aswin1906/github-advisory-2023 huggingface dataset:
jQuery Cross Site Scripting vulnerability (GHSA-257q-pv89-v3xv)
Aliases: CVE-2020-23064
Published: 2023-06-26T21:30:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'jquery'}, 'ecosystem_specific': {'affected_functions': ['jquery.htmlPrefilter']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.3'}, {'fixed': '3.5.0'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'jQuery'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.3'}, {'fixed': '3.5.0'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'jquery-rails'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.4.0'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'org.webjars.npm:jquery'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.3'}, {'fixed': '3.5.0'}]}]}]

Cross Site Scripting vulnerability in jQuery v.2.2.0 until v.3.5.0 allows a remote attacker to execute arbitrary code via the `<options>` element.
Admidio vulnerable to Cross-site Scripting (GHSA-gx4r-fvwg-8678)
Aliases: CVE-2023-3109
Published: 2023-06-05T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'admidio/admidio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.8'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.
Shescape potential environment variable exposure on Windows with CMD (GHSA-3g7p-8qhx-mc8r)
Aliases: CVE-2023-35931
Published: 2023-06-22T20:01:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'shescape'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.1'}]}]}]

### Impact

This impact users of Shescape:

1. On Windows using the Windows Command Prompt (i.e. `cmd.exe`), and
2. Using `quote`/`quoteAll` or `escape`/`escapeAll` with the `interpolation` option set to `true`.

An attacker may be able to get read-only access to environment variables. Example:

```javascript
import * as cp from "node:child_process";
import * as shescape from "shescape";

// 1. Prerequisites
const options = {
    shell: "cmd.exe",
    // Or
    shell: undefined, // Only if the default shell is CMD

    // And
    interpolation: true, // Only applies to `escape` and `escapeAll` usage
}

// 2. Attack (one of many)
const payload = "%PATH%";

// 3. Usage
let escapedPayload;

escapedPayload = shescape.quote(payload, options);
// Or
escapedPayload = shescape.quoteAll([payload], options);
// Or
escapedPayload = shescape.escape(payload, options);
// Or
escapedPayload = shescape.escapeAll([payload], options);

// And (example)
const result = cp.execSync(`echo Hello ${escapedPayload}`, options);

// 4. Impact
console.log(result.toString());
// Outputs "Hello" followed by the contents of the PATH environment variable
```

### Patches

This bug has been patched in [v1.7.1](https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1) which you can upgrade to now. No further changes are required.

### Workarounds

Alternatively, users can remove all instances of `%` from user input, either before or after using Shescape.

### References

- Shescape Pull request [#982](https://github.com/ericcornelissen/shescape/pull/982)
- Shescape commit [`d0fce70`](https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac)
- Shescape Release [v1.7.1](https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1)
Apache Tomcat vulnerable to information leak (GHSA-mppv-79ch-vw6q)
Aliases: CVE-2023-34981
Published: 2023-06-21T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0-M5'}, {'fixed': '11.0.0-M6'}]}], 'versions': ['11.0.0-M5']}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.1.8'}, {'fixed': '10.1.9'}]}], 'versions': ['10.1.8']}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.74'}, {'fixed': '9.0.75'}]}], 'versions': ['9.0.74']}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.88'}, {'fixed': '8.5.89'}]}], 'versions': ['8.5.88']}]

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error (GHSA-jhpr-j7cq-3jp3)
Aliases: CVE-2023-34110
Published: 2023-06-22T19:59:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Flask-AppBuilder'}, 'ecosystem_specific': {'affected_functions': ['flask_appbuilder.models.sqla.interface.SQLAInterface.add', 'flask_appbuilder.models.sqla.interface.SQLAInterface.edit', 'flask_appbuilder.models.sqla.interface.SQLAInterface.delete', 'flask_appbuilder.models.sqla.interface.SQLAInterface.delete_all']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.2'}]}]}]

### Impact
An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password.
 
### Patches
Fixed on 4.3.2
Coraza has potential denial of service vulnerability (GHSA-c2pj-v37r-2p6h)
Aliases: CVE-2023-40586
Published: 2023-06-26T15:48:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/corazawaf/coraza/v3'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/corazawaf/coraza/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'last_affected': '2.0.1'}]}]}]

### Summary

Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers.

### Details

https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29
The bodyprocessors of multipart uses `log.Fatalf` to handle errors from the `mime.ParseMediaType`, but `log.Fatalf` calls `os.Exit` directly after logging the error.
https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291
This means that the application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`.

### PoC

The server can be demonstrated by https://github.com/corazawaf/coraza/tree/main/examples/http-server

After sending this request
```
POST / HTTP/1.1
Host: 127.0.0.1:8090
User-Agent: curl/8.1.2
Accept: */*
Content-Length: 199
Content-Type: multipart/form-data; boundary=------------------------5fa6351b877326a1; a=1; a=2
Connection: close

--------------------------5fa6351b877326a1
Content-Disposition: form-data; name="file"; filename="123"
Content-Type: application/octet-stream

123

--------------------------5fa6351b877326a1--

```
The server will crash immediately. The `a=1; a=2` in `Content-Type` makes `mime: duplicate parameter name` error.

### Impact

I believe the vulnerability was introduced by the following commit: https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec.

### Mitigation

The error from `mime.ParseMediaType` should return directly.
laravel-s vulnerable to Local File Inclusion (GHSA-q2fp-jw87-86px)
Aliases: CVE-2023-29931
Published: 2023-06-22T12:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'hhxsv5/laravel-s'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.7.36'}]}]}]

laravel-s prior to 3.7.36 is vulnerable to Local File Inclusion via `/src/Illuminate/Laravel.php`.
RaspAP raspap-webgui Command Injection vulnerability (GHSA-hhqm-f4m4-pq39)
Aliases: CVE-2023-30260
Published: 2023-06-23T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'billz/raspap-webgui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.9'}]}]}]

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
Apache Airflow JDBC Provider Improper Input Validation vulnerability (GHSA-mm87-c3x2-6f89)
Aliases: CVE-2023-22886
Published: 2023-06-29T12:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission. This issue affects Apache Airflow JDBC Provider: before 4.0.0.
Snowflake NodeJS Driver vulnerable to Command Injection (GHSA-h53w-7qw7-vh5c)
Aliases: CVE-2023-34232
Published: 2023-06-09T22:53:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'snowflake-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.21'}]}]}]

### Issue
Snowflake was informed via our bug bounty program of a command injection vulnerability in the Snowflake NodeJS driver via SSO browser URL authentication.

### Impacted driver package: 
snowflake-connector-nodejs

### Impacted version range: 
before [Version 1.6.21](https://community.snowflake.com/s/article/Node-js-Driver-Release-Notes) 

### Attack Scenario
In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. 

This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources.  

### Solution
On April 18, 2023, Snowflake merged a patch that fixed a command injection vulnerability in the Snowflake NodeJS driver via SSO browser URL authentication. The vulnerability affected the Snowflake NodeJS driver before Version 1.6.21. We strongly recommend users upgrade to Version 1.6.21 as soon as possible via the following resources: [Snowflake NodeJS Driver](https://docs.snowflake.com/en/developer-guide/node-js/nodejs-driver)

### Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
Vapor vulnerable to denial of service in URLEncodedFormDecoder (GHSA-qvxg-wjxc-r4gg)
Aliases: CVE-2022-31019
Published: 2023-06-07T16:11:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/vapor/vapor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.61.1'}]}]}]

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.

### Impact
When using automatic content decoding, e.g. 

```swift
app.post("foo") { request -> String in
  let foo = try request.content.decode(Foo.self)
  return "\(foo)"
}
```

An attacker can craft a request body that can make the server crash with the following request:

```
curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo
```

The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.

### Patches
Fixed in 4.61.1

### Workarounds
If you don't need to decode Form URL Encoded data, you can disable the `ContentConfiguration` so it won't be used. E.g. in **configure.swift**

```swift
var contentConfig = ContentConfiguration()
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)
ContentConfiguration.global = contentConfig
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Vapor repo](https://github.com/vapor/vapor)
* Ask in [Vapor Discord](http://vapor.team)
LeafKit allows XSS with untrusted user input (GHSA-rv3x-xq3r-8j9h)
Aliases: CVE-2021-37634
Published: 2023-06-09T19:32:32Z
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/vapor/leaf-kit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.0'}]}]}]

### Impact
This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an attacker managed to find a variable that was rendered with their unsanitised data, they could inject scripts into a generated Leaf page, which could enable XSS attacks if other mitigations such as a Content Security Policy were not enabled.

### Patches
This has been patched in 1.3.0

### Workarounds
Sanitise any untrusted input before passing it to Leaf and enable a CSP to block inline script and CSS data.

### References
https://github.com/vapor/leaf-kit-ghsa-rv3x-xq3r-8j9h/pull/1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Leaf Kit](https://github.com/vapor/leaf-kit)
* Email us at [security@vapor.codes](mailto:security@vapor.codes)
notation-go's verification bypass can cause users to verify the wrong artifact (GHSA-xhg5-42rf-296r)
Aliases: CVE-2023-33959
Published: 2023-06-06T16:45:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/notaryproject/notation-go'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-rc.6'}]}]}]

### Impact
An attacker who controls or compromises a registry can lead a user to verify the wrong artifact.

### Patches
The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6). Users should upgrade their notation-go library to [v1.0.0-rc.6](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6) or above.

### Workarounds
User should use secure and trusted container registries.

### Credits
The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT), Pritesh Bandi (@priteshbandi)  for root cause analysis.
Apache Accumulo Improper Authentication vulnerability (GHSA-hp5w-w29m-vg63)
Aliases: CVE-2023-34340
Published: 2023-06-21T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.accumulo:accumulo-shell'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.1'}]}], 'versions': ['2.1.0']}]

Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo.
This issue affects Apache Accumulo: 2.1.0.

Accumulo 2.1.0 contains a defect in the user authentication process that may succeed when invalid credentials are provided. Users are advised to upgrade to 2.1.1.
Apache Struts vulnerable to memory exhaustion (GHSA-4g42-gqrg-4633)
Aliases: CVE-2023-34396
Published: 2023-06-14T09:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.struts:struts2-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.31'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.struts:struts2-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.1.2.1'}]}]}]

Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
Vapor's Metrics integration could cause a system drain (GHSA-gcj9-jj38-hwmc)
Aliases: CVE-2021-21328
Published: 2023-06-09T19:31:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/vapor/vapor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.40.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.40.0'}}]

### Impact
This is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app with the following attack vector:

1. send unlimited requests against a vapor instance with different paths. this will create “unlimited” counters and timers, which will eventually drain the system.
2. downstream services might suffer from this attack as well by being spammed with error paths

### Patches
This has been patched in 4.40.1. The `DefaultResponder` will rewrite any undefined route paths for to `vapor_route_undefined` to avoid unlimited counters.

### Workarounds
Don't bootstrap a metrics system or upgrade to 4.40.1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Vapor](https://github.com/vapor/vapor)
* Ask in [Discord](http://vapor.team)
semver vulnerable to Regular Expression Denial of Service (GHSA-c2qf-rxjj-qqgw)
Aliases: CVE-2022-25883
Published: 2023-06-21T06:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'semver'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.5.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'semver'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.3.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'semver'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.7.2'}]}]}]

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
xxl-rpc deserialization vulnerability (GHSA-c29g-q3h3-mwcf)
Aliases: CVE-2023-33496
Published: 2023-06-07T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.xuxueli:xxl-rpc-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.7.0'}]}]}]

xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component `com.xxl.rpc.core.remoting.net.impl.netty.codec.NettyDecode#decode`.
Brook's tproxy server is vulnerable to a drive-by command injection. (GHSA-vfrj-fv6p-3cpf)
Aliases: CVE-2023-33965
Published: 2023-06-06T01:38:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/txthinking/brook'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '20230606'}]}]}]

The `tproxy` server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local `tproxy` service leading to remote code execution.
SafeURL-Python's hostname blocklist does not block FQDNs (GHSA-373w-rj84-pv6x)
Published: 2023-06-29T15:02:16Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'SafeURL-Python'}, 'ecosystem_specific': {'affected_functions': ['safeurl.safeurl.Options.isInList']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3'}]}]}]

### Description
If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host (e.g. adding `.` to the end).

### Impact
The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library user had specifically set certain hostnames as blocked, then an attacker would be able to circumvent that block to cause SSRFs to request those hostnames.

### Patches
Fixed by https://github.com/IncludeSecurity/safeurl-python/pull/6

### Credit
https://github.com/Sim4n6
Mattermost Server Missing Authorization vulnerability (GHSA-455c-vqrf-mghr)
Aliases: CVE-2023-2783
Published: 2023-06-16T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.10.0'}, {'fixed': '7.10.1'}]}], 'versions': ['7.10.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.9.0'}, {'fixed': '7.9.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.5'}]}]}]

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps.
TeamPass vulnerable to stored Cross-site Scripting (GHSA-j245-v2mh-5h6f)
Aliases: CVE-2023-3086
Published: 2023-06-03T12:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Spina Cross-site Scripting vulnerability (GHSA-97wh-6hmj-g8j9)
Aliases: CVE-2023-3445
Published: 2023-06-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'spina'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.15.1'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.
Improper configuration of RBAC permissions obtaining cluster control permissions (GHSA-74j8-w7f9-pp62)
Aliases: CVE-2023-33190
Published: 2023-06-30T20:25:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/labring/sealos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.1-rc4'}]}]}]

### Summary
Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster.

### Details
detail's is disable by publish.

### PoC
detail's is disable by publish.

### Impact
+ sealos public cloud user
+ CWE-287 Improper Authentication
word-wrap vulnerable to Regular Expression Denial of Service (GHSA-j8xg-fqg3-53r7)
Aliases: CVE-2023-26115
Published: 2023-06-22T06:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'word-wrap'}, 'ecosystem_specific': {'affected_functions': ['word-wrap']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.4'}]}]}]

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
`openssl` `X509VerifyParamRef::set_host` buffer over-read (GHSA-xcf7-rvmh-g6q4)
Published: 2023-06-21T22:07:52Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.10.0'}, {'fixed': '0.10.55'}]}]}]

When this function was passed an empty string, `openssl` would attempt to call `strlen` on it, reading arbitrary memory until it reached a NUL byte.
Reportlab vulnerable to remote code execution (GHSA-9q9m-c65c-37pq)
Aliases: CVE-2023-33733
Published: 2023-06-05T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'reportlab'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.6.13'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.6.12'}}]

Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.
ink! vulnerable to incorrect decoding of storage value when using `DelegateCall` (GHSA-853p-5678-hv8f)
Aliases: CVE-2023-34449
Published: 2023-06-14T20:11:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ink'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.1'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'ink_env'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.1'}]}]}]

### Summary
The return value when using delegate call mechanics, either through [`CallBuilder::delegate`](https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate) or [`ink_env::invoke_contract_delegate`](https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html), is being decoded incorrectly.

### Description
Consider this minimal example:

```rust
// First contract, this will be performing a delegate call to the `Callee`.
#[ink(storage)]
pub struct Caller {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self, callee_code_hash: Hash) -> u128 {
    let result = build_call::<DefaultEnvironment>()
        .delegate(callee_code_hash)
        .exec_input(ExecutionInput::new(Selector::new(ink::selector_bytes!(
            "get_value"
        ))))
        .returns::<u128>()
        .invoke();

    result
}

// Different contract, using this code hash for the delegate call.
#[ink(storage)]
pub struct Callee {
    value: u128,
}

#[ink(message)]
pub fn get_value(&self) -> u128 {
    self.value
}
```

In this example we are executing the `Callee` code in the context of the `Caller` contract. This means we'll be using the storage values of the `Caller` contract.

Running this code we expect the delegate call to return `value` as it was stored in the `Caller` contract. However, due to the reported bug a different value is returned (for the case of `uint`s it is `256` times the expected value).

### Impact
After conducting an analysis of the on-chain deployments of ink! contracts on Astar, Shiden, Aleph Zero, Amplitude and Pendulum, we have found that no contracts on those chains have been affected by the issue.

This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of https://github.com/paritytech/ink/pull/1450. Since this feature was only released in ink! 4.0.0 no previous versions are affected.

### Mitigations
If you have an ink! 4.x series contract, please update it to the [4.2.1](https://github.com/paritytech/ink/releases/tag/v4.2.1) patch release that we just published. 

### Credits
Thank you Facundo Lerena from [CoinFabrik](https://www.coinfabrik.com) for reporting this problem in a well-structured and responsible way.
Synapse has URL deny list bypass via oEmbed and image URLs when generating previews (GHSA-98px-6486-j7qc)
Aliases: CVE-2023-32683
Published: 2023-06-06T16:41:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'matrix-synapse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.85.0'}]}]}]

### Impact
A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client:

* For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded.
* For discovered image URLs, any non-image response is discarded.

Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected.

Because of the uncommon configuration required, the limited information a malicious user, and the amount of guesses/time the attack would need; the severity is rated as low.

### Patches

The issue is fixed by #15601.

### Workarounds

The default configuration of the `url_preview_ip_range_blacklist` should protect against requests being made to internal infrastructure, URL previews of public URLs is expected.

Alternately URL previews could be disabled using the `url_preview_enabled` setting.
Snowflake Python Connector vulnerable to Command Injection (GHSA-5w5m-pfw9-c8fp)
Aliases: CVE-2023-34233
Published: 2023-06-09T22:53:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'snowflake-connector-python'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.2'}]}]}]

### Issue
Snowflake was informed via our bug bounty program of a command injection vulnerability in the Snowflake Python connector via SSO browser URL authentication. 

### Impacted driver package: 
snowflake-connector-python

### Impacted version range: 
before [Version 3.0.2](https://community.snowflake.com/s/article/Snowflake-Connector-for-Python-Release-Notes)

### Attack Scenario
In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. 

This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources.   

### Solution
On March 23rd, 2023, Snowflake merged a patch that fixed a command injection vulnerability in the Snowflake Python connector via SSO browser URL authentication. The vulnerability affected the Snowflake Python connector before Version 3.0.2. We strongly recommend users upgrade to Version 3.0.2 as soon as possible via the following resources: [Snowflake Python Connector](https://docs.snowflake.com/en/developer-guide/python-connector/python-connector)

### Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets (GHSA-5fm9-h728-fwpj)
Published: 2023-06-06T02:06:23Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'trust-dns-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.22.1'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'trust-dns-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.23.0-alpha.2'}, {'fixed': '0.23.0-alpha.3'}]}]}]

trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources.
DNS messages with the QR=1 bit set are responded to with a `FormErr` response.
This allows creating a traffic loop, in which these `FormErr` responses are sent nonstop between vulnerable servers.

There are two scenarios how this can be exploited: 1) Create a loop between two instances of trust-dns, consuming network resources, or 2) consuming the CPU of a single instance.

With two instances *A* and *B* an attacker sends a DNS query with a spoofed source IP address to *A*.
*A* replies with a `FormErr` to *B*.
Now both servers with ping-pong the message back and forth until by chance the packet is dropped in the network.
Multiple spoofed packets can be sent by the attacker, increasing resource consumption.

A single server can get locked up replying to itself.
Same setup as above, but now *A* sends the reply to itself.
The packet is sent out as fast as the CPU and network stack manage.
This locks up a CPU core.
Multiple packets from the attacker consume multiple CPU cores.
XWiki Platform may retrieve email addresses of all users  (GHSA-7vr7-cghh-ch63)
Aliases: CVE-2023-34467
Published: 2023-06-20T16:45:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.5-milestone-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}]

### Impact
The mail obfuscation configuration was not fully taken into account and while the mail displayed to the end user was obfuscated:
- the rest response was also containing the mail unobfuscated
- user were able to filter and sort on the unobfuscated (allowing to infer the mail content)

The consequence was the possibility to retrieve the email addresses of all users even when obfuscated.

See https://jira.xwiki.org/browse/XWIKI-20333 for the reproduction steps.

### Patches
This has been patched in XWiki 14.10.4, XWiki 14.4.8, and XWiki 15.0-rc-1.

### Workarounds
The workaround is to modify the page `XWiki.LiveTableResultsMacros` following this [patch](https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a).

### References

https://jira.xwiki.org/browse/XWIKI-20333

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported on Intigriti by @floerer
Liufee CMS File Upload vulnerability (GHSA-6vf2-mfmr-qqqw)
Aliases: CVE-2020-21489
Published: 2023-06-20T15:31:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'feehi/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.8.1'}]}]}]

File Upload vulnerability in Liufee CMS, AKA Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the `/admin/index.php?r=admin-user%2Fupdate-self` component.
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution (GHSA-462x-c3jw-7vr6)
Aliases: CVE-2023-36475
Published: 2023-06-30T20:41:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'parse-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.5.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'parse-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.2.1'}]}]}]

### Impact

An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser.

### Patches

Prevent prototype pollution in MongoDB database adapter.

### Workarounds

Disable remote code execution through the MongoDB BSON parser.

### Credits

- Discovered by hir0ot working with Trend Micro Zero Day Initiative
- Fixed by dbythy
- Reviewed by mtrezza

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6
- https://github.com/advisories/GHSA-prm5-8g2m-24gg
JeecgBoot vulnerable to SQL injection in queryTableDictItemsByCode (GHSA-784x-7w88-w564)
Aliases: CVE-2023-34602
Published: 2023-06-19T06:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.1'}]}]}]

JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component `queryTableDictItemsByCode` in method `org.jeecg.modules.api.controller.SystemApiController`.
passport-wsfed-saml2 Signature Bypass vulnerability (GHSA-5wrg-8fxp-cx9r)
Published: 2023-06-21T22:06:22Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'passport-wsfed-saml2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}]

## Information
Please note that this is not a new disclosure, and is previously reported in our [SECURITY-NOTICE.md](https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70
) which we removed in favor of github advisory. 

# Overview

A vulnerability was found in the validation of a SAML signature. The validation doesn't ensure that the "Signature" tag is at the proper location inside an "Assertion" tag. This leads to a signature relocation attack where the attacker can corrupt one field of data while maintaining the signature valid. This could allow an authenticated attacker to "remove" one group from the assertion or corrupt another field of an assertion.

# Am I affected?

You are affected if you are using the passport-wsfed-saml2 library to version < 3.0.10

# How do I fix it?

You may fix this issue by upgrading passport-wsfed-saml2 library to version 3.0.10 or above. 

# Will the fix impact my users?

This fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.
Silver vulnerable to MitM attack against implants due to a cryptography vulnerability (GHSA-8jxm-xp43-qh3q)
Aliases: CVE-2023-34758
Published: 2023-06-21T22:08:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/bishopfox/sliver'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.5.40'}]}]}]

### Summary
The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)

### Details
Please see [the PoC repo](https://github.com/tangent65536/Slivjacker).

### PoC
Please also see [the PoC repo](https://github.com/tangent65536/Slivjacker).
To setup a simple PoC environment,  
 1. Generate an implant with its C2 set to the PoC server's address and copy the embedded private implant key and public server key into the config json.  
 2. Run the implant on a separate VM and a `notepad.exe` window should pop up on the implanted VM.  

### Impact
A successful attack grants the attacker permission to execute arbitrary code on the implanted device.  
  
### References
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go  
https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go  
https://github.com/tangent65536/Slivjacker  

### Credits
[Ting-Wei Hsieh](https://github.com/tangent65536) from [CHT Security Co. Ltd.](https://www.chtsecurity.com/?lang=en)
MediaWiki Cross-site Scripting vulnerability (GHSA-fmrf-p77g-vv5c)
Aliases: CVE-2023-37302
Published: 2023-06-30T18:31:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wikibase/wikibase'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.39.3'}]}]}]

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).
netty-handler SniHandler 16MB allocation (GHSA-6mjq-h674-j845)
Aliases: CVE-2023-34462
Published: 2023-06-20T16:33:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.netty:netty-handler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.94.Final'}]}]}]

### Summary
The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap.

### Details
The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. 

Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`

1/ allocate a 16MB `ByteBuf`
2/ not fail `decode` method `in` buffer
3/ get out of the loop without an exception

The combination of this without the use of a timeout makes  easy to connect to a TCP server and allocate 16MB of heap memory per connection.

### Impact
If the user has no idle timeout handler configured it might be possible for a remote peer to send a client hello packet which lead the server to buffer up to 16MB of data per connection. This could lead to a OutOfMemoryError and so result in a DDOS.
memoffset allows reading uninitialized memory (GHSA-wfg4-322g-9vqv)
Published: 2023-06-21T22:06:29Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'memoffset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.2'}]}]}]

memoffset allows attempt of reading data from address `0` with arbitrary type. This behavior is an undefined behavior because address `0` to `std::mem::size_of<T>` may not have valid bit-pattern with `T`. Old implementation dereferences uninitialized memory obtained from `std::mem::align_of`. Older implementation prior to it allows using uninitialized data obtained from `std::mem::uninitialized` with arbitrary type then compute offset by taking the address of field-projection. This may also result in an undefined behavior for "father" that includes (directly or transitively) type that [does not allow to be uninitialized](https://doc.rust-lang.org/nightly/reference/behavior-considered-undefined.html).

This flaw was corrected by using `std::ptr::addr_of` in <https://github.com/Gilnaa/memoffset/pull/50>.
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload (GHSA-2fqm-m4r2-fh98)
Aliases: CVE-2023-33977
Published: 2023-06-06T16:46:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ecosystem_specific': {'affected_functions': ['tcms.kiwi_attachments.validators.deny_uploads_containing_script_tag']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 12.3'}}]

### Impact

Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. 

The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy.

### Patches

- Improved file upload validation code
- Updated Nginx reverse proxy configuration for ***.tenant.kiwitcms.org**

### Workarounds

If serving Kiwi TCMS behind a reverse proxy make sure that additional header values are still passed to the client browser. If they aren't redefine them inside the proxy configuration. See [etc/nginx.conf#L66-L68](https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L66-L68) and [etc/nginx.conf#L87](https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf#L87)

### References

Disclosed by [M Nadeem Qazi](https://huntr.dev/bounties/6aea9a26-e29a-467b-aa5a-f767f0c2ec96/).
Froxlor Session Fixation vulnerability (GHSA-jr66-9ghf-6gp3)
Aliases: CVE-2023-3192
Published: 2023-06-11T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

Versions of froxlor/froxlor prior to release 2.1.0 did not regenerate session ids appropriately which may result in session fixation.