aswin1906/github-advisory-2023 huggingface dataset:
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements (GHSA-xp5h-f8jf-rc8q)
Aliases: CVE-2023-23913
Published: 2023-06-09T22:41:16Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'actionview'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '6.1.7.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'actionview'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.3'}]}]}]

NOTE: rails-ujs is part of Rails/actionview since 5.1.0.

There is a potential DOM based cross-site scripting issue in rails-ujs
which leverages the Clipboard API to target HTML elements that are
assigned the contenteditable attribute. This has the potential to
occur when pasting malicious HTML content from the clipboard that
includes a data-method, data-remote or data-disable-with attribute.

This vulnerability has been assigned the CVE identifier CVE-2023-23913.

Not affected: < 5.1.0
Versions Affected: >= 5.1.0
Fixed Versions: 6.1.7.3, 7.0.4.3

Impact
  If the specified malicious HTML clipboard content is provided to a
  contenteditable element, this could result in the arbitrary execution
  of javascript on the origin in question.

Releases
  The FIXED releases are available at the normal locations.

Workarounds
  We recommend that all users upgrade to one of the FIXED versions.
  In the meantime, users can attempt to mitigate this vulnerability
  by removing the contenteditable attribute from elements in pages
  that rails-ujs will interact with.

Patches
  To aid users who aren’t able to upgrade immediately we have provided
  patches for the two supported release series. They are in git-am
  format and consist of a single changeset.

* rails-ujs-data-method-contenteditable-6-1.patch - Patch for 6.1 series
* rails-ujs-data-method-contenteditable-7-0.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are
supported at present, and 6.0.Z for severe vulnerabilities.

Users of earlier unsupported releases are advised to upgrade as
soon as possible as we cannot guarantee the continued availability
of security fixes for unsupported releases.

Credits
  We would like to thank ryotak 15 for reporting this!

* rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-main.patch (8.9 KB)
HuTool XML parsing module has blind XXE vulnerability (GHSA-p2qf-9vp6-3jjq)
Aliases: CVE-2023-3276
Published: 2023-06-15T15:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.19'}]}]}]

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.
Joplin Cross-site Scripting vulnerability (GHSA-7grw-xfx6-qhx6)
Aliases: CVE-2023-37298
Published: 2023-06-30T15:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'joplin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.5'}]}]}]

Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
Cilium vulnerable to information leakage via incorrect ReferenceGrant handling (GHSA-r7wr-4w5q-55m6)
Aliases: CVE-2023-34242
Published: 2023-06-16T17:47:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.4'}]}]}]

### Impact

When the [Gateway API](https://docs.cilium.io/en/v1.13/network/servicemesh/gateway-api/gateway-api/) is enabled in Cilium, the absence of a check on the namespace in which a [ReferenceGrant](https://gateway-api.sigs.k8s.io/api-types/referencegrant/) is created could result in Cilium gaining visibility of secrets (including certificates) and services across namespaces.

An attacker on an affected cluster can configure Cilium to use cluster secrets or communicate with services that it should not have access to.

Gateway API functionality is disabled by default.

### Patches

This vulnerability is fixed in Cilium release 1.13.4.

Cilium versions <1.13 are not affected.

### Workarounds

There is no workaround to this issue.

### Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @meyskens for investigating and fixing the issue.

### For more information
If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
py-xml XML External Entity Injection vulnerability (GHSA-j6v2-mwxm-f952)
Aliases: CVE-2020-26709
Published: 2023-06-29T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'py-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Vaadin vulnerable to possible information disclosure of class and method names in RPC response (GHSA-ch48-9r3q-pv7x)
Aliases: CVE-2023-25500
Published: 2023-06-22T20:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.21'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '2.9.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '9.1.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0'}, {'fixed': '23.3.13'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0'}, {'fixed': '24.0.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.1.alpha1'}, {'fixed': '24.1.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.0.24'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '14.10.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0.0'}, {'fixed': '22.1.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0'}, {'fixed': '23.3.14'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0'}, {'fixed': '24.0.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.1.0.alpha1'}, {'fixed': '24.1.0'}]}]}]

### Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

https://vaadin.com/security/cve-2023-25500
pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character (GHSA-4vvm-4w3v-6mr8)
Aliases: CVE-2023-36464
Published: 2023-06-30T20:33:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pypdf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.9.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'PyPDF2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'last_affected': '3.0.1'}]}]}]

### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted text from such a PDF.

Example Code and a PDF that causes the issue:

```python
from pypdf import PdfReader

# https://objects.githubusercontent.com/github-production-repository-file-5c1aeb/3119517/11367871?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230627%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230627T201018Z&X-Amz-Expires=300&X-Amz-Signature=d71c8fd9181c4875f0c04d563b6d32f1d4da6e7b2e6be2f14479ce4ecdc9c8b2&X-Amz-SignedHeaders=host&actor_id=1658117&key_id=0&repo_id=3119517&response-content-disposition=attachment%3Bfilename%3DMiFO_LFO_FEIS_NOA_Published.3.pdf&response-content-type=application%2Fpdf
reader = PdfReader("MiFO_LFO_FEIS_NOA_Published.3.pdf")
page = reader.pages[0]
page.extract_text()
```

The issue was introduced with https://github.com/py-pdf/pypdf/pull/969

### Patches

The issue was fixed with https://github.com/py-pdf/pypdf/pull/1828

### Workarounds

It is recommended to upgrade to `pypdf>=3.9.0`. PyPDF2 users should migrate to pypdf.

If you cannot update your version of pypdf, you should modify `pypdf/generic/_data_structures.py`:

```
OLD: while peek not in (b"\r", b"\n"):
NEW: while peek not in (b"\r", b"\n", b""):
```
xml-rs vulnerable to denial of service via invalid token in XML document (GHSA-7gf7-jv65-wjmh)
Aliases: CVE-2023-34411
Published: 2023-06-05T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'xml-rs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.9'}, {'fixed': '0.8.14'}]}]}]

The xml-rs crate >= 0.8.9 and < 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to (GHSA-4g8v-vg43-wpgf)
Aliases: CVE-2023-28362
Published: 2023-06-29T15:03:16Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.7.4'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.5.1'}]}]}]

The `redirect_to` method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4

# Impact

This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).

# Releases

The FIXED releases are available at the normal locations.

# Workarounds

Avoid providing user supplied URLs with arbitrary schemes to the `redirect_to` method.
Whaleal IceFrog is vulnerable to deserialization  (GHSA-rx62-5cw6-x29q)
Aliases: CVE-2023-3308
Published: 2023-06-18T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.whaleal.icefrog:icefrog-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.8'}]}]}]

Whaleal IceFrog v1.1.8 component Aviator Template Engine is vulnerable to deserialization of untrusted data. The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
OpenFGA vulnerable to denial of service due to circular relationship (GHSA-hr9r-8phq-5x8j)
Aliases: CVE-2023-35933
Published: 2023-06-28T22:49:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openfga/openfga'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}]

### Overview

OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when certain Check and ListObjects calls are executed against authorization models that contain circular relationship definitions.

### Am I Affected?

You are affected by this vulnerability if you are using OpenFGA v1.1.0 or earlier, and if you are executing certain [Check](https://openfga.dev/api/service#/Relationship%20Queries/Check) or [ListObjects](https://openfga.dev/api/service#/Relationship%20Queries/ListObjects) calls against a vulnerable authorization model. To see which of your models could be vulnerable to this attack, download OpenFGA v1.2.0 and run the following command: 

```
./openfga validate-models --datastore-engine <ENGINE> --datastore-uri <URI> | jq .[] | select(.Error | contains("loop"))
```

replacing the variables `<ENGINE>` and `<URI>` as needed.

### Fix

Upgrade to v1.1.1.

### Backward Compatibility

If you are not passing an invalid authorization model (as identified by running `./openfga validate-models`) as a parameter of your Check and ListObjects calls, this upgrade is backwards compatible. 

Otherwise, OpenFGA v1.1.1 will start returning HTTP 400 status codes on those calls.
FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption (GHSA-whj9-m24x-qhhp)
Aliases: CVE-2023-35925
Published: 2023-06-22T20:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.fastasyncworldedit:FastAsyncWorldEdit-Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.fastasyncworldedit:FastAsyncWorldEdit-Bukkit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

### Coordinated Disclosure Timeline

- 10.06.2023: Issue reported to IntellectualSites
- 11.06.2023: Issue is acknowledged
- 12.06.2023: Issue has been fixed
- 22.06.2023: Advisory has been published

### Impacted version range

Before 2.6.3

### Details

#### Proof of Concept

As a user, do the following:

1. Select position 1 via `//pos1`
2. Select position 2 adding the "Infinity" keyword via `//pos2 Infinity`
3. Execute any further operation.

The steps 1 and 2 are interchangeable.

#### Impact

Such a task has a possibility of bringing the performing server down.

#### CVE

- CVE-2023-35925

#### Credit

This issue was discovered and [reported](https://github.com/IntellectualSites/.github/blob/main/SECURITY.md) by @SuperMonis.

### Solution

On June 12, 2023, a patch, https://github.com/IntellectualSites/FastAsyncWorldEdit/pull/2285, has been merged addressing the vulnerability.
We strongly recommend users to update their version of FastAsyncWorldEdit to 2.6.3 as soon as possible.

### Workarounds

There is no direct mitigation besides updating FastAsyncWorldEdit to a patched version.

### Additional Information

Users with access to the `logs/` folder or shell access on their server can try to identify possible abuses of this issue by going through the logs.
To sieve through the data, you can use the regex query `\/\/pos[12] Infinity`, then investigate all log entries that return results.

### Disclosure Policy

If you discover a security vulnerability within our software, please report the issue according to our [vulnerability disclosure policy](https://github.com/IntellectualSites/.github/blob/main/SECURITY.md).
dottie vulnerable to Prototype Pollution (GHSA-4gxf-g5gf-22h4)
Aliases: CVE-2023-26132
Published: 2023-06-10T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'dottie'}, 'ecosystem_specific': {'affected_functions': ['dottie.set']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.4'}]}]}]

Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the `set()` function and the current variable in the `/dottie.js` file.
org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption (GHSA-9849-p7jc-9rmv)
Aliases: CVE-2022-24839
Published: 2023-06-22T19:58:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.nokogiri:nekohtml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.22.noko2'}]}]}]

## Summary

The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.

## Severity

The maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

## Mitigation

Upgrade to `>= 1.9.22.noko2`.

## Credit

This vulnerability was reported by [이형관 (windshock)](https://www.linkedin.com/in/windshock/).

## References

[CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption

## Notes

The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
RedCloth Regular Expression Denial of Service issue (GHSA-qcm3-vfq5-wfr2)
Aliases: CVE-2023-31606
Published: 2023-06-06T18:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'RedCloth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.2'}]}]}]

A Regular Expression Denial of Service (ReDoS) issue was discovered in the `sanitize_html` function of RedCloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Moodle vulnerable to Cross-site Scripting (GHSA-fwfj-8p36-rc64)
Aliases: CVE-2023-35131
Published: 2023-06-22T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.1'}]}], 'versions': ['4.2.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.9'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.11.15'}]}]}]

Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
JSONUtil vulnerable to stack exhaustion (GHSA-w2rr-wvh9-m2m7)
Aliases: CVE-2023-34615
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.pwall.json:jsonutil'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.0'}]}]}]

An issue was discovered JSONUtil through 5.0 that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
Admidio Improper Access Control vulnerability (GHSA-x3m2-3pwj-8fj4)
Aliases: CVE-2023-3304
Published: 2023-06-23T15:30:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'admidio/admidio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.9'}]}]}]

Admidio prior to 4.2.9 is vulnerable to Improper Access Control.
Shopware dependency configuration exposed (GHSA-q97c-2mh3-pgw9)
Aliases: CVE-2023-34098
Published: 2023-06-28T22:33:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/shopware'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.6.0'}, {'fixed': '5.7.18'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.7.17'}}]

### Impact
Due to a wrong configuration in the `.htaccess` file, the configuration file of Javascript dependencies could be read in production environments (`themes/package-lock.json`). With this information, the used Shopware version might be determined by an attacker, which could be used for further attacks. 

### Patches
We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page.
https://github.com/shopware5/shopware/releases/tag/v5.7.18

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
XWiki Platform vulnerable to persistent Cross-site Scripting through CKEditor Configuration pages (GHSA-793w-g325-hrw2)
Aliases: CVE-2023-36477
Published: 2023-06-30T20:40:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-ckeditor-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.6-rc-1'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.contrib:application-ckeditor-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9'}, {'fixed': '1.64.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-ckeditor-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1'}]}]}]

### Effect
Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as
- removing technical documents, leading to loss of service
- Editing the javascript configuration of CKEditor, leading to persistent XSS

### Patches
This issue has been patched in XWiki 14.10.6 and XWiki 15.1.
This issue has been patched on the CKEditor Integration extension 1.64.9 for XWiki version older than 14.6RC1.

### Workarounds
The issue can be fixed manually by restricting the `edit` and `delete` rights to a trusted user or group (e.g. the `XWiki.XWikiAdminGroup` group), implicitly disabling those rights for all other users.
See https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f

### References
- https://jira.xwiki.org/browse/XWIKI-20590
- https://jira.xwiki.org/browse/CKEDITOR-508
- https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f


### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
Incomplete Internal State Distinction in GRPCWebToHTTP2ServerCodec (GHSA-2jx2-qcm4-rf9h)
Aliases: CVE-2021-36153
Published: 2023-06-09T19:32:18Z
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/grpc/grpc-swift'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}]

### Impact

Affected gRPC Swift servers are vulnerable to precondition failures when parsing certain gRPC Web requests. This may lead to a denial of service.

### Patches

The problem has been fixed in 1.2.0.

### Workarounds

No workaround is available. Users must upgrade.
json-io vulnerable to stack exhaustion (GHSA-779h-3r69-4f5p)
Aliases: CVE-2023-34610
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.cedarsoftware:json-io'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.14.0'}]}]}]

An issue was discovered json-io through 4.14.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that have deeply nested structures.
URI gem has ReDoS vulnerability (GHSA-hww2-5g85-429m)
Aliases: CVE-2023-36617
Published: 2023-06-29T15:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.11.0'}, {'fixed': '0.12.2'}]}]}]

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with `rfc2396_parser.rb` and `rfc3986_parser.rb`.

NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

[The Ruby advisory recommends](https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/) updating the uri gem to 0.12.2. In order to ensure compatibility with the bundled version in older Ruby series, you may update as follows instead:
- For Ruby 3.0: Update to uri 0.10.3
- For Ruby 3.1 and 3.2: Update to uri 0.12.2.

You can use gem update uri to update it. If you are using bundler, please add gem `uri`, `>= 0.12.2` (or other version mentioned above) to your Gemfile.
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees (GHSA-wprv-93r4-jj2p)
Aliases: CVE-2023-34459
Published: 2023-06-19T19:46:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.7.0'}, {'fixed': '4.9.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts-upgradeable'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.7.0'}, {'fixed': '4.9.2'}]}]}]

### Impact

When the `verifyMultiProof`, `verifyMultiProofCalldata`, `processMultiProof`, or `processMultiProofCalldata` functions are in use, it is possible to construct merkle trees that allow forging a valid multiproof for an arbitrary set of leaves.

A contract may be vulnerable if it uses multiproofs for verification and the merkle tree that is processed includes a node with value 0 at depth 1 (just under the root). This could happen inadvertently for balanced trees with 3 leaves or less, if the leaves are not hashed. This could happen deliberately if a malicious tree builder includes such a node in the tree.

A contract is not vulnerable if it uses single-leaf proving (`verify`, `verifyCalldata`, `processProof`, or `processProofCalldata`), or if it uses multiproofs with a known tree that has hashed leaves. Standard merkle trees produced or validated with the [@openzeppelin/merkle-tree](https://github.com/OpenZeppelin/merkle-tree) library are safe.

### Patches

The problem has been patched in 4.9.2.

### Workarounds

If you are using multiproofs: When constructing merkle trees hash the leaves and do not insert empty nodes in your trees. Using the [@openzeppelin/merkle-tree](https://www.npmjs.com/package/@openzeppelin/merkle-tree) package eliminates this issue. Do not accept user-provided merkle roots without reconstructing at least the first level of the tree. Verify the merkle tree structure by reconstructing it from the leaves.
alist Incorrect Access Control vulnerability (GHSA-hh54-53m7-7ffj)
Aliases: CVE-2023-33498
Published: 2023-06-07T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/alist-org/alist/v3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.16.3'}]}]}]

alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.
Snowflake Connector .Net Command Injection (GHSA-223g-8w3x-98wr)
Aliases: CVE-2023-34230
Published: 2023-06-09T22:40:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Snowflake.Data'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.18'}]}]}]

### Issue
Snowflake was informed via our bug bounty program of a command injection vulnerability in the Snowflake .NET driver via SSO URL authentication.

### Impacted driver package: 
snowflake-connector-net

### Impacted version range: 
before [Version 2.0.18](https://community.snowflake.com/s/article/Dot-NET-Driver-Release-Notes)

### Attack Scenario
In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. 

This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources.  

### Solution
On December 2nd, 2022, Snowflake merged a patch that fixed a command injection vulnerability in the Snowflake .NET driver via SSO URL authentication. The vulnerability affected the Snowflake .NET driver before Version 2.0.18. We strongly recommend upgrading to the latest driver version as soon as possible via the following resources: [Snowflake .NET Driver](https://docs.snowflake.com/en/developer-guide/dotnet/dotnet-driver).

### Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients (GHSA-3qh5-qqj2-c78f)
Aliases: CVE-2023-2422
Published: 2023-06-30T20:31:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.1.2'}]}]}]

When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients.
Doorkeeper Improper Authentication vulnerability (GHSA-7w2c-w47h-789w)
Aliases: CVE-2023-34246
Published: 2023-06-12T19:50:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'doorkeeper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.6.6'}]}]}]

OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6

> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**

But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.

Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589

Fix https://github.com/doorkeeper-gem/doorkeeper/pull/1646
Apache Airflow vulnerable to exposure of sensitive information (GHSA-mjff-wv85-hmcj)
Aliases: CVE-2023-35005
Published: 2023-06-19T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.6.2'}]}]}]

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.

This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive.

This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
Ouroboros is Unsound (GHSA-87mf-9wg6-ppf8)
Published: 2023-06-12T18:52:23Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ouroboros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.0'}]}]}]

In 0.15.0 and prior, Ouroboros works internally by creating a struct where all uses of 'this are replaced by 'static. However, a recent addition to Miri checks that references passed to functions are valid during the entire execution of the function, even when those references are passed inside a struct. This poses an issue for dropping self-referencing values, as the reference becomes invalid during the dropping process. Effectively, since self-referencing structs are not allowed in vanilla Rust, there is no allowance for dropping data during a function that has also been given a reference to that data. There's usually no way to pass a and &a to the same function.

A fix was attempted, where the struct would be turned in to a raw byte array and only transformed back into the underlying data type inside each function. This is allowable as a reference can be created and die over the body of a function, as long as the reference was created inside the function. However, this is also not sound if the original struct contains padding. There is no way to initialize padding bytes to a known value that Miri will accept, so when it is cast to an array some of the bytes contain uninitialized values. This is not acceptable (despite the fact that these bytes are never read) due to the potential for optimizations that may read from the uninitialized bytes. Besides which, this fix does not allow for template or constant parameters as there is no way to check the size of a templated type without giving specific, concrete values for the template parameters.

The final solution was to use this fix while wrapping the raw byte array in MaybeUninit<>.
cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability (GHSA-7c94-gvvj-r3mg)
Published: 2023-06-05T20:36:58Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cheqd/cheqd-node'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.2'}]}]}]

### Impact
This vulnerability affects the [`ibc-go` package for those running full nodes, dubbed "Huckleberry"](https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731). According to their advisory:

> This issue is low-severity in general, and it has a low impact and likelihood of exploitation. Depending on how a full node is architected, this issue could potentially yield a high or critical severity vulnerability.

There is no vulnerability in the DID/resource modules for cheqd-node.

### Patches
Node operators are requested to upgrade to [cheqd-node v1.4.2](https://github.com/cheqd/cheqd-node/releases/tag/v1.4.2). This is a non-state breaking release, and does not require a coordinated upgrade across all node operators.

### Workarounds
No. Node operators are recommended to upgrade to the latest release version.

### References
- ["Huckleberry" IBC security advisory](https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731)
- [`ibc-go` v6.1.1 release notes](https://github.com/cosmos/ibc-go/releases/tag/v6.1.1)
Casdoor Cross-Site Request Forgery vulnerability (GHSA-rwcp-qrwg-56cg)
Aliases: CVE-2023-34927
Published: 2023-06-22T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/casdoor/casdoor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.331.0'}]}]}]

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint `/api/set-password`. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances (GHSA-rqjq-ww83-wv5c)
Aliases: CVE-2023-2816
Published: 2023-06-03T00:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/consul'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.15.0'}, {'fixed': '1.15.3'}]}]}]

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
YARP Denial of Service Vulnerability (GHSA-jrjw-qgr2-wfcg)
Aliases: CVE-2023-33141
Published: 2023-06-23T21:37:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Yarp.ReverseProxy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.1.1'}}, {'package': {'ecosystem': 'NuGet', 'name': 'Yarp.ReverseProxy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.1'}]}], 'versions': ['2.0.0']}]

### Impact
A denial of service vulnerability exists in YARP.

### Patches
If you're using YARP 1.x, you should update to NuGet package version [1.1.2](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2).
If you're using YARP 2.0.0, you should update to NuGet package version [2.0.1](https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1).


You can do so by updating the `PackageReference` in your `.csproj` file
```diff
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="2.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="2.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.1" />
</ItemGroup>
```
or by selecting `2.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)

### References

[CVE-2023-33141](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141)
Admidio Improper Access Control vulnerability (GHSA-vmxg-wx6c-4f3r)
Aliases: CVE-2023-3303
Published: 2023-06-23T15:30:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'admidio/admidio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.9'}]}]}]

Admidio prior to 4.2.9 is vulnerable to Improper Access Control.
Craft CMS vulnerable to HTML injection (GHSA-m3v5-gjj9-rg24)
Aliases: CVE-2023-33495
Published: 2023-06-20T15:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.4.9'}]}]}]

Craft CMS through 4.4.9 is vulnerable to HTML Injection.
Denial of service via HTTP/2 HEADERS frames padding (GHSA-q36x-r5x4-h4q6)
Aliases: CVE-2022-0618
Published: 2023-06-09T19:32:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'https://github.com/apple/swift-nio-http2.git'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.20'}]}]}]

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.2. It is fixed in 1.20.0 and later releases.

This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the frame contains padding information without any other data. This logical error caused confusion about the size of the frame, leading to a parsing error. This parsing error immediately crashes the entire process.

Sending a HEADERS frame or PUSH_PROMISE frame with HTTP/2 padding information does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack.

The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames, so attackers require very few resources to achieve a substantial denial of service.

The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code, so the crash is safe. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks.

The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services.

The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.
Guava vulnerable to insecure use of temporary directory (GHSA-7g45-4rm6-3mm3)
Aliases: CVE-2023-2976
Published: 2023-06-14T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.google.guava:guava'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0'}, {'fixed': '32.0.0'}]}]}]

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.
jjson vulnerable to stack exhaustion (GHSA-75m3-f4hr-2vh9)
Aliases: CVE-2023-35110
Published: 2023-06-14T15:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'de.grobmeier.json:jjson'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.7'}]}]}]

An issue was discovered jjson through 0.1.7 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template (GHSA-834c-x29c-f42c)
Aliases: CVE-2023-35156
Published: 2023-06-22T19:59:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0-rc-1'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-0'}, {'fixed': '15.1'}]}]}]

### Impact

Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as:

> xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain)

This vulnerability exists since XWiki 6.0-rc-1.

### Patches

The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. 

### Workarounds

It's possible to workaround the vulnerability by editing the template delete.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

### References

  * Jira ticket about the original vulnerability: https://jira.xwiki.org/browse/XWIKI-20341
  * Commit containing the first fix in the template: https://github.com/xwiki/xwiki-platform/commit/e80d22d193df364b07bab7925572720f91a8984a
  * Jira ticket about the second part of the vulnerability found after 14.10.5: https://jira.xwiki.org/browse/XWIKI-20672
  * Commits containing the second fix in the template: 
    * https://github.com/xwiki/xwiki-platform/commit/13875a6437d4525ac4aeea25918f2d2dffac9ee1
    * https://github.com/xwiki/xwiki-platform/commit/24ec12890ac7fa6daec8d0b3435cfcba11362fd5
  * Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported by René de Sain @renniepak.