Skip to content

Commit 6cf0a92

Browse files
jcburgojcburgo
authored
Merge branch 'github:main' into jcburgo/advisory-improvement-6529
2 parents d110a0f + f79a61c commit 6cf0a92

File tree

8 files changed

+140
-90
lines changed

8 files changed

+140
-90
lines changed

‎advisories/github-reviewed/2025/12/GHSA-6w82-v552-wjw2/GHSA-6w82-v552-wjw2.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-6w82-v552-wjw2",
4-
"modified": "2025-12-09T17:24:21Z",
4+
"modified": "2025-12-10T20:02:23Z",
55
"published": "2025-12-09T17:24:21Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2025-67648"
8+
],
79
"summary": "Shopware Storefront Reflected XSS in Storefront Login Page",
810
"details": "### Impact\n\nBy exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.\n\n### Description\n\nA request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter `waitTime` lacks proper input validation.\n\nThe attack can be tested with the following URL pattern:\n\n```\n/account/login?loginError=1&waitTime=<a%20href%3D\"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing\">Here<%2Fa>\n```\n\nThe same applies to the `errorSnippet` parameter:\n\n```\n/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.\n```",
911
"severity": [

‎advisories/github-reviewed/2025/12/GHSA-9p56-p6mw-w8qc/GHSA-9p56-p6mw-w8qc.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9p56-p6mw-w8qc",
4+
"modified": "2025-12-10T20:05:52Z",
5+
"published": "2025-12-10T18:30:26Z",
6+
"aliases": [
7+
"CVE-2025-67635"
8+
],
9+
"summary": "Jenkins has a Denial of service vulnerability in HTTP-based CLI",
10+
"details": "Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.jenkins-ci.main:jenkins-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.529"
29+
},
30+
{
31+
"fixed": "2.541"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.jenkins-ci.main:cli"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "2.529"
48+
},
49+
{
50+
"fixed": "2.541"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.jenkins-ci.main:jenkins-core"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "2.528.3"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.jenkins-ci.main:cli"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "0"
86+
},
87+
{
88+
"fixed": "2.528.3"
89+
}
90+
]
91+
}
92+
]
93+
}
94+
],
95+
"references": [
96+
{
97+
"type": "ADVISORY",
98+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67635"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://github.com/jenkinsci/jenkins/commit/efa1816322026f2b9235a27eee814bcc7ba0a764"
103+
},
104+
{
105+
"type": "PACKAGE",
106+
"url": "https://github.com/jenkinsci/jenkins"
107+
},
108+
{
109+
"type": "WEB",
110+
"url": "https://www.jenkins.io/security/advisory/2025-12-10/#SECURITY-3630"
111+
}
112+
],
113+
"database_specific": {
114+
"cwe_ids": [
115+
"CWE-404"
116+
],
117+
"severity": "HIGH",
118+
"github_reviewed": true,
119+
"github_reviewed_at": "2025-12-10T20:05:52Z",
120+
"nvd_published_at": "2025-12-10T17:15:55Z"
121+
}
122+
}

‎advisories/github-reviewed/2025/12/GHSA-f4cf-9rvr-2rcx/GHSA-f4cf-9rvr-2rcx.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f4cf-9rvr-2rcx",
4-
"modified": "2025-12-10T18:20:01Z",
4+
"modified": "2025-12-10T20:02:40Z",
55
"published": "2025-12-10T18:20:01Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2025-67717"
8+
],
79
"summary": "Zitadel Discloses the Total Number of Instance Users",
810
"details": "### Summary\n\nZitadel's User Service discloses the total number of instance users to unauthorized users.\n\n### Impact\n\nThe ZITADEL User Service exposes the total number of users within an instance to any authenticated user, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the `totalResult` field constitutes an information disclosure vulnerability that may be sensitive in certain contexts.\n\n### Affected Versions\n\nSystems running one of the following version are affected:\n\n- **4.x**: `4.0.0-rc.1` through `4.7.1`\n- **3.x**: `3.0.0-rc.1` through `3.4.4`\n- **2.x**: `2.44.0` through `2.71.19`\n\n### Patches\n\nThe vulnerability has been addressed in the latest release. The patch resolves the issue and returns the `totalResult` value corresponding to the number of instance users for whom the querying user has read permission.\n\n- 4.x: Upgrade to >=[4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)\n- 3.x: Update to >=[3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5)\n- 2.x: Update to >=[3.4.5](https://github.com/zitadel/zitadel/releases/tag/v3.4.5) (or checkout the workarounds section)\n\n### Workarounds\n\nThe recommended solution is to update Zitadel to a patched version.\n\nIf a version upgrade is not possible, you can enable the `permissionCheckV2` feature on your instance.\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected])\n\n### Credits\n\nThis vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann.\nThe full report will be made public after the complete review.",
911
"severity": [

‎advisories/github-reviewed/2025/12/GHSA-rj35-4m94-77jh/GHSA-rj35-4m94-77jh.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rj35-4m94-77jh",
4-
"modified": "2025-12-05T18:12:51Z",
4+
"modified": "2025-12-10T20:03:48Z",
55
"published": "2025-12-05T18:12:51Z",
66
"aliases": [
77
"CVE-2025-64763"
88
],
99
"summary": "Envoy forwards early CONNECT data in TCP proxy mode",
10-
"details": "## Summary\n\nForwarding of early CONNECT data in TCP proxy mode.\n\n## Details\n\nPer [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies) switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.\n\nThe RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. \n\n## Impact\n\nDe-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.\n\n## Attack vector(s)\nSending data for a CONNECT request before receiving 2xx response.\n\n## Patches\nUsers should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13\n\n## Credits\n\nPatrick Smith ([email protected])",
10+
"details": "## Summary\n\nForwarding of early CONNECT data in TCP proxy mode.\n\n## Details\n\nPer [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies) switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.\n\nThe RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. \n\n## Impact\n\nDe-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.\n\n## Attack vector(s)\nSending data for a CONNECT request before receiving 2xx response.\n\n## Patches\nUsers should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13\n\n## Credits\n\n[chasingimpact](https://github.com/chasingimpact) (Patrick)",
1111
"severity": [
1212
{
1313
"type": "CVSS_V3",

‎advisories/github-reviewed/2025/12/GHSA-wqv2-4wpg-8hc9/GHSA-wqv2-4wpg-8hc9.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-wqv2-4wpg-8hc9",
4-
"modified": "2025-12-10T17:18:37Z",
4+
"modified": "2025-12-10T20:02:32Z",
55
"published": "2025-12-10T17:18:37Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2025-67713"
8+
],
79
"summary": "Miniflux has an Open Redirect via protocol-relative redirect_url",
810
"details": "### Summary\n`redirect_url` is treated as safe when `url.Parse(...).IsAbs()` is false. Protocol-relative URLs like `//ikotaslabs.com` have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites.\n\n### Details\n- `url.Parse(\"//ikotaslabs.com\")` => empty Scheme, Host=\"ikotaslabs.com\".\n- `IsAbs()` returns false for `//ikotaslabs.com`, so the code treats it as allowed.\n- Browser resolves `//ikotaslabs.com` to current-origin scheme (e.g. `https://ikotaslabs.com`), enabling phishing flows after login.\n\n### PoC\n1. Send or visit: `http://localhost/login?redirect_url=//ikotaslabs.com` \n2. Complete normal login flow. \n3. After login the app redirects to `https://ikotaslabs.com` (or `http://` depending on origin).\n\n### Acknowledgements \nThis vulnerability was discovered using the automated vulnerability analysis tools **VulScribe** and **PwnML**. \nThe research and tool development were conducted with support from the **MITOU Advanced Program (未踏アドバンスト事業)**, \nadministered by the **Information-technology Promotion Agency (IPA), Japan**.",
911
"severity": [

‎advisories/github-reviewed/2025/12/GHSA-x93p-w2ch-fg67/GHSA-x93p-w2ch-fg67.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-x93p-w2ch-fg67",
4-
"modified": "2025-12-10T18:20:55Z",
4+
"modified": "2025-12-10T20:02:47Z",
55
"published": "2025-12-10T18:20:55Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2025-67719"
8+
],
79
"summary": "Ibexa User Bundle is missing password change validation",
810
"details": "### Impact\nThe vulnerability is in the password change dialog in the back office. During the transition from v4 to v5 a mistake was made in the validation code which caused the validation of the previous password to not run as expected. This made it possible for a logged in user to change password in the back office without knowing the previous password. For example if someone logs in, leaves their workstation unlocked, and another person uses the same machine.\n\n### Credit\nThe issue was reported to us by Code-Rhapsodie. We thank them for their responsible disclosure!\nhttps://www.code-rhapsodie.fr/\n\n### Patches\n- See \"Patched versions\".\n- https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4\n\n### Workarounds\nNone.",
911
"severity": [

‎advisories/unreviewed/2025/12/GHSA-9p56-p6mw-w8qc/GHSA-9p56-p6mw-w8qc.json‎

Lines changed: 0 additions & 36 deletions
This file was deleted.

‎advisories/unreviewed/2025/12/GHSA-rpr2-4hqj-hc4q/GHSA-rpr2-4hqj-hc4q.json‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

0 commit comments

Comments
 (0)