aswin1906/github-advisory-2023 huggingface dataset:
Apache Airflow Google Provider Improper Input Validation vulnerability (GHSA-h8p2-8g72-qpgh)
Aliases: CVE-2023-25692
Published: 2023-02-24T12:31:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-google'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.10.0'}]}]}]

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
Versionn Command Injection Vulnerability (GHSA-fj78-2vc5-f6cm)
Aliases: CVE-2023-25805
Published: 2023-02-22T00:05:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'versionn'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

### Impact

Command Injection Vulnerability. All versions <1.1.0 are affected.
 
### Patches

Please upgrade to versionn@1.1.0
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics (GHSA-5r5m-65gx-7vrh)
Aliases: CVE-2023-25151
Published: 2023-02-08T22:32:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.38.0'}, {'fixed': '0.39.0'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.38.0'}, {'fixed': '0.39.0'}]}]}]

### Impact

The [v0.38.0](https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.13.0) release of [`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/463c2e7cd69d25f40b0a595b05394eeb26c68ae2/instrumentation/net/http/otelhttp/handler.go#L218) uses the [`httpconv.ServerRequest`](https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159) function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments.

The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not "forget" previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack.

Pseudo-attack:
```
for infinite loop {
  r := generate_random_string()
  do_http_request("/some/path?random="+r)
}
```

### Patches
- `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` - v0.39.0
- `go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego` - v0.39.0

[^1]: https://github.com/open-telemetry/opentelemetry-go/blob/6cb5718eaaed5c408c3bf4ad1aecee5c20ccdaa9/semconv/internal/v2/http.go#L202-L208
Ascii (crate) allows out-of-bounds array indexing in safe code (GHSA-mrrw-grhq-86gf)
Published: 2023-02-28T20:30:10Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ascii'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.6.0'}, {'fixed': '0.9.3'}]}]}]

Affected version of this crate had implementation of `From<&mut AsciiStr>` for `&mut [u8]` and `&mut str`. This can result in out-of-bounds array indexing in safe code.

The flaw was corrected in commit [8a6c779](https://github.com/tomprogrammer/rust-ascii/pull/63/commits/8a6c7798c202766bd57d70fb8d12739dd68fb9dc) by removing those impls.
Withdrawn: wallabag subject to Improper Authorization (GHSA-h45f-rjvw-2rv2)
Published: 2023-02-01T12:32:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha.1'}, {'fixed': '2.5.3'}]}]}]

## Duplicate advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-qwx8-mxxx-mg96](https://github.com/advisories/GHSA-qwx8-mxxx-mg96). This link is maintained to preserve external references.

## Original Description

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
ecdh vulnerable to Exposure of Resource to Wrong Sphere (GHSA-p2hp-3wv3-4w74)
Aliases: CVE-2022-44310
Published: 2023-02-24T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ecdh'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.0'}]}]}]

In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
frp_form_answers allows Cross-site Scripting (GHSA-q3r2-23r8-wqr9)
Aliases: CVE-2023-26091
Published: 2023-02-26T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'frappant/frp-form-answers'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'frappant/frp-form-answers'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.2'}]}]}]

The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.
Microweber Cross-site Scripting vulnerability (GHSA-mv37-xrmc-hf64)
Aliases: CVE-2021-32856
Published: 2023-02-21T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.12'}]}]}]

Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.
IPFS go-unixfsnode subject to DOS via HAMT Decoding Panics (GHSA-4gj3-6r43-3wfc)
Aliases: CVE-2023-23631
Published: 2023-02-10T19:54:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ipfs/go-unixfsnode'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.2'}]}]}]

## Impact

Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic.

This is caused by a bogus fanout parameter in the HAMT directory nodes.
This includes checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the fanout to <= 1024 (to avoid attempts of arbitrary sized allocations).

## Patches
- https://github.com/ipfs/go-unixfsnode/commit/91b3d39d33ef0cd2aff2c95d50b2329350944b68
- https://github.com/ipfs/go-unixfsnode/commit/a4ed723727e0bdc2277158337c2fc0d82802d122

## References

* https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778
* https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r
Denial of Service in dhowden/tag (GHSA-9xm8-8qvc-vw3p)
Aliases: CVE-2020-29242
Published: 2023-02-07T22:41:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/dhowden/tag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20201120070457-d52dcb253c63'}]}]}]

dhowden tag before 0.0.0-20201120070457-d52dcb253c63 allows `panic: runtime error: index out of range` via readPICFrame.
Cross-site scripting in CKEditor5 (GHSA-6p89-3p7c-qrhv)
Aliases: CVE-2022-48110
Published: 2023-02-13T21:31:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ckeditor5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '36.0.0'}]}]}]

CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.

NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set (GHSA-jp7v-3587-2956)
Aliases: CVE-2023-24827
Published: 2023-02-08T21:38:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/anchore/syft'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.69.0'}, {'fixed': '0.70.0'}]}]}]

A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable.

### Impact
The `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key <path-to-key-file>`)  during the signing process while generating an SBOM attestation. 

This vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue.

The credentials are leaked in two ways:
- in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level >= `DEBUG`)
- in the attestation or SBOM only when the `syft-json` format is used 

Note that as of v0.69.0 any generated attestations by the `syft attest` command are uploaded to the OCI registry (if you have write access to that registry) in the same way `cosign attach` is done. This means that any attestations generated for the affected versions of syft when the `SYFT_ATTEST_PASSWORD` environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry.

Example commands run from affected versions of syft that show the credential disclosure:
```bash
$ SYFT_ATTEST_PASSWORD=123456 syft <container-image-or-directory-input> -o syft-json | grep 123456
# "123456" is in the output

$ SYFT_ATTEST_PASSWORD=123456 syft attest <container-image-input> -o syft-json 
$ cosign download attestation <container-image-input> | jq -r '.payload' | base64 -d | grep 123456
# "123456" is in the output
```

### Patches

The patch has been released in v0.70.0.

### Workarounds

There are no workarounds for this vulnerability.

### References

Patch pull request: https://github.com/anchore/syft/pull/1538
github.com/satori/go.uuid has Predictable SIF UUID Identifiers (GHSA-33m6-q9v5-62r7)
Aliases: CVE-2021-3538
Published: 2023-02-07T22:57:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/satori/go.uuid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.1-0.20180103161547-0ef6afb2f6cd'}, {'fixed': '1.2.1-0.20180404165556-75cca531ea76'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/apptainer/sif/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.1-0.20180103161547-0ef6afb2f6cd'}, {'fixed': '1.2.1-0.20180404165556-75cca531ea76'}]}]}]

### Impact

The siftool new command produces predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency.

### Patches

A patch is available in version >= v1.2.1-0.20180404165556-75cca531ea76 of the module. Users are encouraged to upgrade.

Fixed by https://github.com/hpcng/sif/pull/90

### Workarounds

Users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:

`go get -u github.com/satori/go.uuid@v1.2.1-0.20180404165556-75cca531ea76`

### References

https://github.com/satori/go.uuid/issues/73

### For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/hpcng/sif/issues
Mind-elixir Cross-site Scripting vulnerability (GHSA-m22q-97p5-79v2)
Aliases: CVE-2021-32851
Published: 2023-02-21T00:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'mind-elixir'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.18.1'}]}]}]

Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue is patched in version 0.18.1.
Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework (GHSA-6pm2-j2v8-h3cj)
Aliases: CVE-2023-0669
Published: 2023-02-06T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'metasploit-framework'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.0.33'}]}]}]

## Withdrawn
This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.

## Original Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
vantage6 vulnerable to Improper Preservation of Permissions (GHSA-vvjv-97j8-94xh)
Aliases: CVE-2023-22738
Published: 2023-02-28T23:19:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vantage6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.0'}]}]}]

### Impact
Assigning existing users to a different organization is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access.

### Patches
Update to 3.8.0

### Workarounds
None

### References
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [vantage6@iknl.nl](mailto:vantage6@iknl.nl)
GeoTools OGC Filter SQL Injection Vulnerabilities (GHSA-99c3-qc2q-p94m)
Aliases: CVE-2023-25158
Published: 2023-02-22T19:16:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.geotools:gt-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '28.0'}, {'fixed': '28.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.geotools:gt-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '27.0'}, {'fixed': '27.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.geotools:gt-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '26.0'}, {'fixed': '26.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.geotools:gt-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '25.0'}, {'fixed': '25.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.geotools:gt-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '24.7'}]}]}]

### Impact

GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore.

SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations:

1. ``PropertyIsLike`` filter
   * Requires PostGIS DataStore with "encode functions" enabled
   * Or any JDBCDataStore (all relational databases) with String field (no mitigation)
3. ``strEndsWith`` function
   * Requires PostGIS DataStore with "encode functions" enabled
5. ``strStartsWith`` function
   * Requires PostGIS DataStore with "encode functions" enabled
6. ``FeatureId`` filter
   * Requires JDBCDataStore (all relational databases) with prepared statements disabled and table with String primary key (Oracle not affected, SQL Server and MySQL have no settings to enabled prepared statements, PostGIS does)
7. ``jsonArrayContains`` function
   * Requires PostGIS and Oracle DataStore with String or JSON field
8. ``DWithin`` filter
   * Happens only in Oracle DataStore, no mitigation

### Patches

* GeoTools 28.2
* GeoTools 27.4
* GeoTools 26.7
* GeoTools 25.7
* GeoTools 24.7

### Workarounds

Partial mitigation:

* In PostGIS DataStore disable "encode functions"
* In any PostGIS enable "prepared statements" (only database with such settings)

```java
        Map<String, Object> params = new HashMap<>();
        params.put("dbtype", "postgis");
        params.put("host", "localhost");
        params.put("port", 5432);
        params.put("schema", "public");
        params.put("database", "database");
        params.put("user", "postgres");
        params.put("passwd", "postgres");
        params.put("preparedStatements", true ); // mitigation
        params.put("encode functions", false ); // mitigation

        DataStore dataStore = DataStoreFinder.getDataStore(params);
```

### References

* [OGC Filter SQL Injection Vulnerabilities](https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf) (GeoServer)
Apache Airflow Hive Provider Improper Input Validation vulnerability (GHSA-9mwf-mw74-9cv5)
Aliases: CVE-2023-25696
Published: 2023-02-24T12:31:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-hive'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.1.3'}]}]}]

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.
Data Amplification in HashiCorp go-getter (GHSA-jpxj-2jvg-6jv9)
Aliases: CVE-2023-0475
Published: 2023-02-16T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/go-getter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/go-getter/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.2.0'}]}]}]

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
Apache Airflow Google Provider Improper Input Validation vulnerability (GHSA-8g23-2q5p-8866)
Aliases: CVE-2023-25691
Published: 2023-02-24T12:31:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-google'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.10.0'}]}]}]

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system (GHSA-66p8-j459-rq63)
Aliases: CVE-2023-25168
Published: 2023-02-10T23:11:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pterodactyl/wings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pterodactyl/wings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.4'}]}]}]

### Impact

This vulnerability impacts anyone running the affected versions of Wings.  The vulnerability can be used to delete files and directories recursively on the host system.  This vulnerability can be combined with [`GHSA-p8r3-83r8-jwj5`](https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5) to overwrite files on the host system.

In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings.  Information on how the exploitation of this vulnerability works will be released on February 24th, 2023 in North America.

### Patches

This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`.

Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`.

### Workarounds

None at this time.
Open Redirect in Caddy (GHSA-qpm3-vr34-h8w8)
Aliases: CVE-2022-28923
Published: 2023-02-07T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/caddyserver/caddy/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0-beta.1'}]}]}]

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs
Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information (GHSA-w695-p3j5-hrj9)
Aliases: CVE-2023-25956
Published: 2023-02-24T12:31:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-amazon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.2.1'}]}]}]

Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
froxlor is vulnerable to privilege escalation from customer to root via directory-options (GHSA-9fqc-9cpr-w73q)
Aliases: CVE-2023-0671
Published: 2023-02-04T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.10'}]}]}]

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
XML External Entity (XXE) vulnerability in apoc.import.graphml (GHSA-9vx8-f5c4-862x)
Published: 2023-02-24T17:39:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.neo4j.procedure:apoc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.4.0.14'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.neo4j.procedure:apoc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.5.0'}]}]}]

### Impact
A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this.

External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.

Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. 

### Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 4.4.0.14. 

### Workarounds
If you cannot upgrade the library, you can control the [allowlist](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist)  of the  procedures that can be used in your system.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)
* Email us at [security@neo4j.com](mailto:security@neo4j.com)

### Credits
We want to publicly recognise the contribution of Christopher Schneider – State Farm.
dd-plist XML External Entitly vulnerability (GHSA-4jx2-hvqw-93j9)
Aliases: CVE-2016-15026
Published: 2023-02-20T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.googlecode.plist:dd-plist'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.18'}]}]}]

A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The name of the patch is 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.
Header injection in TurboGears (GHSA-8q38-w56m-qq2c)
Aliases: CVE-2019-25101
Published: 2023-02-04T09:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'TurboGears'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.11.11'}]}]}]

A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely. Upgrading to version 1.0.11.11 is able to address this issue. The name of the patch is f68bbaba47f4474e1da553aa51564a73e1d92a84. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220059.
Path Traversal in gin-vue-admin (GHSA-x623-hr8h-7g5v)
Aliases: CVE-2022-47762
Published: 2023-02-03T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/flipped-aurora/gin-vue-admin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.5'}]}]}]

In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Improper Validation of Array Index in GJSON (GHSA-p64j-r5f4-pwwx)
Aliases: CVE-2020-36067
Published: 2023-02-06T23:38:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/tidwall/gjson'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.6'}]}]}]

GJSON < 1.6.6 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
URI validation failure on SVG parsing. Bypass of CVE-2023-23924 (GHSA-56gj-mvh6-rp75)
Aliases: CVE-2023-24813
Published: 2023-02-07T18:16:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dompdf/dompdf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.2'}, {'fixed': '2.0.3'}]}], 'versions': ['2.0.2']}]

### Summary
Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols.

### Details
Dompdf parses the href attribute of `image` tags with the following code:

[`src/Image/Cache.php` line 135-150](https://github.com/dompdf/dompdf/blob/2a8a6b80fcaa5148ace50f35a10979fe00c6a35d/src/Image/Cache.php#L135-L150)
``` php
function ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {
    if (strtolower($name) === "image") {
        $attributes = array_change_key_case($attributes, CASE_LOWER);
        $url = $attributes["xlink:href"] ?? $attributes["href"];
        if (!empty($url)) {
            $inner_full_url = Helpers::build_url($parsed_url["protocol"], $parsed_url["host"], $parsed_url["path"], $url);
            if ($inner_full_url === $full_url) {
                throw new ImageException("SVG self-reference is not allowed", E_WARNING);
            }
            [$resolved_url, $type, $message] = self::resolve_url($url, $parsed_url["protocol"], $parsed_url["host"], $parsed_url["path"], $options);
            if (!empty($message)) {
                throw new ImageException("This SVG document references a restricted resource. $message", E_WARNING);
            }
        }
    }
},
```

As you can see from the code snippet above, it respects `xlink:href` even if `href` is specified.
``` php
$url = $attributes["xlink:href"] ?? $attributes["href"];
```

However, php-svg-lib, which is later used to parse the svg file, parses the href attribute with the following code:

[`src/Svg/Tag/Image.php` line 51-57](https://github.com/dompdf/php-svg-lib/blob/76876c6cf3080bcb6f249d7d59705108166a6685/src/Svg/Tag/Image.php#L51-L57)
``` php
if (isset($attributes['xlink:href'])) {
    $this->href = $attributes['xlink:href'];
}

if (isset($attributes['href'])) {
    $this->href = $attributes['href'];
}
```

Since `href` is respected if both `xlink:href` and `href` is specified, it's possible to bypass the protection on the Dompdf side by providing an empty `xlink:href` attribute.

### Impact
An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes.
Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all (GHSA-mc8h-8q98-g5hr)
Published: 2023-02-24T16:23:59Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'remove_dir_all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.0'}]}]}]

The `remove_dir_all` crate is a Rust library that offers additional features over the Rust standard library `fs::remove_dir_all` function. It suffers the same class of failure as the code it was layering over: TOCTOU race conditions, with the ability to cause arbitrary paths to be deleted by substituting a symlink for a path after the type of the path was checked.

Thanks to the Rust security team for identifying the problem and alerting us to it.
@braintree/sanitize-url Cross-site Scripting vulnerability (GHSA-q8gg-vj6m-hgmj)
Aliases: CVE-2022-48345
Published: 2023-02-24T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@braintree/sanitize-url'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.1'}]}]}]

sanitize-url (aka @braintree/sanitize-url) before 6.0.1 allows XSS via HTML entities.
`pnet_packet` buffer overrun in `set_payload` setters (GHSA-cf4g-fcf8-3cr9)
Published: 2023-02-09T19:27:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'pnet_packet'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.27.2'}]}]}]

As indicated by this [issue](https://github.com/libpnet/libpnet/issues/449#issuecomment-663355987), a buffer overrun is possible in the `set_payload` setter of the various mutable "Packet" struct setters. The offending `set_payload` functions were defined within the struct `impl` blocks in earlier versions of the package, and later by the `packet` macro.

Fixed in the `packet` macro by [this](https://github.com/libpnet/libpnet/pull/455) PR.
Payment information sent to PayPal not necessarily identical to created order (GHSA-vxpm-8hcp-qh27)
Aliases: CVE-2023-23941
Published: 2023-02-03T21:07:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'swag/paypal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.4.4'}]}]}]

### Impact
If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order.

### Patches
The problem has been fixed with version 5.4.4

### Workarounds
Disable the aforementioned payment methods or use the Security Plugin in version >= 1.0.21.

### References
[Shopware blog post](https://news.shopware.com/security-issue-in-paypal-plugin-update-required)
SQL injection in webbuilders-group silverstripe-kapost-bridge (GHSA-32gr-x76g-267w)
Aliases: CVE-2015-10077
Published: 2023-02-10T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'webbuilders-group/silverstripe-kapost-bridge'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.0'}]}]}]

A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The name of the patch is 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.
Miscompilation in cortex-m-rt 0.7.1 and 0.7.2 (GHSA-xw5j-gv2g-mjm2)
Published: 2023-02-14T21:53:37Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'cortex-m-rt'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.7.0'}, {'fixed': '0.7.3'}]}]}]

Version 0.7.1 of the `cortex-m-rt` crate introduced a regression causing the stack to NOT be eight-byte aligned prior to calling `main` (or any other specified entrypoint), violating the [stack ABI of AAPCS32], the default ABI used by all Cortex-M targets. This regression is also present in version 0.7.2 of the `cortex-m-rt` crate.

This regression can cause certain compiler optimizations (which assume the eight-byte alignment) to produce incorrect behavior at runtime. This incorrect behavior has been [observed in real-world applications].

**It is advised that ALL users of `v0.7.1` and `v0.7.2` of the `cortex-m-rt` crate update to the latest version (`v0.7.3`), AS SOON AS POSSIBLE.** Users of `v0.7.0` and prior versions of `cortex-m-rt` are not affected by this regression.

It will be necessary to rebuild all affected firmware binaries, and flash or deploy the new firmware binaries to affected devices.

[stack ABI of AAPCS32]: https://github.com/ARM-software/abi-aa/blob/edd7460d87493fff124b8b5713acf71ffc06ee91/aapcs32/aapcs32.rst#6212stack-constraints-at-a-public-interface
[observed in real-world applications]: https://github.com/peter9477/test2
Privilege escalation in Strongbox (GHSA-mhgm-52vg-pvvc)
Published: 2023-02-16T14:12:04Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.schibsted.security:strongbox-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0'}]}]}]

### Impact
An attacker with read-only access to a Strongbox secret could craft a valid encrypted secret (same id/version). It also makes the audit logs from KMS less useful. The issue is caused by a bug in the underlying AWS Encryption SDK.

By default, the encrypted secrets are stored in DynamoDB and an attacker with read-only access would not be able to write the encrypted secret to DynamoDB. So in practice the impact should be limited for most users.

Strongbox supports storing data in files as an alternative to DynamoDB. If the attacker had write access to where the files are stored they could make the attack work end-to-end. Similarly, any custom storage backend could also be affected.

In order to be backwards compatible Strongbox will not make use of key commitments (another improvement to the AWS Encryption SDK). Strongbox enforces that only one KMS key can be used, and it must match the expected one. This means that an attacker needs write access to both KMS and DynamoDB (or other storage backend) to stage an attack, which is not a scenario Strongbox is designed to protect against.

### Patches
Fixed in version 0.5.0.

### Workarounds
None

### References
- https://github.com/aws/aws-encryption-sdk-java/security/advisories/GHSA-55xh-53m6-936r
- https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#key-commitment
is-url Inefficient Regular Expression Complexity vulnerability (GHSA-p9w8-2mpq-49h9)
Aliases: CVE-2018-25079
Published: 2023-02-04T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'is-url'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.3'}]}]}]

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is an unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The name of the patch is 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.
Authentication Bypass in modoboa (GHSA-rfhw-fm4m-52j6)
Aliases: CVE-2023-0777
Published: 2023-02-10T21:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.3'}]}]}]

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
Answer has Cross-site Scripting vulnerability (GHSA-p7wj-c85f-xq9h)
Aliases: CVE-2023-0741
Published: 2023-02-08T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.
Supplementary groups are not set up properly in github.com/containerd/containerd (GHSA-hmfx-3pcx-653p)
Aliases: CVE-2023-25173
Published: 2023-02-16T14:11:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/containerd/containerd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.18'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/containerd/containerd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.6.0'}, {'fixed': '1.6.18'}]}]}]

### Impact

A bug was found in containerd where supplementary groups are not set up properly inside a container.  If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.

Downstream applications that use the containerd client library may be affected as well.

### Patches
This bug has been fixed in containerd v1.6.18 and v.1.5.18.  Users should update to these versions and recreate containers to resolve this issue.  Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions.

### Workarounds

Ensure that the `"USER $USERNAME"` Dockerfile instruction is not used.  Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups.

### References

- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
- Docker/Moby: CVE-2022-36109, fixed in Docker 20.10.18
- CRI-O: CVE-2022-2995, fixed in CRI-O 1.25.0
- Podman: CVE-2022-2989, fixed in Podman 3.0.1 and 4.2.0
- Buildah: CVE-2022-2990, fixed in Buildah 1.27.1

Note that CVE IDs apply to a particular implementation, even if an issue is common.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2 (GHSA-p4xx-w6fr-c4w9)
Aliases: CVE-2023-25015
Published: 2023-02-02T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'clockwork_web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.2'}]}]}]

Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.
Vulnerable OpenSSL included in sgx-dcap-quote-verify-python (GHSA-344m-qcjq-xgrf)
Published: 2023-02-14T00:30:22Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sgx-dcap-quote-verify-python'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.3'}]}]}]

sgx-dcap-quote-verify-python includes a statically linked copy of OpenSSL. The version of OpenSSL included in sgx-dcap-quote-verify-python 0.0.1..0.0.2 is vulnerable to a security issue. More details about the OpenSSL vulnerabilities themselves can be found at https://www.openssl.org/news/secadv/20230207.txt.

## Analysis
The binding includes OpenSSL version 1.1.1s which is vulnerable to the vulnerabilities disclosed in [OpenSSL Security Advisory from the 7th February 2023](https://www.openssl.org/news/secadv/20230207.txt).
The binding does not directly use OpenSSL. The binding calls the SGX Quote Verification Library which uses OpenSSL.

## Explanation
The SGX Quote Verification Library uses OpenSSL as a dependency to perform its cryptographic operations and certificate verification.

The OpenSSL security advisory mentions multiple vulnerabilities but I believe the most concerning would be CVE-2023-0286 “X.400 address type confusion in X.509 GeneralName”. Its severity is rated high and the advisory states that “this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.”

Relying on CRLs obtained from an untrusted party is exactly what can happen when verifying a quote. For instance, the vulnerability could be triggered through the "sgx_qv_verify_quote" function which can take untrusted quote collateral as input. The quote collateral contains a CRL and certificate chains. The Quote Verification Library uses OpenSSL to verify the validity of those in order to establish the authenticity of the quote. Thus the vulnerability could be exploited with corrupted/forged collateral and quote.

## Impact

According to the advisory the "vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service". Transitively I expect the same to be true for the Quote Verification Library.
The denial of service impact is not much of a concern I believe since processing forged collateral would most likely stop the software from proceeding normally anyway (forged collateral should be rejected). The part regarding the ability to read memory contents, could result in information disclosure which is a real concern. The quote verification happens on the relying party end, which might use it to check enclave authenticity before providing sensitive data, this vulnerability could therefore result in the leakage of sensitive data.
Resource exhaustion in Django (GHSA-2hrw-hx67-34x6)
Aliases: CVE-2023-24580
Published: 2023-02-15T03:30:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.0'}, {'fixed': '3.2.18'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.7'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.10'}]}]}]

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Erxes vulnerable to Cross-site Scripting (GHSA-g9ph-r9hc-34r8)
Aliases: CVE-2021-32853
Published: 2023-02-21T00:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'erxes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.1'}]}]}]

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in all versions. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.
Command injection in Apache Sling (GHSA-gvg3-83q4-rfhq)
Aliases: CVE-2023-25141
Published: 2023-02-14T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sling:org.apache.sling.jcr.base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDNI and RMI. Users of Apache Sling JCR Base are recommended to upgrade to Apache Sling JCR Base 3.1.12 or later, or to run on a more recent JDK.