aswin1906/github-advisory-2023 huggingface dataset:
ginuerzh/gost vulnerable to Timing Attack (GHSA-qjrq-hm79-49ww)
Aliases: CVE-2023-32691
Published: 2023-05-22T19:47:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ginuerzh/gost'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.11.5'}]}]}]

[Timing attacks](https://en.wikipedia.org/wiki/Timing_attack) occur when an attacker can guess a secret by observing a difference in processing time for valid and invalid inputs. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparision function.
More information on this attack type can be found in [this blog post](https://verboselogging.com/2012/08/20/a-timing-attack-in-action). 

# Root Cause Analysis

In this case, the vulnerability occurs due to the following code.

https://github.com/ginuerzh/gost/blob/1c62376e0880e4094bd3731e06bd4f7842638f6a/auth.go#L46-L46

Here, a untrusted input, sourced from a HTTP header, is compared directly with a secret. 
Since, this comparision is not secure, an attacker can mount a side-channel timing attack to guess the password.

# Remediation

This can be easily fixed using a constant time comparing function such as `crypto/subtle`'s `ConstantTimeCompare`. 
An example fix can be found in https://github.com/runatlantis/atlantis/commit/48870911974adddaa4c99c8089e79b7d787fa820 Alternatively, one can apply the patch below

```
From d18cff85e1a565f688f717fd8f2cacea62ff9dbf Mon Sep 17 00:00:00 2001
From: Porcupiney Hairs <porcupiney.hairs@protonmail.com>
Date: Sun, 7 May 2023 01:03:33 +0530
Subject: [PATCH] Fix : Timing attack

---
 auth.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/auth.go b/auth.go
index 1be96e9..be13f23 100644
--- a/auth.go
+++ b/auth.go
@@ -2,6 +2,7 @@ package gost
 
 import (
 	"bufio"
+	"crypto/subtle"
 	"io"
 	"strings"
 	"sync"
@@ -43,7 +44,8 @@ func (au *LocalAuthenticator) Authenticate(user, password string) bool {
 	}
 
 	v, ok := au.kvs[user]
-	return ok && (v == "" || password == v)
+	passOk := subtle.ConstantTimeCompare([]byte(password), []byte(v)) == 0
+	return ok && (v == "" || passOk)
 }
 
 // Add adds a key-value pair to the Authenticator.
-- 
2.25.1

```
Vyper's nonpayable default functions are sometimes payable (GHSA-vxmm-cwh2-q762)
Aliases: CVE-2023-32675
Published: 2023-05-22T20:35:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.8'}]}]}]

### Impact
in contracts with at least one regular nonpayable function, due to the callvalue check being inside of the selector section, it is possible to send funds to the default function by using less than 4 bytes of calldata, even if the default function is marked `nonpayable`. this applies to contracts compiled with vyper<=0.3.7.
```vyper
# @version 0.3.7

# implicitly nonpayable
@external
def foo() -> uint256:
    return 1

# implicitly nonpayable
@external
def __default__():
    # could receive ether here
    pass
```

### Patches
this was fixed by the removal of the global calldatasize check in https://github.com/vyperlang/vyper/commit/02339dfda0f3caabad142060d511d10bfe93c520.

### Workarounds
don't use nonpayable default functions

### References
_Are there any links users can visit to find out more?_
transformers has Insecure Temporary File (GHSA-282v-666c-3fvg)
Aliases: CVE-2023-2800
Published: 2023-05-18T18:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'transformers'}, 'ecosystem_specific': {'affected_functions': ['transformers.utils.hub.download_url']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.30.0'}]}]}]

Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0.
Jenkins Reverse Proxy Auth Plugin cross-site request forgery vulnerability (GHSA-pmmr-r9v2-59p8)
Aliases: CVE-2023-32987
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:reverse-proxy-auth-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.5'}]}]}]

Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier does not require POST requests for a form validation method, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

Reverse Proxy Auth Plugin 1.7.5 requires POST requests for the affected form validation method.
Moodle External Control of File Name or Path vulnerability (GHSA-22gj-8qj2-fj46)
Aliases: CVE-2023-30943
Published: 2023-05-02T21:31:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.0-rc2'}]}]}]

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter (GHSA-fjx5-xm7q-whvj)
Aliases: CVE-2023-30130
Published: 2023-05-12T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.8.1'}]}]}]

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
OpenSearch issue with fine-grained access control during extremely rare race conditions (GHSA-g8xc-6mf7-h28h)
Aliases: CVE-2023-31141
Published: 2023-05-09T21:25:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opensearch.plugin:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.3.10.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.opensearch.plugin:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.7.0.0'}]}]}]

### Impact
There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours.

### Affected versions
OpenSearch 1.0.0-1.3.9 and 2.0.0-2.6.0

### Patched versions
OpenSearch 1.3.10 and 2.7.0

### For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Cross Site Scripting in OpenTSDB (GHSA-9chv-3w6c-jq9w)
Aliases: CVE-2023-25827
Published: 2023-05-03T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.opentsdb:opentsdb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.1'}]}]}]

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a reflected XSS vulnerability with the suggestion endpoint.
Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field (GHSA-g947-422m-hr7p)
Published: 2023-05-10T06:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mhpj-7m7h-8p6x. This link is maintained to preserve external references.

## Original Description
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers (GHSA-6gf5-c898-7rxp)
Aliases: CVE-2023-32070
Published: 2023-05-11T20:37:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.rendering:xwiki-rendering-syntax-xhtml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-core-rendering-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0-milestone-2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.rendering:xwiki-rendering-syntax-html'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.rendering:xwiki-rendering-syntax-html5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-annotation-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}]

### Impact

HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax.

### Patches
This has been patched in XWiki 14.6 RC1.

### Workarounds
There are no known workarounds apart from upgrading to a fixed version.

### References
* https://github.com/xwiki/xwiki-rendering/commit/c40e2f5f9482ec6c3e71dbf1fff5ba8a5e44cdc1
* https://jira.xwiki.org/browse/XRENDERING-663

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
ONOS vulnerable to Cross-site Scripting (GHSA-q63q-hwf6-3mw6)
Aliases: CVE-2023-30093
Published: 2023-05-05T00:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.onosproject:onos-archetypes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9.0'}, {'last_affected': '2.7.0'}]}]}]

A cross-site scripting (XSS) vulnerability in Open Network Operating System (ONOS) from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the authorizationURL parameter of the API documentation dashboard under securityDefinitions > OAuth2 > authorizationURL.
Malware in pre-build binaries of bignum (GHSA-7cgc-fjv4-52x6)
Published: 2023-05-24T16:43:58Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'bignum'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.12.2'}, {'fixed': '0.13.1'}]}]}]

### Impact

bignum releases from v0.12.2 to v0.13.0 (inclusive) used node-pre-gyp to optionally download pre-built binary versions of the addon. These binaries were published on a now-expired S3 bucket which has since been claimed by a malicious third party which is now serving binaries containing malware that exfiltrates data from the user's computer.

### Patches

v0.13.1 does not use node-pre-gyp and does not have support for downloading pre-built binaries in any form, avoiding the risk of malicious downloads.
Jenkins HashiCorp Vault Plugin has improper masking of credentials (GHSA-v3fv-v9m6-26g3)
Aliases: CVE-2023-33001
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.datapipe.jenkins.plugins:hashicorp-vault-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '360.v0a'}]}]}]

Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like `sh` and `bat`, when both of the following conditions are met:

- The credentials are printed in build steps executing on an agent (typically inside a `node` block).

- Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property `org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING`. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

An improvement in Credentials Binding 523.525.vb_72269281873 implements a workaround that applies build log masking even in affected plugins. This workaround is temporary and potentially incomplete, so it is still recommended that affected plugins be updated to resolve this issue.

As of publication of this advisory, there is no fix.
Ingress-nginx `path` sanitization can be bypassed with newline character (GHSA-863x-868h-968x)
Aliases: CVE-2021-25748
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'k8s.io/ingress-nginx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.1'}]}]}]

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
vm2 Sandbox Escape vulnerability (GHSA-whpj-8f3w-67p5)
Aliases: CVE-2023-32314
Published: 2023-05-15T20:50:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.18'}]}]}]

A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`.

### Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches
This vulnerability was patched in the release of version `3.9.18` of `vm2`.

### Workarounds
None.

### References
PoC - https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header (GHSA-mgc4-wqv7-4pxm)
Published: 2023-05-18T17:29:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.14.2'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.13.1'}]}]}]

### Impact

Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.

This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module.

### Workarounds

No workaround is available, users must upgrade.

### References

https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
Apache JSPWiki vulnerable to cross-site scripting on several plugins (GHSA-qvq8-cw7f-m7m4)
Aliases: CVE-2022-46907
Published: 2023-05-25T09:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-main'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.12.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.12.0'}]}]}]

A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.0 or later.
Pimcore Cross-site Scripting (XSS) in Static Routes name field (GHSA-mhpj-7m7h-8p6x)
Aliases: CVE-2023-2616
Published: 2023-05-11T20:29:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.


### Patches
Update to version 10.5.21 or apply this patch manually:
https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch

### Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch

### References
https://huntr.dev/bounties/564cb512-2bcc-4458-8c20-88110ab45801/
go package pydio cells vulnerable to cross-site scripting  (GHSA-wmfc-g86p-fjvr)
Aliases: CVE-2023-2981
Published: 2023-05-30T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pydio/cells'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.1'}]}]}]

A vulnerability, which was classified as problematic, has been found in Abstrium Pydio Cells 4.2.0. This issue affects some unknown processing of the component Chat. The manipulation leads to basic cross site scripting. The attack may be initiated remotely. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230213 was assigned to this vulnerability.
vm2 vulnerable to Inspect Manipulation (GHSA-p5gc-c584-jj6v)
Aliases: CVE-2023-32313
Published: 2023-05-17T03:49:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.18'}]}]}]

In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`.

### Impact
A threat actor can edit options for `console.log`.

### Patches
This vulnerability was patched in the release of version `3.9.18` of `vm2`.

### Workarounds
After creating a vm make the `inspect` method readonly with `vm.readonly(inspect)`.

### References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
User data exposure in Apache InLong (GHSA-h79m-5cm2-278c)
Aliases: CVE-2023-31101
Published: 2023-05-22T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-dao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.7.0'}]}]}]

Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0.  Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7836 to solve it.
Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php (GHSA-g2mc-fqqc-hxg3)
Aliases: CVE-2023-30855
Published: 2023-05-02T16:43:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.18'}]}]}]

### Impact
The impact of this path traversal and arbitrary extension is limited (creation of arbitrary files and appending data to existing files) but when combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver.

### Patches
Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch manually.


### References
https://github.com/pimcore/pimcore/pull/14498
etcd Key name can be accessed via LeaseTimeToLive API (GHSA-3p4g-rcw5-8298)
Aliases: CVE-2023-32082
Published: 2023-05-12T20:19:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/etcd-io/etcd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.26'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/etcd-io/etcd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.5.0'}, {'fixed': '3.5.9'}]}]}]

### Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).

### Patches
< v3.4.26 and < v3.5.9 are affected.

### Workarounds
No.

### Reporter
Yoni Rozenshein
Craft CMS stored XSS in indexedVolumes (GHSA-6qjx-787v-6pxr)
Aliases: CVE-2023-33197
Published: 2023-05-26T13:56:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-RC1'}, {'fixed': '4.4.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.4.5'}}]

### Summary
XSS can be triggered via the Update Asset Index utility

### PoC
1. Access setting tab
2. Create new assets
3. In assets name inject payload: "<script>alert(26)</script>
4. Click Utilities tab
5. Choose all volumes, or volume trigger xss
7. Click Update asset indexes.

XSS will be triggered

Json response volumes name makes triggers the payload

    "session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},

It’s run on every POST request in the utility.

Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
Privilege escalation (PR)/RCE from account through class sheet (GHSA-36fm-j33w-c25f)
Aliases: CVE-2023-32069
Published: 2023-05-11T20:36:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-test-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.3-milestone-3'}, {'fixed': '14.10.4'}]}]}]

### Impact

It's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document.

**Steps to Reproduce:**

1. Edit your user profile with the object editor and add an object of type `DocumentSheetBinding` with value `Default Class Sheet`
1. Edit your user profile with the wiki editor and add the syntax `{{async}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}`
1. Click "Save & View"

**Expected result:**

An error is displayed as the user doesn't have the right to execute the Groovy macro.

**Actual result:**

The text "Hello from groovy!" is displayed at the top of the document.

### Patches

This has been patched in XWiki 15.0-rc-1 and 14.10.4.

### Workarounds

There are no known workarounds for it.

### References

https://jira.xwiki.org/browse/XWIKI-20566
https://github.com/xwiki/xwiki-platform/commit/de72760d4a3e1e9be64a10660a0c19e9534e2ec4

### For more information
If you have any questions or comments about this advisory:
*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
Jenkins WSO2 Oauth Plugin Session Fixation vulnerability (GHSA-xxq2-74hw-vg6m)
Aliases: CVE-2023-33005
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:wso2id-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

As of publication of this advisory, there is no fix.
Dcat-Admin vulnerable to Stored Cross-site Scripting (GHSA-p74v-mwvg-8ghp)
Aliases: CVE-2023-33736
Published: 2023-05-31T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dcat/laravel-admin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.3-beta'}]}]}]

A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
phpMyFAQ vulnerable to stored Cross-site Scripting (GHSA-j657-pjgc-c4h6)
Aliases: CVE-2023-2752
Published: 2023-05-17T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.0-beta'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
proxy denial of service vulnerability (GHSA-mj6p-3pc9-wf5m)
Aliases: CVE-2023-2968
Published: 2023-05-30T18:30:23Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'proxy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.1.1'}]}]}]

A remote attacker can trigger a denial of service in the `socket.remoteAddress` variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception.
ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits (GHSA-95x4-j7vc-h8mf)
Aliases: CVE-2023-26044
Published: 2023-05-17T17:07:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'react/http'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '1.9.0'}]}]}]

### Summary

Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the  `RequestBodyBufferMiddleware` with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests.

### Patches

The supplied patch resolves this vulnerability for ReactPHP.

### Workarounds

- Keeping the request body limit using `RequestBodyBufferMiddleware` sensible will mitigate it.

- Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.

### References

A similar vulnerability was discovered in PHP recently, see also [PHP's security advisory](https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv) (CVE-2023-0662). The fix is based on the [PHP-FPM fix](https://github.com/php/php-src/commit/716de0cff539f46294ef70fe75d548cd66766370#diff-81d659aa9e83177ac08151f99cebf21ab331d22462c72a1039f59947e66f5a35).
Server-Side Template Injection in Camaleon CMS (GHSA-x487-866m-p8hr)
Aliases: CVE-2023-30145
Published: 2023-05-26T15:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'camaleon_cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.4'}]}]}]

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the `formats` parameter.
Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery (GHSA-c9qp-6556-jwwp)
Aliases: CVE-2023-32978
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ldap'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '676.vfa'}]}]}]

Jenkins LDAP Plugin 673.v034ec70ec2b_b_ and earlier does not require POST requests for a form validation method, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.

LDAP Plugin 676.vfa_64cf6b_b_002 requires POST requests for the affected form validation method.
Apache Ranger Hive Plugin missing permissions check (GHSA-vjr2-wpfh-5r9p)
Aliases: CVE-2021-40331
Published: 2023-05-05T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.ranger:ranger-hive-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.4.0'}]}]}]

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled
This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.
Jenkins Code Dx Plugin stores API keys in plain text (GHSA-gpc2-f62m-c6h6)
Aliases: CVE-2023-2632
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:codedx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.

Code Dx Plugin 4.0.0 no longer stores the API keys directly, instead accessing them through its newly added Credentials Plugin integration. Affected jobs need to be reconfigured.
nilsteampassnet/teampass vulnerable to cross-site scripting  (GHSA-h5g9-2p35-54c7)
Aliases: CVE-2023-3009
Published: 2023-05-31T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. This  enables an attacker to inject malicious code into a shared folder, which can then be executed by other users who have access to the folder.
Phishing attack vulnerability by uploading malicious HTML file (GHSA-9prm-jqwx-45x9)
Aliases: CVE-2023-32689
Published: 2023-05-31T23:39:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'parse-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.4.4'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'parse-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.1.1'}]}]}]

### Impact

Phishing attack vulnerability by uploading malicious files. A malicious user could upload a HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain.

An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker.

### Patches

The fix adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to `['.*']` or another custom value to override the default.

### References

- https://github.com/parse-community/parse-server/security/advisories/GHSA-9prm-jqwx-45x9
- https://github.com/parse-community/parse-server/pull/8538 (Parse Server 6)
- https://github.com/parse-community/parse-server/pull/8537 (Parse Server 5)
SSCMS vulnerable to Cross Site Scripting (GHSA-63c6-w556-3h7q)
Aliases: CVE-2023-2862
Published: 2023-05-24T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'SSCMS'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '7.2.1'}]}]}]

A vulnerability, which was classified as problematic, was found in SiteServer CMS up to 7.2.1. Affected is an unknown function of the file `/api/stl/actions/search`. The manipulation of the argument ajaxDivId leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-229818 is the identifier assigned to this vulnerability.
AzuraCast missing brute force prevention (GHSA-4m7v-wr6v-2mw5)
Aliases: CVE-2023-2531
Published: 2023-05-05T03:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'azuracast/azuracast'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.18.3'}]}]}]

The request rate limiting feature on the login page of AzuraCast before version 0.18.3 can be bypassed, which could allow an attacker to brute force login credentials.
in-toto: PGP trust model not (fully) considered (GHSA-jjgp-whrp-gq8m)
Published: 2023-05-11T20:48:15Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'in-toto'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.0'}]}]}]

### Impact

This security advisory lists multiple concerns about how in-toto uses PGP keys. The findings are aggregated here, because they are all eligible to the same mitigation strategy. Note that the findings are rated with different severities (see inline) and the highest score was chosen for this advisory:

- **PGP Key Creation Time Not Validated** (severity: low)
  in-toto does not check, if the validity period of a PGP Key (starting with the key creation time) is in the future, when copying the key from GnuPG to a layout, or when verifying signatures. A validity period in the future is usually a sign of a wrong system clock, meaning it can’t be trusted for verifying the validity period. A MITM attacker who is able to manipulate delivered software products might also be able to control the system time by manipulating NTP. In a scenario where an attacker gained control over two expired subkeys with no overlapping validity period, the attacker could set the system time to a time before the validity period of either key, resulting in both keys being accepted.

- **PGP Key Revocation Not Considered** (severity: medium)
 in-toto does not check PGP revocation signatures, when copying the key from GnuPG to a layout, or when verifying signatures. This means that a key may still be accepted in signatures, even if it has been revoked in GnuPG.

- **PGP Key Usage Flags Not Considered** (severity: low)
  in-toto does not check PGP usage flags, when copying the key from GnuPG to a layout, or when verifying signatures. This means that at a key may still be accepted in signatures, even if it is not permitted to sign data as per its key usage flags.


Security auditors recommend to verify these properties at signature verification time.

However, this is not planned, as in-toto does not rely on PGP’s trust model, because it should not be required to consult with a separate PKI/web-of-trust at verification time. Instead the project owner establishes ultimate trust by adding a PGP public key to a layout, and thus is responsible for its validity, and also to revoke the layout, if the key is no longer trusted. The same is true for PGP public keys used to verify a layout.

The preferred mitigation strategy is to verify these properties when exporting a public key from GnuPG, and to clarify usage documentation that no verification against the PGP trust model is performed afterwards.

### References
- "Handle GPG revocation signatures" -- https://github.com/secure-systems-lab/securesystemslib/issues/190
- "inconsistent use of GnuPG" -- https://github.com/in-toto/in-toto/issues/569
Command injection in OpenTSDB (GHSA-h475-7v3c-26q7)
Aliases: CVE-2023-25826
Published: 2023-05-03T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.opentsdb:opentsdb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.1'}]}]}]

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.
Unrestricted recursion in htmlunit (GHSA-rc44-5cmh-879m)
Aliases: CVE-2023-2798
Published: 2023-05-25T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.htmlunit:htmlunit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.70.0'}]}]}]

Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack. This issue affects HtmlUnit before 2.70.0.
Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability (GHSA-ghpm-mgf5-cv8q)
Aliases: CVE-2023-32995
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.1'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.
Rekor's compressed archives can result in OOM conditions (GHSA-2h5h-59f5-c5x9)
Aliases: CVE-2023-30551
Published: 2023-05-03T21:56:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/sigstore/rekor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}]

## Summary
Two vulnerabilities have been found in Rekor types for archive files JARs and APKs, where Rekor would crash due to out of memory conditions caused by reading archive metadata files into memory without checking their sizes first causing a Denial of Service of Rekor.

These vulnerabilities were found through fuzzing with [OSS-Fuzz](https://google.github.io/oss-fuzz/).

## Vulnerability 1: OOM due to large files in META-INF directory of JAR files.
### Summary
Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large.

### Details
As part of verifying a JAR file, Rekor uses the [relic library](http://github.com/sassoftware/relic) to check that the JAR is signed, the signature verifies, and that the hashes in the signed manifest are all valid. This library function reads files within META-INF/ into memory without checking their sizes, resulting in an OOM if the uncompressed file is sufficiently large. Rekor is also not performing any such checks prior to passing the JAR to this library function.

### Patches
Users should update to the latest version of Rekor, 1.1.1.

### Workaround
There are no workarounds, users should update.

## Vulnerability 2: OOM due to large .SIGN and .PKGINFO files in APK files.
### Summary
Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large.

### Details
When parsing an APK file, Rekor allocates byte slices to read both the .SIGN and .PKGINFO files into memory in order to verify the signature and hashes in the APK. These byte slices are allocated based on the size included in the tar header for each file, with no checks performed on that size. If the size in the header is sufficiently large, either because the uncompressed file is large or the size in the header has been artificially set to a large value, Rekor will crash due to an out of memory panic.

### Patches
Users should update to the latest version of Rekor, 1.1.1.

### Workaround
There are no workarounds, users should update.
VTAdmin users that can create shards can deny access to other functions (GHSA-pqj7-jx24-wj7w)
Aliases: CVE-2023-29195
Published: 2023-05-11T19:40:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'vitess.io/vitess'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.2'}]}]}]

### Impact
Users can either intentionally or inadvertently create a shard containing `/` characters from VTAdmin such that from that point on, anyone who tries to create a new shard from VTAdmin will receive an error. 
Attempting to view the keyspace(s) will also no longer work.
Creating a shard using `vtctldclient` does not have the same problem because the CLI validates the input correctly.

### Patches
v16.0.2, corresponding to [0.16.2 on pkg.go.dev](https://pkg.go.dev/vitess.io/vitess@v0.16.2)

### Workarounds
- Always use `vtctldclient` to create shards, instead of using VTAdmin
- Disable creating shards from VTAdmin using RBAC
- Delete the topology record for the offending shard using the client for your topology server. For example, if you created a shard called `a/b` in keyspace `commerce`, and you are running etcd, it can be deleted by doing something like
```
% etcdctl --endpoints "http://${ETCD_SERVER}" del /vitess/global/keyspaces/commerce/shards/a/b/Shard
```

### References
https://github.com/vitessio/vitess/issues/12842

Found during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).
Ibexa User Settings are accessible on the front-end for anonymous user (GHSA-r3fg-3r88-6x3f)
Published: 2023-05-10T21:25:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ibexa/user'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.4.3'}]}]}]

### Impact
This security advisory is about the user settings, which include things like preferred time zone and number of items per page in item listings. These could be accessed by the anonymous user. This impacted only the anonymous users themselves, and had no impact on logged in users. As such the impact is limited, even if custom user settings have been added, but please consider if this matters for your site. The fix ensures that only logged in users can access their user settings.

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2023-002-user-settings-are-accessible-on-the-front-end-for-the-anonymous-user