aswin1906/github-advisory-2023 huggingface dataset:
Nacos Spring vulnerable to Unsafe Deserialization (GHSA-v6c8-pwhq-288m)
Aliases: CVE-2023-39106
Published: 2023-08-21T18:31:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.alibaba.nacos:nacos-spring-context'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.1'}]}]}]

An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
MongoDB Driver may publish events containing authentication-related data (GHSA-vxvm-qww3-2fh7)
Aliases: CVE-2021-32050
Published: 2023-08-29T18:31:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'mongodb/mongodb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.9.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'mongodb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.6.0'}, {'fixed': '3.6.10'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'mongodb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.17.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'mongodb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.8.0'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'https://github.com/mongodb/mongo-swift-driver'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.1.1'}]}]}]

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.

Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).

This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).
Sulu Observable Response Discrepancy on Admin Login (GHSA-wmwf-49vv-p3mr)
Aliases: CVE-2023-39343
Published: 2023-08-03T19:44:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'sulu/sulu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.10'}]}]}]

### Impact

It allows over the Admin Login form to detect which user (username, email) exists and which one do not exist.

Impacted by this issue are Sulu installation >= 2.5.0 and <2.5.10 using the newer Symfony Security System which is default since Symfony 6.0 but can be enabled in Symfony 5.4. Sulu Installation not using the old Symfony 5.4 security System and previous version are not impacted by this Security issue.

### Patches

The problem has been patched in version 2.5.10. 

### Workarounds

Create a custom AuthenticationFailureHandler which does not return the `$exception->getMessage();` instead the `$exception->getMessageKey();`

### References

Currently no references.
Path traversal in Zip Swift (GHSA-g454-wj9r-jpg4)
Aliases: CVE-2023-39135
Published: 2023-08-31T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'https://github.com/marmelroy/Zip'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.2'}]}]}]

An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.
@webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content (GHSA-3x59-vrmc-5mx6)
Aliases: CVE-2023-41167
Published: 2023-08-24T22:16:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@webiny/react-rich-text-renderer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.37.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.37.1'}}]

## Overview
`@webiny/react-rich-text-renderer` is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. The `@webiny/react-rich-text-renderer` package depends on the [editor.js](https://editorjs.io/) rich text editor to handle rich text content. The CMS stores rich text content from the `editor.js` into the database. When the `@webiny/react-rich-text-renderer` is used to render such content, it uses the `dangerouslySetInnerHTML` prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.

## Am I affected?
You will be affected if you're running a Webiny project created prior to `5.35.0` and you're using the legacy rich text editor (which uses `editor.js` library under the hood). If you've already switched to using the new rich text editor, powered by Lexical editor, you will not be affected by this.

## How do I patch this vulnerability?
Update to Webiny version `5.37.2`.
Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths (GHSA-qppv-j76h-2rpx)
Published: 2023-08-14T21:34:17Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tornado'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.3.3'}]}]}]

## Summary
Tornado interprets `-`, `+`, and `_` in chunk length and `Content-Length` values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected.

## Details
Tornado uses the `int` constructor to parse the values of `Content-Length` headers and chunk lengths in the following locations:
### `tornado/http1connection.py:445`
```python3
            self._expected_content_remaining = int(headers["Content-Length"])
```
### `tornado/http1connection.py:621`
```python3
                content_length = int(headers["Content-Length"])  # type: Optional[int]
```
### `tornado/http1connection.py:671`
```python3
            chunk_len = int(chunk_len_str.strip(), 16)
```
Because `int("0_0") == int("+0") == int("-0") == int("0")`, using the `int` constructor to parse and validate strings that should contain only ASCII digits is not a good strategy.
Jenkins Flaky Test Handler Plugin stored cross-site scripting vulnerability (GHSA-hv48-hgp6-xpqf)
Aliases: CVE-2023-40342
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:flaky-test-handler'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.3'}]}]}]

Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control JUnit report file contents.

Flaky Test Handler Plugin 1.2.3 escapes JUnit test contents when showing them on the Jenkins UI.
Denial of service in jackson-dataformats-text (GHSA-rg2c-cfxv-qp6f)
Aliases: CVE-2023-3894
Published: 2023-08-08T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.dataformat:jackson-dataformats-text'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.15.0'}]}]}]

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
libp2p nodes vulnerable to attack using large RSA keys (GHSA-876p-8259-xjgg)
Aliases: CVE-2023-39533
Published: 2023-08-09T13:18:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/libp2p/go-libp2p'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.27.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/libp2p/go-libp2p'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.28.0'}, {'fixed': '0.28.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/libp2p/go-libp2p'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.29.0'}, {'fixed': '0.29.1'}]}], 'versions': ['0.29.0']}]

### Impact
A malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step.
To prevent this attack, go-libp2p now restricts RSA keys to <= 8192 bits.

### Patches
Users should upgrade their go-libp2p versions to >=v0.27.8, >= v0.28.2, or >=v0.29.1
To protect your application, it's necessary to update to these patch releases **AND** to use the updated Go compiler (1.20.7 or 1.19.12, respectively)

### Workarounds
There are no known workarounds

### References
The Golang crypto/tls package also had this vulnerability ("verifying certificate chains containing large RSA keys is slow” https://github.com/golang/go/issues/61460)
Fix in golang/go crypto/tls: https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
Fix in quic-go https://github.com/quic-go/quic-go/pull/4012
Flarum vulnerable to LFI and Blind SSRF via Avatar upload (GHSA-67c6-q4j4-hccg)
Aliases: CVE-2023-40033
Published: 2023-08-16T21:02:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'flarum/core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.0'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'flarum/framework'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.0'}]}]}]

## Impact
The Flarum forum software is affected by a vulnerability that allows an attacker to conduct a Blind SSRF attack or disclose any file on the server, even with a basic user account on any Flarum forum. By uploading a file containing a URL and spoofing the MIME type, an attacker can manipulate the application to execute unintended actions. The vulnerability is due to the behavior of the `intervention/image` package, which attempts to interpret the supplied file contents as a URL, which then fetches its contents. This allows an attacker to exploit the vulnerability to perform SSRF attacks, disclose local file contents, or conduct a blind oracle attack.

### Patches
This has been patched in Flarum **v1.8**.

## Workarounds
As a temporary workaround for the SSRF aspect of the vulnerability, one can disable PHP's `allow_url_fopen` which will prevent the fetching of external files via URLs.

### Credits
Adam Kues - [Assetnote](https://assetnote.io/)
XWiki Platform privilege escalation (PR) from account through AWM content fields (GHSA-5mf8-v43w-mfxp)
Aliases: CVE-2023-40177
Published: 2023-08-21T20:10:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3-milestone-2'}, {'fixed': '14.10.5'}]}]}]

### Impact

Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation.

The problem is present [since version 4.3M2](https://jira.xwiki.org/browse/XWIKI-7369) when AppWithinMinutes Application added support for the Content field, allowing any wiki page (including the user profile page) to use its content as an AWM Content field, which has a custom displayer that executes the content with the rights of the ``AppWithinMinutes.Content`` author, rather than the rights of the content author.

### Patches

The issue has been fixed in XWiki 14.10.5 and 15.1RC1 by https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262 . The fix is in the content of the [AppWithinMinutes.Content](https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262#diff-850f6875c40cf7932f40a985e99679a041891c6ee75d10239c06921c0019cf78R82) page that defines the custom displayer. By using the ``display`` script service to render the content we make sure that the proper author is used for access rights checks.

### Workarounds

If you want to fix this problem on older versions of XWiki that have not been patched then you need to modify the content of ``AppWithinMinutes.Content`` page to use the ``display`` script service to render the content, like this:

```
- {{html}}$tdoc.getRenderedContent($tdoc.content, $tdoc.syntax.toIdString()).replace('{{', '&amp;#123;&amp;#123;'){{/html}}
+ {{html}}$services.display.content($tdoc, {
+   'displayerHint': 'default'
+ }).replace('{{/html}}', '&amp;#123;&amp;#123;/html&amp;#125;&amp;#125;'){{/html}}
```

### References

* JIRA issue https://jira.xwiki.org/browse/XWIKI-19906
* Fix https://github.com/xwiki/xwiki-platform/commit/dfb1cde173e363ca5c12eb3654869f9719820262

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been found and reported by @michitux .
libp2p nodes vulnerable to OOM attack (GHSA-gcq9-qqwx-rgj3)
Aliases: CVE-2023-40583
Published: 2023-08-24T22:22:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/libp2p/go-libp2p'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.27.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.27.3'}}]

### Summary
In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash.

It is feasible to do this at scale. An attacker would have to transfer ~1/2 as much memory it wants to occupy (2x amplification factor).

The attacker can perform this attack over time as the target node’s memory will not be garbage collected.

This can occur because when a signed peer record is received, only the signature validity check is performed but the sender signature is not checked. Signed peer records from randomly generated peers can be sent by a malicious actor. A target node will accept the peer record as long as the signature is valid, and then stored in the peer store.

There is cleanup logic in the peer store that cleans up data when a peer disconnects, but this cleanup is never triggered for the fake peer (from which signed peer records were accepted) because it was never “connected”.

### Impact
If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.)

### Patches
Update your go-libp2p dependency to the latest release, v0.30.0 at the time of writing.

If you'd like to stay on the 0.27.x release, we strongly recommend users to update to go-libp2p [0.27.7](https://github.com/libp2p/go-libp2p/releases/tag/v0.27.7). Though this OOM issue was fixed in 0.27.4, there were subsequent patch releases afterwards (important fixes for other issues unrelated to the OOM).

### Workarounds
None
Admidio Insufficient Session Expiration vulnerability (GHSA-qq8m-9rpx-w2fm)
Aliases: CVE-2023-4190
Published: 2023-08-06T03:30:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'admidio/admidio'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.11'}]}]}]

Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11. This vulnerability allows a user's session to remain valid even after the user has logged out, potentially granting unauthorized access to sensitive areas and functionalities.
etcd denial of service vulnerability (GHSA-65rp-cv85-263x)
Aliases: CVE-2022-34038
Published: 2023-08-22T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'go.etcd.io/etcd/v3'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.5'}]}]}]

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go
SUCHMOKUO node-worker-threads-pool denial of service Vulnerability (GHSA-7vxc-q7rv-qfj8)
Aliases: CVE-2021-29057
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'node-worker-threads-pool'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service.
Cloudflare Wrangler directory traversal vulnerability (GHSA-8c93-4hch-xgxp)
Aliases: CVE-2023-3348
Published: 2023-08-03T16:34:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'wrangler'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.20.1'}]}]}]

### Impact 
The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.

### Patches
Wrangler2: Upgrade to v2.20.1 or higher.
Wrangler3: Upgrade to v3.1.1 or higher.

### References
[Workers SDK on Github](https://github.com/cloudflare/workers-sdk)
[Wrangler docs](https://developers.cloudflare.com/workers/wrangler/)
[CVE-2023-3348](https://www.cve.org/CVERecord?id=CVE-2023-3348)
Several quadratic complexity bugs may lead to denial of service in Commonmarker (GHSA-7vh7-fw88-wj87)
Published: 2023-08-08T17:12:00Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'commonmarker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.23.10'}]}]}]

## Impact

Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

* [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5)

For more information, consult the release notes for version [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12).

## Mitigation

Users are advised to upgrade to commonmarker version [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10).
Pyramid static view path traversal up one directory (GHSA-j8g2-6fc7-q8f8)
Aliases: CVE-2023-40587
Published: 2023-08-25T18:49:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyramid'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.2'}]}]}]

### Impact

This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be disclosed accidentally is `index.html`.

Example:

```
config.add_static_view(name='static', path='/usr/src/app/static', cache_max_age=0)
```

And directory tree:

```
/usr/src/app \
              | - static \
                          | - file.css
                          | - index.html
                          | - ...
              | - index.html <-- (this file could be disclosed with this bug)
```

### Patches

Pyramid now will reject any path that contains a null-byte out of caution. While valid in directory/file names, we would strongly consider it a mistake to use null-bytes in naming files/directories.

Secondly, Python 3.11, and 3.12 has fixed the underlying issue in `os.path.normpath` to no longer truncate on the first `0x00` found, returning the behavior to pre-3.11 Python, un an as of yet unreleased version, see:

- https://github.com/python/cpython/issues/106242
- https://github.com/python/cpython/pull/106816

At the time the following Python versions are not fixed:

- Python 3.11.0 to 3.11.4
- Python 3.12.0a1 to 3.12.0rc1

Fixes will be available in: Python 3.12.0rc2 or 3.11.5.

Please note that release candidates of Python are not production ready and should not be used for production workloads.

### Workarounds

Use a version of Python 3 that is not affected. Downgrade to Python 3.10 series temporarily, or wait till Python 3.11.5 is released and upgrade to the latest version of Python 3.11 series.

### References

- https://owasp.org/www-community/attacks/Path_Traversal
-  VN: JVN#41113329
-  TN: JPCERT#93311166

### Thanks

- Masashi Yamane of LAC Co., Ltd
Answer Missing Authorization vulnerability (GHSA-v9vc-7x69-c2x8)
Aliases: CVE-2023-4124
Published: 2023-08-03T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}]

Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure (GHSA-rc33-44qp-vpvq)
Aliases: CVE-2023-40349
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:gogs-webhook'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.15'}]}]}]

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.

Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.

As of publication of this advisory, there is no fix.
Netmaker has Hardcoded DNS Secret Key (GHSA-8x8h-hcq8-jwwx)
Aliases: CVE-2023-32077
Published: 2023-08-25T18:38:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gravitl/netmaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/gravitl/netmaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.18.0'}, {'fixed': '0.18.6'}]}]}]

### Impact 
Hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.

### Patches
Issue is patched in 0.17.1, and fixed in 0.18.6+. 

If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users

If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.

### Workarounds
If using 0.17.1, can just pull the latest docker image of backend and restart server.

### References
Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery
Jeecg-boot SQL Injection vulnerability (GHSA-9v66-9239-cqv2)
Aliases: CVE-2023-38905
Published: 2023-08-17T21:30:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.0'}]}]}]

SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the `Benchmark`, `PG_Sleep`, `DBMS_Lock.Sleep`, `Waitfor`, `DECODE`, and `DBMS_PIPE.RECEIVE_MESSAGE` functions.
Jenkins Fortify Plugin HTML injection vulnerability (GHSA-223m-pgcq-f3xg)
Aliases: CVE-2023-4303
Published: 2023-08-22T00:31:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:fortify'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '22.2.39'}]}], 'database_specific': {'last_known_affected_version_range': '<= 22.1.38'}}]

Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method. This results in an HTML injection vulnerability.

Fortify Plugin 22.2.39 removes HTML tags from the error message.
FaucetSDN Ryu Denial of Service Vulnerability (GHSA-5x64-925v-h4gv)
Aliases: CVE-2020-35141
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ryu'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.34'}]}]}]

An issue was discovered in `OFPQueueGetConfigReply` in `parser.py` in FaucetSDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop).
rustls-webpki: CPU denial of service in certificate path building (GHSA-fh2r-99q2-6mmg)
Published: 2023-08-22T18:06:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'rustls-webpki'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.100.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'rustls-webpki'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.101.0'}, {'fixed': '0.101.4'}]}]}]

When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building.

Both TLS clients and TLS servers that accept client certificate are affected.

We now give each path building operation a budget of 100 signature verifications.

The original `webpki` crate is also affected, see [GHSA-8qv2-5vq6-g2g7](https://github.com/advisories/GHSA-8qv2-5vq6-g2g7).

This was previously reported in the original crate <https://github.com/briansmith/webpki/issues/69> and re-reported to us recently.
mlflow vulnerable to OS Command Injection (GHSA-ffw3-6378-cqgp)
Aliases: CVE-2023-4033
Published: 2023-08-01T03:31:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mlflow'}, 'ecosystem_specific': {'affected_functions': ['mlflow.pyfunc.backend.PyFuncBackend.predict']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
zola Path Traversal vulnerability (GHSA-xvv9-5j67-3rpq)
Aliases: CVE-2023-40274
Published: 2023-08-14T03:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'zola'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.13.0'}, {'last_affected': '0.17.2'}]}]}]

An issue was discovered in zola 0.13.0 through 0.17.2. The custom implementation of a web server, available via the "zola serve" command, allows directory traversal. The `handle_request` function, used by the server to process HTTP requests, does not account for sequences of special path control characters (`../`) in the URL when serving a file, which allows one to escape the webroot of the server and read arbitrary files from the filesystem.
OpenNMS Horizon XXE Injection Vulnerability (GHSA-2qc8-r663-v864)
Aliases: CVE-2023-0871
Published: 2023-08-11T18:31:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms.core:org.opennms.core.xml'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '31.0.8'}, {'fixed': '32.0.2'}]}]}]

XXE injection in `/rtc/post/ endpoint` in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to XML external entity (XXE) injection, which can be used for instance to force Horizon to make arbitrary HTTP requests to internal and external services. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Authenticated Local Privilege Escalation vulnerability in Intel Optimization for Tensorflow (GHSA-m2f8-v8q4-3m59)
Aliases: CVE-2023-27506
Published: 2023-08-11T03:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'intel-tensorflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.12'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-intel'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.12'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'intel-tensorflow-avx512'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.12'}]}]}]

Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privilege via local access.
Mattermost fails to sanitize post metadata (GHSA-9rww-66w7-7vjx)
Aliases: CVE-2023-4108
Published: 2023-08-11T09:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.8.7'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.9.0'}, {'fixed': '7.9.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.9.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.10.0'}, {'fixed': '7.10.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.10.3'}}]

Mattermost fails to sanitize post metadata during audit logging, resulting in permalinks' contents being logged.
Esoteric YamlBeans Unsafe Deserialization vulnerability (GHSA-jm7r-4pg6-gf26)
Aliases: CVE-2023-24621
Published: 2023-08-25T21:30:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.esotericsoftware.yamlbeans:yamlbeans'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.15'}]}]}]

An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.
Froxlor vulnerable to business logic errors (GHSA-9rmf-6qgj-g3wj)
Aliases: CVE-2023-4304
Published: 2023-08-11T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.22'}]}]}]

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22
RaspAP Command Injection vulnerability (GHSA-7c28-wg7r-pg6f)
Aliases: CVE-2022-39986
Published: 2023-08-01T15:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'billz/raspap-webgui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'last_affected': '2.8.7'}]}]}]

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the `cfg_id` parameter in `/ajax/openvpn/activate_ovpncfg.php` and `/ajax/openvpn/del_ovpncfg.php`.
langchain Code Injection vulnerability (GHSA-gwqq-6vq7-5j86)
Aliases: CVE-2023-36095
Published: 2023-08-05T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.236'}]}]}]

An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,from_math_prompt(llm).run in the python exec method.
Netmaker IDOR Allows User to Update Other User's Password (GHSA-256m-j5qw-38f4)
Aliases: CVE-2023-32078
Published: 2023-08-25T18:41:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gravitl/netmaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/gravitl/netmaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.18.0'}, {'fixed': '0.18.6'}]}]}]

### Impact
An IDOR vulnerability was found in the user update function. By specifying another user's username it is possible to update the other user's password.

### Patches
Issue is patched in 0.17.1, and fixed in 0.18.6+.

If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users

If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.

### Workarounds
If using 0.17.1, can just pull the latest docker image of backend and restart server.

### References
Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery
Duplicate Advisory: Wallabag user can reset data unintentionally (GHSA-rwpg-4c4c-v3r4)
Published: 2023-08-21T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha.1'}, {'fixed': '2.6.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.6.2'}}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-p8gp-899c-jvq9. This link is maintained to preserve external references.

## Original Description
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
Answer has Weak Password Requirements (GHSA-j63x-f657-2m9g)
Aliases: CVE-2023-4125
Published: 2023-08-03T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
Jenkins Folders Plugin information disclosure vulnerability (GHSA-36hq-v2fc-rpqp)
Aliases: CVE-2023-40338
Published: 2023-08-16T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:cloudbees-folder'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.848.ve3b'}]}]}]

Jenkins Folders Plugin displays an error message when attempting to access the Scan Organization Folder Log if no logs are available.

In Folders Plugin 6.846.v23698686f0f6 and earlier, this error message includes the absolute path of a log file, exposing information about the Jenkins controller file system.

Folders Plugin 6.848.ve3b_fd7839a_81 does not display the absolute path of a log file in the error message.
Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint (GHSA-6xcx-gx7r-rccj)
Aliases: CVE-2023-40024
Published: 2023-08-15T20:04:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'scancodeio'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '32.5.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 32.5.1'}}]

### Summary
In the `/license/` endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

### Details
In the `/license/` endpoint, the `license_details_view` function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the `key` parameter. This vulnerability arises when attempting to access a key with malicious javascript.

```python
def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")
```


### PoC
1. Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

### Impact
Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the `license_details_view` function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.
Archive spoofing vulnerability in borgbackup (GHSA-8fjr-hghr-4m99)
Aliases: CVE-2023-36811
Published: 2023-08-30T20:09:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'borgbackup'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.5'}]}]}]

### Impact
A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository.

The attack requires an attacker to be able to

1. insert files (with no additional headers) into backups
2. gain write access to the repository

This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives.

Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives.

Affected are all borgbackup releases prior to 1.2.5.

Note: CVSS scoring model seemed to badly fit for this case, thus I manually set score to "moderate".

### Patches
The issue has been fixed in borgbackup 1.2.5.
But there was a bug in 1.2.5 upgrade instructions, thus 1.2.6 with an important fix in docs and code was released a day afterwards.

Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the latest version of the change log.

### Workarounds
Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune".

### References

https://github.com/borgbackup/borg/blob/1.2.6/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811
Answer Insufficient Session Expiration vulnerability (GHSA-ggcf-hwxp-rc77)
Aliases: CVE-2023-4126
Published: 2023-08-03T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
PandasAI vulnerable to arbitrary code execution (GHSA-8fp9-43pw-56vw)
Aliases: CVE-2023-39661
Published: 2023-08-15T18:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pandasai'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.8.1'}]}]}]

An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the `_is_jailbreak` function.
OpenRefine Server-Side Request Forgery vulnerability (GHSA-q7mc-fc87-v7w7)
Aliases: CVE-2022-41401
Published: 2023-08-04T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openrefine:main'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.6.0'}]}]}]

OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.
RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling (GHSA-wwrg-2w5j-grvx)
Aliases: CVE-2023-4138
Published: 2023-08-03T18:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'rdiffweb'}, 'ecosystem_specific': {'affected_functions': ['rdiffweb.controller.page_pref_notification.PagePrefNotification']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.1'}]}]}]

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
pandasai vulnerable to prompt injection (GHSA-w832-v3c6-m6rg)
Aliases: CVE-2023-39660
Published: 2023-08-21T18:31:23Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pandasai'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.1'}]}]}]

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
hCaptcha for EXT:form Broken Access Control vulnerability (GHSA-93wx-j2qv-49fg)
Aliases: CVE-2023-41100
Published: 2023-08-23T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'waldhacker/hcaptcha'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.2'}]}]}]

An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. It fails to check that the required captcha field is submitted in the form data. allowing a remote user to bypass the CAPTCHA check.