Uncontrolled Recursion (4.9)](https://cwe.mitre.org/data/definitions/674.html)
usememos/memos Cross-Site Request Forgery vulnerability
Advisory: GHSA-642q-2q68-9j3p
Aliases: CVE-2022-4849
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos 0.9.0 and prior.
SimbCo httpster vulnerable to Path Traversal
Advisory: GHSA-p8j8-wxvp-h695
Aliases: CVE-2020-36629
Published: 2022-12-25T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.
Macaron i18n Open Redirect vulnerability
Advisory: GHSA-jwrv-x6rx-8vfm
Aliases: CVE-2020-36627
Published: 2022-12-25T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 0.5.0 can address this issue. The name of the patch is 329b0c4844cc16a5a253c011b55180598e707735. It is recommended to upgrade the affected component. The identifier VDB-216745 was assigned to this vulnerability.
ecnepsnai/web vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-jpgg-cp2x-qrw3
Aliases: CVE-2021-4236
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
Tauri Filesystem Scope Glob Pattern is too Permissive
Advisory: GHSA-6mv3-wm7j-h4w5
Aliases: CVE-2022-46171
Published: 2022-12-22T20:03:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact

The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths.

Example: The `fs` scope `$HOME/*.key` would also allow `$HOME/.ssh/secret.key` to be read even though it is in a sub directory of `$HOME` and is inside a hidden folder.

Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected.

### Patches

The issue has been patched in the latest release and was backported into the currently supported 1.x branches.

### Workarounds

No workaround is known at the time of publication.

### References

The original report contained information that the `dialog.open` component automatically allows one sub directory to be read, regardless of the `recursive` option.

Imagine a file system looking like
```
 o ../
 o documents/
    - file.txt
    - deeper/
       o deep_file.txt
```

Reproduction steps:

1. Trying to load “file.txt” or “deep_file.txt” doesn’t work. Expected
2. Select “documents” as folder to open(ie. with window.__TAURI__.dialog.open)
3. Trying to load “file.txt” works. Expected
5. Trying to load “deep_file.txt” also works, which isn’t expected

The recursive flag is used in https://github.com/tauri-apps/tauri/blob/cd8c074ae6592303d3f6844a4fb6d262eae913b2/core/tauri/src/scope/fs.rs#L154 to scope the filesystem access to either files in the folder or to also include sub directories.

The original issue was replicated and further investigated.

The root cause was triaged to the `glob` crate facilitating defaults, which allow the `*` and `[...]` to also match path literals.

```rust
MatchOptions {
    case_sensitive: true,
    require_literal_separator: false,
    require_literal_leading_dot: false
}
```

This implicated that not only the `dialog.open` component was affected but rather all `fs` scopes containing the `*` or `[...]` glob.
During this investigation it became obvious that the current glob matches would also match hidden folder (e.g: `.ssh`) content by default, without explicitly allowing hidden folders to be matched. This is not commonly expected behavior in comparison to for example `bash`.

The new default  Match options are:

```rust
MatchOptions {
    case_sensitive: true,
    require_literal_separator: true,
    require_literal_leading_dot: true
}
```

> Another note security relevant for developers building applications interacting with case sensitive filesystems is, that the `case_sensitive` option only affects ASCII file paths and is not valid in Unicode based paths. This is considered a known risk until the `glob` crate supports non-ASCII file paths for this type of case sensitive matching.

### For more Information

If you have any questions or comments about this advisory:

Open an issue in tauri
Email us at [security@tauri.app](mailto:security@tauri.app)
easy-static-server vulnerable to Directory Traversal
Advisory: GHSA-wcwm-c3mr-pxcr
Aliases: CVE-2022-25931
Published: 2022-12-20T06:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the `req.url` user input that is passed to the server code.
pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)
Advisory: GHSA-qwmp-2cf2-g9g6
Aliases: CVE-2022-40898
Published: 2022-12-23T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Python Packaging Authority (PyPA) Wheel is a reference implementation of the Python wheel packaging standard. Wheel 0.37.1 and earlier are vulnerable to a Regular Expression denial of service via attacker controlled input to the wheel cli. The vulnerable regex is used to verify the validity of Wheel file names. This has been patched in version 0.38.1.
Helm vulnerable to denial of service through schema file
Advisory: GHSA-67fx-wx78-jx33
Aliases: CVE-2022-23526
Published: 2022-12-14T21:39:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the `_chartutil_` package that can cause a segmentation violation. Applications that use functions from the `_chartutil_` package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

### Impact

The `_chartutil_` package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The `_chartutil_` package parses the schema file and loads it into structures Go can work with. Some schema files can cause array data structures to be created causing a memory violation.

Applications that use the `_chartutil_` package in the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with a schema file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client.

### Patches

This issue has been resolved in 3.10.3. 

### Workarounds

SDK users can validate schema files that are correctly formatted before passing them to the `_chartutil_` functions.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.
HAProxyMessageDecoder Stack Exhaustion DoS
Advisory: GHSA-fx2c-96vj-985v
Aliases: CVE-2022-41881
Published: 2022-12-12T21:24:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact
A StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion.

### Patches
Users should upgrade to 4.1.86.Final.

### Workarounds
There is no workaround, except using a custom HaProxyMessageDecoder.

### References
When parsing a TLV with type = PP2_TYPE_SSL, the value can be again a TLV with type = PP2_TYPE_SSL and so on.
The only limitation of the recursion is that the TLV length cannot be bigger than 0xffff because it is encoded in an unsigned short type.
Providing a TLV with a nesting level that is large enough will lead to raising of a StackOverflowError.
The StackOverflowError will be caught if HAProxyMessageDecoder is used as part of Netty’s ChannelPipeline, but using it directly without the ChannelPipeline will lead to a thrown exception / crash.


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [netty](https://github.com/netty/netty)
Apache CXF vulnerable to Exposure of Sensitive Information
Advisory: GHSA-3w37-5p3p-jv92
Aliases: CVE-2022-46363
Published: 2022-12-13T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.
Traefik routes exposed with an empty TLSOption
Advisory: GHSA-468w-8x39-gj5v
Aliases: CVE-2022-46153
Published: 2022-12-08T16:11:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

## Impact

There is a potential vulnerability in Traefik managing the TLS connections.

A router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.

For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.

## Patches

https://github.com/traefik/traefik/releases/tag/v2.9.6

## Workarounds

Check the logs to detect the following error messages and fix your TLS options:

- Empty CA:

```
{"level":"error","msg":"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required","routerName":"Router0@file"}
```

- Bad CA content (or bad path):

```
{"level":"error","msg":"invalid certificate(s) content","routerName":"Router0@file"}
```

- Unknown Client Auth Type:

```
{"level":"error","msg":"unknown client auth type \"FooClientAuthType\"","routerName":"Router0@file"}
```

- Invalid cipherSuites

```
{"level":"error","msg":"invalid CipherSuite: foobar","routerName":"Router0@file"}
```

- Invalid curvePreferences

```
{"level":"error","msg":"invalid CurveID in curvePreferences: foobar","routerName":"Router0@file"}
``` 

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
csaf-poc/csaf_distribution Cross-site Scripting vulnerability
Advisory: GHSA-xxfx-w2rw-gh63
Aliases: CVE-2022-43996
Published: 2022-12-14T00:30:23Z

The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories are served and interpreted as HTML pages. Such uploaded advisories can contain JavaScript code that will execute within the browser context of users inspecting the advisory.
WSO2 carbon-registry Cross-site Scripting vulnerability
Advisory: GHSA-j34r-57xj-pfm5
Aliases: CVE-2022-4520
Published: 2022-12-15T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp` of the component `Advanced Search`. The manipulation of the argument `mediaType/rightOp/leftOp/rightPropertyValue/leftPropertyValue` leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.8.12 can address this issue. The name of the patch is 0c827cc1b14b82d8eb86117ab2e43c34bb91ddb4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215900.
Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed
Advisory: GHSA-9895-g6x5-xwcp
Aliases: CVE-2022-4147
Published: 2022-12-06T21:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
usememos/memos has Incorrectly Specified Destination in a Communication Channel
Advisory: GHSA-r7hg-2cpp-8wqq
Aliases: CVE-2022-4847
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos 0.9.0 and prior.
SCIFIO vulnerable to Path Traversal
Advisory: GHSA-cmwm-45mj-mpg3
Aliases: CVE-2022-4493
Published: 2022-12-14T12:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/io/scif/util/DefaultSampleFilesService.java of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The patch is at commit fcb0dbca0ec72b22fe0c9ddc8abc9cb188a0ff31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215803.
safe-eval vulnerable to Prototype Pollution
Advisory: GHSA-33vh-7x8q-mg35
Aliases: CVE-2022-25904
Published: 2022-12-20T06:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype.
Apache Atlas: zip path traversal in import functionality
Advisory: GHSA-p782-4j23-xqcg
Aliases: CVE-2022-34271
Published: 2022-12-14T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.
GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected
Advisory: GHSA-3839-6r69-m497
Aliases: CVE-2021-4238
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Randomly-generated alphanumeric strings contain significantly less entropy than expected. The `RandomAlphaNumeric` and `CryptoRandomAlphaNumeric` functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access
Advisory: GHSA-m688-cx2p-rgq9
Aliases: CVE-2018-25058
Published: 2022-12-29T09:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file `js/twitterFetcher.js` of the component Link Target Handler. The manipulation leads to use of web link to untrusted target with window.opener access. It is possible to initiate the attack remotely. Upgrading to version 18.0.0 can address this issue. The name of the patch is 7d281c6fb5acbc29a2cad295262c1f0c19ca56f3. It is recommended to upgrade the affected component. The identifier VDB-217017 was assigned to this vulnerability.
Macaron csrf missing encryption and has sensitive cookies in HTTP session without secure attribute
Advisory: GHSA-hhxg-px5h-jc32
Aliases: CVE-2018-25060
Published: 2022-12-30T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file `csrf.go`. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The name of the patch is dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
Froxlor vulnerable to Cross-Site Request Forgery
Advisory: GHSA-6gwx-gw56-qhf7
Aliases: CVE-2022-4867
Published: 2022-12-31T09:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
Oils JS vulnerable to Open Redirect
Advisory: GHSA-v279-v2xm-whq9
Aliases: CVE-2021-4260
Published: 2022-12-19T15:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was found in oils-js. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect and the attack can be initiated remotely. The name of the patch is fad8fbae824a7d367dacb90d56cb02c5cb999d42. It is recommended to apply a patch to fix this issue.
CodeIgniter4 allows spoofing of IP address when using proxy
Advisory: GHSA-ghw3-5qvm-3mqc
Aliases: CVE-2022-23556
Published: 2022-12-22T19:59:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

### Impact
This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy.

### Patches
Upgrade to v4.2.11 or later, and configure `Config\App::$proxyIPs`.

### Workarounds
Do not use `$request->getIPAddress()`.

### References
- https://codeigniter4.github.io/userguide/incoming/request.html#CodeIgniter\HTTP\Request::getIPAddress

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Froxlor Improper Authorization vulnerability
Advisory: GHSA-w6qf-j4qr-f946
Aliases: CVE-2022-4868
Published: 2022-12-31T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
Alist Cross-site Scripting vulnerability
Advisory: GHSA-957m-g6rf-4c2m
Aliases: CVE-2022-45970
Published: 2022-12-12T15:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
Apache Kylin vulnerable to Command injection by Diagnosis Controller
Advisory: GHSA-w9rv-xmf7-x3gh
Aliases: CVE-2022-44621
Published: 2022-12-30T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
Cortex's Alertmanager can expose local files content via specially crafted config
Advisory: GHSA-cq2g-pw6q-hf7j
Aliases: CVE-2022-23536
Published: 2022-12-19T21:09:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

A local file inclusion vulnerability exists in Cortex versions v1.13.0, v1.13.1 and v1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the [Alertmanager Set Configuration API](https://cortexmetrics.io/docs/api/#set-alertmanager-configuration). Only users of the Cortex Alertmanager service using `-experimental.alertmanager.enable-api` or `enable_api: true` are affected.

### Patches
Affected Cortex users are advised to upgrade to versions 1.13.2 or 1.14.1.

### Workarounds
Patching is ultimately advised. Using out-of-bound validation, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section and `opsgenie_api_key_file` in the `global` section before sending to the [Set Alertmanager Configuration API](https://cortexmetrics.io/docs/api/#set-alertmanager-configuration) as a workaround.

### References
- Fixed Versions:
   - https://github.com/cortexproject/cortex/releases/tag/v1.14.1
   - https://github.com/cortexproject/cortex/releases/tag/v1.13.2
- https://cortexmetrics.io/docs/api/#set-alertmanager-configuration

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [cortex](https://github.com/cortexproject/cortex/issues/new/choose)
* Email us at [cortex-team@googlegroups.com](mailto:cortex-team@googlegroups.com).
CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation
Advisory: GHSA-cm9x-c3rh-7rc4
Aliases: CVE-2022-4318
Published: 2022-12-29T01:49:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

### Impact
It is possible to craft an environment variable with newlines to add entries to a container's /etc/passwd. It is possible to circumvent admission validation of username/UID by adding such an entry.

Note: because the pod author is in control of the container's /etc/passwd, this is not considered a new risk factor. However, this advisory is being opened for transparency and as a way of tracking fixes.

### Patches
1.26.0 will have the fix. More patches will be posted as they're available.

### Workarounds
Additional security controls like SELinux should prevent any damage a container is able to do with root on the host. Using SELinux is recommended because this class of attack is already possible by manually editing the container's /etc/passwd 

### References
nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit
Advisory: GHSA-x2jx-w3wm-9p3p
Aliases: CVE-2022-41777
Published: 2022-12-05T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.
Ariadne Component Library vulnerable to Server-Side Request Forgery
Advisory: GHSA-qr97-v87p-x965
Aliases: CVE-2017-20157
Published: 2022-12-31T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 can address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.
json stack overflow vulnerability
Advisory: GHSA-3vqj-43w4-2q58
Aliases: CVE-2022-45688
Published: 2022-12-13T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 and org.json:json before version 20230227 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset
Advisory: GHSA-mgj2-q8wp-29rr
Aliases: CVE-2022-23502
Published: 2022-12-13T17:06:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

### Problem
When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions and backend user sessions.

### Solution
Update to TYPO3 versions 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

### References
* [TYPO3-CORE-SA-2022-014](https://typo3.org/security/advisory/typo3-core-sa-2022-014)
usememos/memos vulnerable to Comparison of Object References Instead of Object Contents
Advisory: GHSA-m5pr-wm6q-x4g2
Aliases: CVE-2022-4812
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Comparison of Object References Instead of Object Contents in GitHub repository usememos/memos 0.9.0 and prior.
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
Advisory: GHSA-97g8-xfvw-q4hg
Aliases: CVE-2022-3916
Published: 2022-12-13T19:44:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

An issue was discovered in Keycloak when using a client with the `offline_access` scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.

This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the `offline_access` scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-qf9q-3wwx-8qjv
Aliases: CVE-2022-4810
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In usememos/memos 0.9.0 and prior, a user can view any content from private memos from other users via the API.
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package
Advisory: GHSA-rp2v-v467-q9vq
Aliases: CVE-2022-23531
Published: 2022-12-02T22:25:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

### Impact

Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed.

This is due to a path traversal vulnerability when extracting the `.tar.gz` file of the package being scanned, which exists by design in the `tarfile.TarFile.extractall` function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

### Remediation

Upgrade to GuardDog v0.1.5 or more recent.

### References

* https://semgrep.dev/r?q=trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal
* https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html
* https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall
usememos/memos makes Incorrect Use of Privileged APIs
Advisory: GHSA-ghx2-6v4g-9wmm
Aliases: CVE-2022-4796
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

In usememos/memos 0.9.0 and prior, a user with login permission can delete all notes of the whole application via `API DELETE https://demo.usememos.com/api/memo/$idnote`. The vulnerability will lose all user notes data throughout the system, causing damage to user data.
Unzip vulnerable to path traversal
Advisory: GHSA-f5c5-hmw9-v8hx
Aliases: CVE-2020-36561
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Helm vulnerable to denial of service through string value parsing
Advisory: GHSA-6rx9-889q-vv2r
Aliases: CVE-2022-23524
Published: 2022-12-14T21:36:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the _strvals_ package that can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

### Impact

The _strvals_ package contains a parser that turns strings into Go structures. For example, the Helm client has command line flags like `--set`, `--set-string`, and others that enable the user to pass in strings that are merged into the values. The _strvals_ package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing a stack overflow.

Applications that use the _strvals_ package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes a stack overflow. Helm is not a long running service so the panic will not affect future uses of the Helm client.

### Patches

This issue has been resolved in 3.10.3. 

### Workarounds

SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.
usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts 
Advisory: GHSA-qrrf-xvcf-p64q
Aliases: CVE-2022-4797
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In usememos/memos 0.9.0 and prior, an attacker can delete other users' posts via post id, which can be done via brute force.
Sentry vulnerable to invite code reuse via cookie manipulation
Advisory: GHSA-jv85-mqxj-3f9j
Aliases: CVE-2022-23485
Published: 2022-12-12T21:27:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

With a known valid invite link (i.e. not already accepted or expired) an unauthenticated attacker can manipulate the cookie to allow the same invite link to be reused on multiple accounts when joining an organization.

### Impact
An attacker with a valid invite link can create multiple users and join the organization from which the invite link was generated.

### Patches
This issue was patched in version 22.11.0.

### Workarounds
Sentry SaaS customers do not need to take action.

Self-hosted Sentry installs can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

1. Add the following line into `sentry.conf.py`:

    ```python
     SENTRY_FEATURES["organizations:invite-members"] = False
    ```
2. Restart the Sentry web service.

    ```
    docker compose restart web
    ```

### For more information
If you have any questions or comments about this advisory:
* [Visit our FAQs on this CVE](https://help.sentry.io/account/security/cve-2022-23485-faqs/)
* Open an issue in [getsentry/sentry](http://github.com/getsentry/sentry)
* Email us at security[@]sentry.io
OpenFGA Authorization Bypass
Advisory: GHSA-m3q4-7qmj-657m
Aliases: CVE-2022-23542
Published: 2022-12-20T19:33:27Z

### Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.3.0 is vulnerable to authorization bypass under certain conditions.

### Am I Affected?
You are affected by this vulnerability if **all** of the following applies:

1.  You are using OpenFGA v0.3.0
2. You created a model using modeling language v1.1 that applies a type restriction to an object e.g. `define viewer: [user]`
3. You created tuples based on the aforementioned model, e.g. `document:1#viewer@user:jon`
4. You updated the previous model by adding a new type and replacing the previous restriction with the newly added type e.g. `define viewer: [employee]`
5. You use the tuples created against the first model (step 3) and issue checks against the updated model e.g. `user=user:jon, relation=viewer, object:document:1`

### How to fix that?
Upgrade to version v0.3.1

### Backward Compatibility
This update is backward compatible.
usememos/memos Cross-Site Request Forgery vulnerability
Advisory: GHSA-5jqp-wmhj-g33f
Aliases: CVE-2022-4844
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos 0.9.0 and prior.
replicator vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-hw46-vg6w-88fj
Aliases: CVE-2021-33420
Published: 2022-12-15T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-gfj4-wg89-m22r
Aliases: CVE-2022-4807
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In usememos/memos 0.9.0 and prior, users can edit and delete all other users' shortcuts.
studygolang vulnerable to cross-site scripting
Advisory: GHSA-gw62-c7w4-x449
Aliases: CVE-2021-4272
Published: 2022-12-21T21:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 0fb30f9640bd5fa0cae58922eac6c00bb1a94391. It is recommended to apply a patch to fix this issue. The identifier VDB-216477 was assigned to this vulnerability.
libp2p DoS vulnerability from lack of resource management
Advisory: GHSA-jvgw-gccv-q5p8
Aliases: CVE-2022-23486
Published: 2022-12-07T20:28:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

An attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network.

### Details

In the original version of the attack, the malicious node would continuously open new streams on a single connection using a stream multiplexer that doesn’t provide sufficient back pressure (mplex or yamux). While allocations per stream might be considered small, they multiply with the number of streams and connections. It is easy to defend against this one attack, e.g. by setting a strict per connection stream limit and connection limit. But there are other variations of this attack, e.g. causing memory allocations by sending partial payloads on various protocol levels, forcing the victim to buffer the partial payload for a period of time or by tricking the victim into pre-allocating buffers for messages which are never sent by the attacker.

### Patches

Users are advised to upgrade to `libp2p` `v0.45.1` or above.

### References
Please see our DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.

Please see the related disclosure for go-libp2p: https://github.com/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw and js-libp2p: https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv

### For more information
If you have any questions or comments about this advisory, please email us at security@libp2p.io.
php-mod/curl allows Cross-site Scripting
Advisory: GHSA-f8p3-q834-q9cj
Aliases: CVE-2021-30134
Published: 2022-12-26T09:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the `post_file_path_upload.php` key parameter and the POST data to `post_multidimensional.php`.
teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
Advisory: GHSA-xr7p-8q82-878q
Aliases: CVE-2022-23466
Published: 2022-12-06T15:36:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L

### Description

teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized.

### Impact

This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.

### Affected Version

This issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` & `v2.0.0-dev`.

### Patches

This vulnerability has been fixed on version `v2.0.0-rc.4` & `v2.0.0-dev.2`.

### Workarounds

Here are some workarounds to handle this case:
- Deactivate the live event dashboard from the configuration file, or
- Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` & above.

### References

- https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-c2v4-8r9g-g5xj
Aliases: CVE-2022-4695
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
rdiffweb vulnerable to Cross-Site Request Forgery
Advisory: GHSA-85fp-523q-5xwc
Aliases: CVE-2022-4646
Published: 2022-12-22T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

rdiffweb prior to version 2.5.4 is vulnerable to Cross-Site Request Forgery (CSRF).
usememos/memos has Insufficient Granularity of Access Control
Advisory: GHSA-f83p-pg86-p922
Aliases: CVE-2022-4801
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

usememos/memos 0.9.0 and prior allows an attacker to archive any user's public or private post.
lite-dev-server vulnerable to Directory Traversal
Advisory: GHSA-pppv-ch8p-rp2w
Aliases: CVE-2022-25895
Published: 2022-12-21T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the `req.url` user input that is passed to the server code.
collective.dms.basecontent Cross-site Scripting vulnerability
Advisory: GHSA-r48c-4vfj-h426
Aliases: CVE-2022-4495
Published: 2022-12-14T15:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.7 or later will address this issue. The patch is at commit 6c4d616fcc771822a14ebae5e23f3f6d96d134bd. It is recommended to upgrade the affected component. The identifier VDB-215813 was assigned to this vulnerability.
Helm vulnerable to denial of service through through repository index file
Advisory: GHSA-53c4-hhmh-vw5q
Aliases: CVE-2022-23525
Published: 2022-12-14T21:38:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the `_repo_` package that can cause a segmentation violation. Applications that use functions from the `_repo_` package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

### Impact

The `_repo_` package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The `_repo_` package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation.

Applications that use the `_repo_` package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client.

### Patches

This issue has been resolved in 3.10.3. 

### Workarounds

SDK users can validate index files that are correctly formatted before passing them to the `_repo_` functions.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.
SilverStripe Subsite weakens file permissions
Advisory: GHSA-cx45-565q-6qx8
Aliases: CVE-2022-42949
Published: 2022-12-19T18:19:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

The subsites module can weaken edit restrictions on some files and allow a malicious user to edit files they do not have edit rights to.

This only affects projects with the subsites module installed. Regression testing should focus on custom file logic.

Be advised that this is not a case of a user being able to edit a file in subsites they do not have access to. As a reminder, all separation of content achieved with the subsites module should be viewed as cosmetic and not appropriate for security-critical applications.
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-pp3p-6jjh-rmg7
Aliases: CVE-2022-4806
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

An Improper Access Control vulnerability in usememos/memos 0.9.0 and prior can result in a user deleting others' public and private memos.