-
Notifications
You must be signed in to change notification settings - Fork 210
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 2 new CVEs: CVE-2024-28855, CVE-2024-28864 - 0 updated CVEs:
- Loading branch information
cvelistV5 Github Action
committed
Mar 18, 2024
1 parent
10144f7
commit 9a0d022
Showing
4 changed files
with
294 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.0", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-28855", | ||
| "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "GitHub_M", | ||
| "dateReserved": "2024-03-11T22:45:07.686Z", | ||
| "datePublished": "2024-03-18T21:46:47.314Z", | ||
| "dateUpdated": "2024-03-18T21:46:47.314Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "title": "ZITADEL vulnerable to improper HTML sanitization", | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-20", | ||
| "lang": "en", | ||
| "description": "CWE-20: Improper Input Validation", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 8.1, | ||
| "baseSeverity": "HIGH", | ||
| "confidentialityImpact": "HIGH", | ||
| "integrityImpact": "HIGH", | ||
| "privilegesRequired": "NONE", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "REQUIRED", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", | ||
| "version": "3.1" | ||
| } | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj", | ||
| "tags": [ | ||
| "x_refsource_CONFIRM" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-hfrg-4jwr-jfpj" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.41.15", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.41.15" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.42.15", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.42.15" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.43.9", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.43.9" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.44.3", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.44.3" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.45.1", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.45.1" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.46.1", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.46.1" | ||
| }, | ||
| { | ||
| "name": "https://github.com/zitadel/zitadel/releases/tag/v2.47.3", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.47.3" | ||
| } | ||
| ], | ||
| "affected": [ | ||
| { | ||
| "vendor": "zitadel", | ||
| "product": "zitadel", | ||
| "versions": [ | ||
| { | ||
| "version": "< 2.41.15", | ||
| "status": "affected" | ||
| }, | ||
| { | ||
| "version": ">= 2.42.0, < 2.42.15", | ||
| "status": "affected" | ||
| }, | ||
| { | ||
| "version": ">= 2.43.0, < 2.43.9", | ||
| "status": "affected" | ||
| }, | ||
| { | ||
| "version": ">= 2.44.0, < 2.44.3", | ||
| "status": "affected" | ||
| }, | ||
| { | ||
| "version": "= 2.45.0", | ||
| "status": "affected" | ||
| }, | ||
| { | ||
| "version": "= 2.46.0", | ||
| "status": "affected" | ||
| }, | ||
| { | ||
| "version": ">= 2.47.0, < 2.47.4", | ||
| "status": "affected" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "shortName": "GitHub_M", | ||
| "dateUpdated": "2024-03-18T21:46:47.314Z" | ||
| }, | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/template` instead of the `html/template` package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15. An attacker could create a malicious link, where he injected code which would be rendered as part of the login screen. While it was possible to inject HTML including JavaScript, the execution of such scripts would be prevented by the Content Security Policy. Versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and 2.41.15 contain a patch for this issue. No known workarounds are available." | ||
| } | ||
| ], | ||
| "source": { | ||
| "advisory": "GHSA-hfrg-4jwr-jfpj", | ||
| "discovery": "UNKNOWN" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.0", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-28864", | ||
| "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "GitHub_M", | ||
| "dateReserved": "2024-03-11T22:45:07.687Z", | ||
| "datePublished": "2024-03-18T21:49:06.762Z", | ||
| "dateUpdated": "2024-03-18T21:50:26.926Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "title": "[TagAwareCipher] - Decryption Failure (Regex Match)", | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-1333", | ||
| "lang": "en", | ||
| "description": "CWE-1333: Inefficient Regular Expression Complexity", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "HIGH", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 2.6, | ||
| "baseSeverity": "LOW", | ||
| "confidentialityImpact": "LOW", | ||
| "integrityImpact": "NONE", | ||
| "privilegesRequired": "LOW", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "REQUIRED", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", | ||
| "version": "3.1" | ||
| } | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "name": "https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8", | ||
| "tags": [ | ||
| "x_refsource_CONFIRM" | ||
| ], | ||
| "url": "https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8" | ||
| }, | ||
| { | ||
| "name": "https://github.com/IlicMiljan/Secure-Props/issues/20", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/IlicMiljan/Secure-Props/issues/20" | ||
| }, | ||
| { | ||
| "name": "https://github.com/IlicMiljan/Secure-Props/pull/21", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/IlicMiljan/Secure-Props/pull/21" | ||
| }, | ||
| { | ||
| "name": "https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627", | ||
| "tags": [ | ||
| "x_refsource_MISC" | ||
| ], | ||
| "url": "https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627" | ||
| } | ||
| ], | ||
| "affected": [ | ||
| { | ||
| "vendor": "IlicMiljan", | ||
| "product": "Secure-Props", | ||
| "versions": [ | ||
| { | ||
| "version": ">= 1.2.0, < 1.2.2", | ||
| "status": "affected" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", | ||
| "shortName": "GitHub_M", | ||
| "dateUpdated": "2024-03-18T21:50:26.926Z" | ||
| }, | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default." | ||
| } | ||
| ], | ||
| "source": { | ||
| "advisory": "GHSA-rj29-j2g4-77q8", | ||
| "discovery": "UNKNOWN" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters