aswin1906/github-advisory-2023 huggingface dataset:
Anyone with a share link can RESET all website data in Umami (GHSA-8www-cffh-4q98)
Published: 2023-07-28T15:33:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'umami'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.1'}]}]}]

### Summary
Anyone with a share link (permissions to view) can reset the website data.

### Details
When a user navigates to a `/share/` URL, he receives a share token which is used for authentication. This token is later verified by `useAuth`. After the token is verified, the user can call most of the `GET` APIs that allow fetching stats about a website.

The `POST /reset` endpoint is secured using `canViewWebsite` which is the incorrect verification for such destructive action. This makes it possible to completly reset all website data ONLY with view permissions - [permalink](https://github.com/umami-software/umami/blob/7bfbe264852558a148c7741f8637ff2b266d48cd/pages/api/websites/%5Bid%5D/reset.ts#L22)


### PoC
```bash
curl -X POST 'https://analytics.umami.is/api/websites/b8250618-ccb5-47fb-8350-31c96169a198/reset' \
  -H 'authority: analytics.umami.is' \
  -H 'accept: application/json' \
  -H 'accept-language: en-US,en;q=0.9' \
  -H 'authorization: Bearer undefined' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -H 'pragma: no-cache' \
  -H 'referer: https://analytics.umami.is/share/bw6MFhkwpwEXFsbd/test' \
  -H 'sec-ch-ua: "Not.A/Brand";v="8", "Chromium";v="114", "Google Chrome";v="114"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "Linux"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36' \
  -H 'x-umami-share-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ3ZWJzaXRlSWQiOiJiODI1MDYxOC1jY2I1LTQ3ZmItODM1MC0zMWM5NjE2OWExOTgiLCJpYXQiOjE2OTAzNjkxOTl9.zTfwFrfggE5na7rOOgkUobEBm48AH_8WVyh2RgJGzcw' \
  --compressed
```

You can reproduce this by:
* Accessing a website using it's share link
* Copy the `token` received from the the received from the `GET /share/{website-id}`
* Send a POST request to `https://analytics.umami.is/api/websites/b8250618-ccb5-47fb-8350-31c96169a198/reset` with `x-umami-share-token: ` header equal to the token copied in the previous step
* The website data is now cleared

### Impact
Everyone with an open share link exposed to the internet!
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability (GHSA-4q2q-q5pw-2342)
Aliases: CVE-2023-37415
Published: 2023-07-13T09:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-hive'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.2'}]}]}]

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.

Patching on top of CVE-2023-35797
Before 6.1.2 the proxy_user option can also inject semicolon.

This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.

It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.
Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller (GHSA-vx35-f379-4q49)
Aliases: CVE-2023-3574
Published: 2023-07-10T21:53:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/customer-management-framework-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.1'}]}]}]

### Impact
The product performs authorization checks incorrectly when an unauthorized actor tries to access a resource or perform an actions.

The attacker can view and freely perform actions to add, modify, or delete rules.

### Patches
Update to version 3.4.1 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch

### Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch manually.

### References
https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6/
impl `FromMdbValue` for bool is unsound (GHSA-f9g6-fp84-fv92)
Published: 2023-07-19T22:09:38Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'lmdb-rs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.7.6'}]}]}]

The implementation of `FromMdbValue` has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of reproducing the bug are available [here](https://github.com/vhbit/lmdb-rs/issues/67).
Jenkins mabl Plugin vulnerable to cross-site request forgery (GHSA-wvgr-5wgr-c6fj)
Aliases: CVE-2023-37952
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.mabl.integration.jenkins:mabl-integration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.47'}]}]}]

Jenkins mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

mabl Plugin 0.0.47 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Apache ShardingSphere-Agent Deserialization of Untrusted Data vulnerability (GHSA-3cxh-xp3g-jxjm)
Aliases: CVE-2023-28754
Published: 2023-07-19T09:30:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.shardingsphere:shardingsphere'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.4.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.3.2'}}]

Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file.

The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR.
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent.

This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.
KubePi Privilege Escalation vulnerability (GHSA-757p-vx43-fp9r)
Aliases: CVE-2023-37917
Published: 2023-07-21T20:18:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/KubeOperator/kubepi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.5'}]}]}]

### Summary
A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request


### PoC
Change the value of the `isadmin` field in the request to true:
https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview

### Impact
Elevate user privileges
Hard-coded System User Credentials in Folio Data Export Spring module  (GHSA-m8v7-469p-5x89)
Published: 2023-07-25T14:44:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.folio:mod-remote-storage'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.folio:mod-remote-storage'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.2'}]}]}]

### Impact
The module creates a system user that is used to perform internal module-to-module operations.  Credentials for this user are hard-coded in the source code.  This makes it trivial to authenticate as this user, allowing unauthorized read access to these mod-inventory-storage records: instances, holdings, items, contributor-types, identifier-types. This includes records marked as suppressed from discovery.

### Patches
Upgrade mod-remote-storage to >=2.0.3, or a 1.7.x version >=1.7.1.

### Workarounds
No known workarounds.

### References
https://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions
https://github.com/folio-org/mod-remote-storage/commit/57df495f76e9aa5be9ce7ce3a65f89b6dbcbc13b - Fix
CasaOS Gateway vulnerable to incorrect identification of source IP addresses (GHSA-vjh7-5r6x-xh6g)
Aliases: CVE-2023-37265
Published: 2023-07-17T14:36:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/IceWhaleTech/CasaOS-Gateway'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.4'}]}]}]

### Impact

Unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances.

### Patches

The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4.

### Workarounds

Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. 

### References

- 391dd7f
Apache Any23 vulnerable to excessive memory usage (GHSA-2gpr-j5vj-wvh2)
Aliases: CVE-2023-34150
Published: 2023-07-05T09:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.any23:apache-any23'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.7'}]}]}]

Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage.
postgraas-server vulnerable to SQL injection (GHSA-vghm-8cjp-hjw6)
Aliases: CVE-2018-25088
Published: 2023-07-18T15:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'postgraas-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function `_create_pg_connection/create_postgres_db` of the file `postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py` of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability.
Indico vulnerable to Cross-Site-Scripting via confirmation prompts (GHSA-fmqq-25x9-c6hm)
Aliases: CVE-2023-37901
Published: 2023-07-21T20:24:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'indico'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.6'}]}]}]

### Impact
There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico.
Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content.

Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content.

### Patches
You need to update to [Indico 3.2.6](https://github.com/indico/indico/releases/tag/v3.2.6) as soon as possible.
See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.

### Workarounds
Only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management.

Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.

For more information

If you have any questions or comments about this advisory:

* Open a thread in [our forum](https://talk.getindico.io/)
* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
Okio Signed to Unsigned Conversion Error vulnerability (GHSA-w33c-445m-f8w7)
Aliases: CVE-2023-3635
Published: 2023-07-12T21:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.squareup.okio:okio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.0'}]}]}]

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
protobufjs Prototype Pollution vulnerability (GHSA-h755-8qp9-cq85)
Aliases: CVE-2023-36665
Published: 2023-07-05T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'protobufjs'}, 'ecosystem_specific': {'affected_functions': ['protobufjs.util.setProperty']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.2.4'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'protobufjs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.10.0'}, {'fixed': '6.11.4'}]}]}]

protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about `Object.constructor.prototype.<new-property> = ...;` whereas CVE-2022-25878 was about `Object.__proto__.<new-property> = ...;` instead.
Code injection in wix-embedded-mysql (GHSA-fx3v-4w3w-wpwr)
Aliases: CVE-2023-39021
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.wix:wix-embedded-mysql'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.6.2'}]}]}]

wix-embedded-mysql v4.6.2 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
Connection confusion in gRPC (GHSA-cfgp-2977-2fmm)
Aliases: CVE-2023-32731
Published: 2023-07-05T19:12:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.grpc:grpc-protobuf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'grpcio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'grpc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}]

When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in  https://github.com/grpc/grpc/pull/32309
PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket (GHSA-7wrv-6h42-w54f)
Published: 2023-07-14T21:50:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.20.0'}, {'fixed': '4.22.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.2.1'}]}]}]

### Summary
A player sending a packet can cause the server to crash by providing incorrect sign data in NBT in `BlockActorDataPacket`.

### Details
This vulnerability was discovered using the `BlockActorDataPacket`, but other packets may also be affected. The player would seem to just need to send an NBT with an incorrect type to throw this error.

```
[Server thread/CRITICAL]: pocketmine\nbt\UnexpectedTagTypeException: "Expected a tag of type pocketmine\nbt\tag\CompoundTag, got pocketmine\nbt\tag\ByteTag" (EXCEPTION) in "pmsrc/vendor/pocketmine/nbt/src/tag/CompoundTag" at line 107
--- Stack trace ---
  #0 pmsrc/src/network/mcpe/handler/InGamePacketHandler(751): pocketmine\nbt\tag\CompoundTag->getCompoundTag(string[9] FrontText)
  #1 pmsrc/vendor/pocketmine/bedrock-protocol/src/BlockActorDataPacket(50): pocketmine\network\mcpe\handler\InGamePacketHandler->handleBlockActorData(object pocketmine\network\mcpe\protocol\BlockActorDataPacket#220241)
  #2 pmsrc/src/network/mcpe/NetworkSession(433): pocketmine\network\mcpe\protocol\BlockActorDataPacket->handle(object pocketmine\network\mcpe\handler\InGamePacketHandler#190572)
```

### PoC
Use a bot or proxy to send a packet when editing a sign. This packet should contain an NBT with incorrect types but correct architecture.

### Impact
This makes it possible to shutdown a server for someone who knows how to operate it. As this was discovered in 4.22.1, everyone with at least this version is affected.

### Patches
This bug was fixed by 0c250a2ef09627b48aa52302f6cc7e1f2afb70ea in the 4.22.3 and 5.2.1 releases.

### Workarounds
A plugin may be able to handle `DataPacketReceiveEvent` for `BlockActorDataPacket`, and verify that the `FrontText` tag is a `TAG_Compound`.
Apache Camel information exposure vulnerability (GHSA-6g2w-257v-3c9f)
Aliases: CVE-2023-34442
Published: 2023-07-10T18:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.camel:camel-jira'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0-M3'}, {'fixed': '3.14.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.camel:camel-jira'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.15.0'}, {'fixed': '3.18.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.camel:camel-jira'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.20.0'}, {'fixed': '3.20.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.camel:camel-jira'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-M1'}, {'fixed': '4.0.0-RC1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.0.0-M3'}}]

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel. This issue affects Apache Camel from 3.X through <=3.14.8, from 3.18.X through <=3.18.7, from 3.20.X through <= 3.20.5, from 4.X through <= 4.0.0-M3.

Users should upgrade to 3.14.9, 3.18.8, 3.20.6 or 3.21.0 and for users on Camel 4.x update to 4.0.0-RC1
Path Traversal in Apache Shiro (GHSA-pmhc-2g4f-85cg)
Aliases: CVE-2023-34478
Published: 2023-07-24T21:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.shiro:shiro-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.12.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.shiro:shiro-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha-1'}, {'fixed': '2.0.0-alpha-3'}]}]}]

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.

Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
Stylelint has vulnerability in semver dependency (GHSA-f7xj-rg7h-mc87)
Published: 2023-07-07T20:32:55Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'stylelint'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '15.10.1'}]}]}]

### Summary

Our `meow` dependency (which we use for our CLI) depended on `semver@5.7.1 `. A vulnerability in this version of `semver` was recently identified and surfaced by `npm audit`:

Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

### Details

Original post by the reporter:

"my npm audit show the report

semver  <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
No fix available

And my dependencies tree for semver show your package

├─┬ stylelint@15.9.0
│   └─┬ meow@9.0.0
│        └─┬ read-pkg-up@7.0.1
│             └─┬ read-pkg@5.2.0
│                  └─┬ normalize-package-data@2.5.0
│                       └── semver@5.7.1 deduped

I found that meow@10.x.x contains normalize-package-data@5 and I can fix this vulnerability because it uses semver@7.  But I can't update meow to the new major version because your package doesn't allow it."

Update your package to use the 'meow' version >=10"

### PoC

N/A

### Impact

We anticipate the impact to be low as Stylelint is a dev tool and `meow` is only used on the CLI pathway. 

---

⬇️  EDITED AFTER PUBLISHED ⬇️ 

### Security fix backported to older `semver` versions

The same security fix has been backported to older `semver` versions of 5.x and 6.x. See the [CVE-2022-25883](https://github.com/advisories/GHSA-c2qf-rxjj-qqgw) details.

So, you can fix this vulnerability by just updating `semver` in your project's dependency tree, instead of updating `stylelint`. For details, see the example:

`package.json`:

```json
{
  "dependencies": {
    "stylelint": "15.10.0"
  }
}
```

Run `npm audit` (here is no alert for `semver`):

```console
$ npm ci
...

$ npm audit
...
stylelint  8.0.0 - 15.10.0
Stylelint has vulnerability in semver dependency - https://github.com/advisories/GHSA-f7xj-rg7h-mc87
fix available via `npm audit fix --force`
Will install stylelint@15.10.1, which is outside the stated dependency range
node_modules/stylelint

1 low severity vulnerability
...

$ npm ls semver
...
└─┬ stylelint@15.10.0
  └─┬ meow@9.0.0
    ├─┬ normalize-package-data@3.0.3
    │ └── semver@7.5.4
    └─┬ read-pkg-up@7.0.1
      └─┬ read-pkg@5.2.0
        └─┬ normalize-package-data@2.5.0
          └── semver@5.7.2
```
HashiCorp Vault's revocation list not respected (GHSA-9mh8-9j64-443f)
Aliases: CVE-2022-41316
Published: 2023-07-06T19:24:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.10.0'}, {'fixed': '1.10.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.10'}]}]}]

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
Cross-site Scripting in healthcheck webconsole plugin (GHSA-4pvw-g9fx-594r)
Aliases: CVE-2023-38435
Published: 2023-07-25T18:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]


An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack.

Upgrade to Apache Felix Healthcheck Webconsole Plugin 2.1.0 or higher.
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation (GHSA-wmg5-g953-qqfw)
Aliases: CVE-2023-24999
Published: 2023-07-06T19:24:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.10.11'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.4'}]}]}]

When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the `/auth/approle/role/:role_name/secret-id-accessor/destroy` endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999, has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
Apache InLong Deserialization of Untrusted Data Vulnerability (GHSA-c3rh-f2w5-fghm)
Aliases: CVE-2023-31058
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-common'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}]

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the `autoDeserialize` option filtering by adding blanks.  Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674 to solve it.
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats. (GHSA-8c6x-g4fw-8rf4)
Published: 2023-07-10T21:54:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Whatsapp-Chat-Exporter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.9.5'}]}]}]

### Impact
A Cross-Site Scripting (XSS) vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, `autoescape=True` was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offline, an adversary may still be able to inject malicious payloads into the chat through WhatsApp. All users are affected.

### Patches
The vulnerability is patched in 0.9.5. All users are strongly advised to update the exporter to the latest version.

### Workarounds
No workaround is available. Please update the exporter to the latest version.

### References
https://github.com/KnugiHK/WhatsApp-Chat-Exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79
https://owasp.org/www-community/attacks/xss/
Jenkins mabl Plugin missing permission check (GHSA-m9jj-p947-m8xv)
Aliases: CVE-2023-37953
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.mabl.integration.jenkins:mabl-integration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.47'}]}]}]

Jenkins mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

mabl Plugin 0.0.47 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Denial of service in neutron (GHSA-r3jh-qhgj-gvr8)
Aliases: CVE-2023-3637
Published: 2023-07-25T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'neutron'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '22.0.2'}]}]}]

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Pimcore SQL Injection vulnerability (GHSA-rxp5-qwrf-pfv3)
Aliases: CVE-2023-3673
Published: 2023-07-14T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.24'}]}]}]

 SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
Apache InLong has Files or Directories Accessible to External Parties (GHSA-3p9p-59qf-mqwh)
Aliases: CVE-2023-31064
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-workflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}]

Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0.The user in InLong could cancel an application that doesn't belong to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7799 to solve it.
Apache Linkis Unrestricted File Upload vulnerability (GHSA-x84r-jrqm-3hj8)
Aliases: CVE-2023-27602
Published: 2023-07-06T19:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.

We recommend users upgrade the version of Linkis to version 1.3.2. 

For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties

`wds.linkis.workspace.filesystem.owner.check=true`
`wds.linkis.workspace.filesystem.path.check=true`
mx-chain-go's relayed transactions always increment nonce (GHSA-j494-7x2v-vvvp)
Aliases: CVE-2023-34458
Published: 2023-07-13T17:02:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/multiversx/mx-chain-go'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.17'}]}]}]

### Impact
When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain.

### Patches
v1.4.17 and later versions contain the fix for this issue

### Workarounds
there were no workarounds for this issue. The affected account could only wait for the DoS attack to finish as the attack was not free or to attempt to send transactions in a very fast manner so as to compete on the same nonce with the attacker.

### References
For the future understanding of this issue, on v1.4.17 and onwards versions, we have this integration test that addresses the issue and tests the fix. 
https://github.com/multiversx/mx-chain-go/blob/babdb144f1316ab6176bf3dbd7d4621120414d43/integrationTests/vm/txsFee/relayedMoveBalance_test.go#LL165C14-L165C14
Wallabag vulnerable to Allocation of Resources Without Limits or Throttling (GHSA-6qq7-3hqc-p5w4)
Aliases: CVE-2023-3566
Published: 2023-07-10T18:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.5.4'}]}]}]

A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Decidim Cross-site Scripting vulnerability in the external link redirections (GHSA-469h-mqg8-535r)
Aliases: CVE-2023-32693
Published: 2023-07-11T22:47:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'decidim'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.25.0'}, {'fixed': '0.26.7'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.27.0'}, {'fixed': '0.27.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.25.0'}, {'fixed': '0.26.7'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.27.0'}, {'fixed': '0.27.3'}]}]}]

### Impact

The external link feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.

### Patches

The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.7](https://github.com/decidim/decidim/releases/tag/v0.26.7)
Decidim vulnerable to sensitive data disclosure (GHSA-jm79-9pm4-vrw9)
Aliases: CVE-2023-34090
Published: 2023-07-11T22:46:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'decidim'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.27.0'}, {'fixed': '0.27.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim-meetings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.27.0'}, {'fixed': '0.27.3'}]}]}]

Note: added the actual report as a [comment](https://github.com/decidim/decidim/security/advisories/GHSA-jm79-9pm4-vrw9#advisory-comment-81110).

### Summary

Decidim, a platform for digital citizen participation, uses a third-party library named Ransack for filtering certain database collections (e.g., public meetings). By default, this library allows filtering on all data attributes and associations. This allows an unauthenticated remote attacker to exfiltrate non-public data from the underlying database of a Decidim instance (e.g., exfiltrating data from the user table).

### Impact
This issue may lead to Sensitive Data Disclosure.

### Patches
The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3).

### Workarounds
Disable or unpublish all meetings components from your application.
Incorrect Permission Checking for GraphQL Subscriptions (GHSA-gggm-66rh-pp98)
Aliases: CVE-2023-38503
Published: 2023-07-25T23:31:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'directus'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.3'}, {'fixed': '10.5.0'}]}]}]

### Summary

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Access to information you should not have access to when the permissions rely on `$CURRENT_USER` for filtering.

### Details

The permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be receiving according to the permissions.
This can be any collection but out-of-the box the `directus_users` collection is configured with such a permissions filter allowing you to get updates for other users when changes happen.

An example:
```graphql
subscription {
  directus_users_mutated {
    event
    data {
      id
      last_access
      last_page
    }
  }
}
```

### Patches
https://github.com/directus/directus/pull/19155

### Workarounds
Disable GraphQL Subscriptions

### References
Apache InLong Exposure of Resource to Wrong Sphere vulnerability (GHSA-7mhc-76hf-3jp9)
Aliases: CVE-2023-31103
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-dao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-test'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}]

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.  Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7891 to solve it.
Apache Airflow information disclosure vulnerability (GHSA-xvw9-3mhm-xjqq)
Aliases: CVE-2022-46651
Published: 2023-07-12T12:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['airflow.www.views.ConnectionModelView._iter_extra_field_names', 'airflow.www.views.ConnectionModelView.add_columns', 'airflow.www.views.ConnectionModelView.edit_columns', 'airflow.www.views.ConnectionModelView.prefill_form']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Ineffective privileges drop when requesting container network (GHSA-mmx5-32m4-wxvx)
Aliases: CVE-2023-38496
Published: 2023-07-25T13:52:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/apptainer/apptainer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.2.1'}]}]}]

### Impact

Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer 1.2.0-rc.2 has introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges.  The attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems.  Only affects setuid installations of Apptainer.  

### Patches

The security fix https://github.com/apptainer/apptainer/pull/1578 has been included in Apptainer 1.2.1

### Workarounds

There is no known workaround outside of upgrading to Apptainer 1.2.1
Apache Linkis Zip Slip issue (GHSA-pj5j-w7mw-w797)
Aliases: CVE-2023-27603
Published: 2023-07-06T19:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability.


We recommend users upgrade the version of Linkis to version 1.3.2.
Graylog vulnerable to insecure source port usage for DNS queries (GHSA-g96c-x7rh-99r3)
Aliases: CVE-2023-41045
Published: 2023-07-06T20:51:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.graylog2:graylog2-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.graylog2:graylog2-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.9'}]}]}]

### Summary
Graylog utilises only one single source port for DNS queries.

### Details
Graylog seems to bind a single socket for outgoing DNS queries. That socket is bound to a random port number which is not changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered how easy is to carry out DNS cache poisoning attacks. In order to prevent cache poisoning with spoofed DNS responses, it is necessary to maximise the uncertainty in the choice of a source port for a DNS query.


### PoC 

The attached figure shows the source ports distribution difference between Graylog configured to use a data adapter based on DNS queries and ISC Bind.  The source port distribution of the DNS queries sent from Graylog to a recursive DNS name server running Bind (CLIENT_QUERY) are depicted in purple, while the queries sent from the recursive DNS server to the authoritatives (RESOLVER_QUERY) are plotted in green color. As it can be observed, in contrast to ISC Bind which presents a heterogeneous usage of source port, Graylog utilises a single source port.

![image](https://user-images.githubusercontent.com/67056857/242301750-6a5a8d0d-fcd2-40d1-bbd4-73baa8279ed3.png)

### Impact
Although unlikely in many setups, an external attacker could inject forged DNS responses into a Graylog's lookup table cache. In order to prevent this, it is at least recommendable to distribute the DNS queries through a pool of distinct sockets, each of them with a random source port and renew them periodically.



(Credit to Iratxe Niño from Fundación Sarenet and Borja Marcos from Sarenet)
Hard-coded System User Credentials in Folio Data Export Spring module  (GHSA-vf78-3q9f-92g3)
Published: 2023-07-25T13:53:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.folio:mod-data-export-spring'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.folio:mod-data-export-spring'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.4'}]}]}]

### Impact
The module creates a system user that is used to perform internal module-to-module operations.  Credentials for this user are hard-coded in the source code.  This makes it trivial to authenticate as this user, resulting in unauthorized access to potentially dangerous APIs, allowing to view and modify configuration including single-sign-on configuration, to read, add and modify user data, and to read and transfer fees/fines in a patron's account.

### Patches
Upgrade mod-data-export-spring to >=2.0.2, or a 1.5.x version >=1.5.4.

### Workarounds
No known workarounds.

### References
https://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions
https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 - Fix