Skip to content

Commit 0d3fd78

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-66jq-2c23-2xh5 GHSA-xv5p-fjw5-vrj6
1 parent 1a4ea08 commit 0d3fd78

File tree

2 files changed

+176
-0
lines changed

2 files changed

+176
-0
lines changed

‎advisories/github-reviewed/2025/11/GHSA-66jq-2c23-2xh5/GHSA-66jq-2c23-2xh5.json‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-66jq-2c23-2xh5",
4+
"modified": "2025-11-25T20:40:14Z",
5+
"published": "2025-11-25T20:40:13Z",
6+
"aliases": [
7+
"CVE-2025-65942"
8+
],
9+
"summary": "VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM",
10+
"details": "### Impact\nAffected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits.\n\n### Patches\nVersions 1.129.1, 1.122.8, 1.110.23\n\n### Resources\n - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1\n - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8\n - https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23\n \n### Note \nVictoriaMetrics' security model assumes its APIs are properly secured (e.g. via access control flags or a firewall); this advisory addresses malicious input that should not be possible under a [correctly secured](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#security) deployment.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/VictoriaMetrics/VictoriaMetrics"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.123.0"
29+
},
30+
{
31+
"fixed": "1.129.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/VictoriaMetrics/VictoriaMetrics"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "1.111.0"
48+
},
49+
{
50+
"fixed": "1.122.8"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/VictoriaMetrics/VictoriaMetrics"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "1.0.0"
67+
},
68+
{
69+
"fixed": "1.110.23"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-66jq-2c23-2xh5"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/VictoriaMetrics/VictoriaMetrics/commit/51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24"
84+
},
85+
{
86+
"type": "PACKAGE",
87+
"url": "https://github.com/VictoriaMetrics/VictoriaMetrics"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.110.23"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.8"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.129.1"
100+
}
101+
],
102+
"database_specific": {
103+
"cwe_ids": [
104+
"CWE-770"
105+
],
106+
"severity": "LOW",
107+
"github_reviewed": true,
108+
"github_reviewed_at": "2025-11-25T20:40:13Z",
109+
"nvd_published_at": null
110+
}
111+
}

‎advisories/github-reviewed/2025/11/GHSA-xv5p-fjw5-vrj6/GHSA-xv5p-fjw5-vrj6.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xv5p-fjw5-vrj6",
4+
"modified": "2025-11-25T20:39:15Z",
5+
"published": "2025-11-25T20:39:15Z",
6+
"aliases": [
7+
"CVE-2025-62703"
8+
],
9+
"summary": "Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer",
10+
"details": "### Summary\nThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine.\n\n### Details\n_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization.\n\n### PoC\n* Step1:\nThe victim user starts an RPC server binding to open network using the Fugue framework. Here, I use the official RPC server code to initialize the server. \n\n* Step2:\nThe attacker modifies the _encode() function in fugue/rpc/flask.py to inject malicious pickle data:\n\n<img width=\"740\" height=\"260\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6064516b-e1a6-45fa-a91c-8e276bc4a106\" />\n\nIn this example, attacker modifies _encode to let the victim execute command “ls -l”\n\n* Step 3:\nThe attacker then uses the RPC client to send the malicious request\n\nFugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py.\n\n\n### Impact\nRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:\n\n- Complete system compromise\n- Data exfiltration\n- Lateral movement within the network\n- Denial of service attacks\n- Installation of persistent backdoors\n\n### Mitigation\n1. **Replace unsafe deserialization**: Replace `pickle.loads()` with safer alternatives such as:\n - JSON serialization for simple data structures\n - Protocol Buffers or MessagePack for complex data\n - If pickle must be used, implement a custom `Unpickler` with a restricted `find_class()` method that only allows whitelisted classes\n\n2. **Network security**: \n - If the service is intended for internal use only, bind to localhost (`127.0.0.1`) instead of `0.0.0.0`\n - Implement authentication and authorization mechanisms\n\n3. **Security warnings**: When starting the service on public interfaces, display clear security warnings to inform users about the risks.\n\nAttachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "fugue"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.9.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/fugue-project/fugue"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-78"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-11-25T20:39:15Z",
63+
"nvd_published_at": null
64+
}
65+
}

0 commit comments

Comments
 (0)