Skip to content

Commit cb2735e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-j7c9-79x7-8hpr GHSA-jf75-p25m-pw74 GHSA-xq4m-mc3c-vvg3
1 parent c877628 commit cb2735e

File tree

3 files changed

+249
-0
lines changed

3 files changed

+249
-0
lines changed

‎advisories/github-reviewed/2025/12/GHSA-j7c9-79x7-8hpr/GHSA-j7c9-79x7-8hpr.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j7c9-79x7-8hpr",
4+
"modified": "2025-12-03T16:27:59Z",
5+
"published": "2025-12-03T16:27:59Z",
6+
"aliases": [
7+
"CVE-2025-66406"
8+
],
9+
"summary": "step-ca Has Improper Authorization Check for SSH Certificate Revocation",
10+
"details": "## Summary\n\nA security fix is now available for Step CA that resolves a vulnerability affecting deployments configured with the SSHPOP provisioner.\nAll operators running these provisioners should upgrade to the latest release (`v0.29.0`) immediately.\n\nThe issue was discovered and responsibly disclosed by a research team during a security review. There is no evidence of active exploitation.\n\nTo limit exploitation risk during a coordinated disclosure window, we are withholding detailed technical information for now. A full write-up will be published in several weeks.\n\n---\n\n## Embargo List\n\nIf your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.\n\n---\n\n## Acknowledgements\n\nThis issue was identified and reported by Gabriel Departout and Andy Russon, from [AMOSSYS](http://amossys.fr/). This audit was sponsored by [ANSSI](https://cyber.gouv.fr/) (French Cybersecurity Agency) based on [their Open-Source security audit program](https://cyber.gouv.fr/open-source-lanssi#:~:text=Financement%20d%27%C3%A9valuations%20de%20s%C3%A9curit%C3%A9%20de%20logiciels%20libres).\n\n---\n\nStay safe, and thank you for helping us keep the ecosystem secure.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/smallstep/certificates"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.29.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 0.28.4"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/smallstep/certificates/commit/1011f5f5408b470a636f583bf74c0d7bbaf75d72"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/smallstep/certificates/commit/992ff696e95b424a99140bd7edb2144013975059"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/smallstep/certificates"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-285",
62+
"CWE-863"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-03T16:27:59Z",
67+
"nvd_published_at": null
68+
}
69+
}

‎advisories/github-reviewed/2025/12/GHSA-jf75-p25m-pw74/GHSA-jf75-p25m-pw74.json‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jf75-p25m-pw74",
4+
"modified": "2025-12-03T16:28:36Z",
5+
"published": "2025-12-03T16:28:36Z",
6+
"aliases": [
7+
"CVE-2025-66411"
8+
],
9+
"summary": "Coder logs sensitive objects unsanitized",
10+
"details": "## Summary\nWorkspace Agent manifests containing sensitive values were logged in plaintext unsanitized\n\n## Details\nBy default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)\nhttps://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439\n\n[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely\nhttps://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090\n\nAn attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs\n\nThis behavior opened room for unauthorized access and privilege escalation\n\n## Impact\nImpact varies depending on the environment variables set in a given workspace\n\n## Patches\n[Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released & backported:\n- https://github.com/coder/coder/releases/tag/v2.28.4\n- https://github.com/coder/coder/releases/tag/v2.27.7\n- https://github.com/coder/coder/releases/tag/v2.26.5\n\n## Workarounds\nOne potential workaround is to disable Workspace Agent Logs by setting following configuration option\n`CODER_AGENT_LOGGING_HUMAN=/dev/null` \n> platform operators are advised to upgrade their deployments",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/coder/coder/v2"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.26.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/coder/coder/v2"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "2.27.0"
48+
},
49+
{
50+
"fixed": "2.27.7"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/coder/coder/v2"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "2.28.0"
67+
},
68+
{
69+
"fixed": "2.28.4"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/coder/coder/pull/20968"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/coder/coder/commit/06c6abbe0935f9213c1588add60a396da5762e1c"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/coder/coder/commit/a75205a559211c8aa494b1a16750d114b263f24a"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289"
96+
},
97+
{
98+
"type": "PACKAGE",
99+
"url": "https://github.com/coder/coder"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/coder/coder/releases/tag/v2.26.5"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/coder/coder/releases/tag/v2.27.7"
108+
},
109+
{
110+
"type": "WEB",
111+
"url": "https://github.com/coder/coder/releases/tag/v2.28.4"
112+
}
113+
],
114+
"database_specific": {
115+
"cwe_ids": [
116+
"CWE-532"
117+
],
118+
"severity": "HIGH",
119+
"github_reviewed": true,
120+
"github_reviewed_at": "2025-12-03T16:28:36Z",
121+
"nvd_published_at": null
122+
}
123+
}

‎advisories/github-reviewed/2025/12/GHSA-xq4m-mc3c-vvg3/GHSA-xq4m-mc3c-vvg3.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xq4m-mc3c-vvg3",
4+
"modified": "2025-12-03T16:27:19Z",
5+
"published": "2025-12-03T16:27:19Z",
6+
"aliases": [
7+
"CVE-2025-66032"
8+
],
9+
"summary": "Claude Code Command Validation Bypass Allows Arbitrary Code Execution",
10+
"details": "Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass the Claude Code read-only validation and trigger arbitrary code execution. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.\n\nThank you to [RyotaK](hxxps://ryotak.net) from [GMO Flatt Security Inc.](hxxps://flatt.tech/en/) for reporting this issue!",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "@anthropic-ai/claude-code"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.0.93"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/anthropics/claude-code/security/advisories/GHSA-xq4m-mc3c-vvg3"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/anthropics/claude-code"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-20"
51+
],
52+
"severity": "HIGH",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2025-12-03T16:27:19Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)