Skip to content

Commit da03137

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2r4h-8jxv-w2j8 GHSA-c6cm-5gc7-c3f4 GHSA-rg35-5v25-mqvp
1 parent 9c9bf5e commit da03137

File tree

3 files changed

+146
-8
lines changed

3 files changed

+146
-8
lines changed

‎advisories/github-reviewed/2025/10/GHSA-2r4h-8jxv-w2j8/GHSA-2r4h-8jxv-w2j8.json‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2r4h-8jxv-w2j8",
4+
"modified": "2025-10-29T15:34:22Z",
5+
"published": "2025-10-29T15:34:22Z",
6+
"aliases": [
7+
"CVE-2025-54384"
8+
],
9+
"summary": "CKAN vulnerable to stored XSS in resource description",
10+
"details": "### Impact\n\nThe `helpers.markdown_extract()` function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector.\n\n### Patches\nThis vulnerability has been fixed in CKAN 2.10.9 and 2.11.4",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "ckan"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.11.0"
29+
},
30+
{
31+
"fixed": "2.11.4"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "PyPI",
40+
"name": "ckan"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "2.10.9"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/ckan/ckan/commit/112affffa74b14fc97c54abcf18315df97114917"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/ckan/ckan"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/ckan/ckan/releases/tag/ckan-2.10.9"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/ckan/ckan/releases/tag/ckan-2.11.4"
77+
}
78+
],
79+
"database_specific": {
80+
"cwe_ids": [
81+
"CWE-79"
82+
],
83+
"severity": "MODERATE",
84+
"github_reviewed": true,
85+
"github_reviewed_at": "2025-10-29T15:34:22Z",
86+
"nvd_published_at": null
87+
}
88+
}

advisories/unreviewed/2025/10/GHSA-c6cm-5gc7-c3f4/GHSA-c6cm-5gc7-c3f4.json renamed to advisories/github-reviewed/2025/10/GHSA-c6cm-5gc7-c3f4/GHSA-c6cm-5gc7-c3f4.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c6cm-5gc7-c3f4",
4-
"modified": "2025-10-28T06:31:05Z",
4+
"modified": "2025-10-29T15:35:08Z",
55
"published": "2025-10-28T06:31:05Z",
66
"aliases": [
77
"CVE-2025-10939"
88
],
9+
"summary": "Keycloak allows access to admin path through flaw",
910
"details": "A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.keycloak:keycloak-quarkus-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.4.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -26,15 +47,19 @@
2647
{
2748
"type": "WEB",
2849
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2398025"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/keycloak/keycloak"
2954
}
3055
],
3156
"database_specific": {
3257
"cwe_ids": [
3358
"CWE-427"
3459
],
3560
"severity": "LOW",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-29T15:35:07Z",
3863
"nvd_published_at": "2025-10-28T04:16:15Z"
3964
}
4065
}

advisories/unreviewed/2025/10/GHSA-rg35-5v25-mqvp/GHSA-rg35-5v25-mqvp.json renamed to advisories/github-reviewed/2025/10/GHSA-rg35-5v25-mqvp/GHSA-rg35-5v25-mqvp.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rg35-5v25-mqvp",
4-
"modified": "2025-10-28T15:30:43Z",
4+
"modified": "2025-10-29T15:35:45Z",
55
"published": "2025-10-28T15:30:43Z",
66
"aliases": [
77
"CVE-2025-12390"
88
],
9+
"summary": "Keycloak vulnerable to session takeovers due to reuse of session identifiers",
910
"details": "A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.keycloak:keycloak-services"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "26.4.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -26,15 +47,19 @@
2647
{
2748
"type": "WEB",
2849
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406793"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/keycloak/keycloak"
2954
}
3055
],
3156
"database_specific": {
3257
"cwe_ids": [
3358
"CWE-384"
3459
],
3560
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-29T15:35:45Z",
3863
"nvd_published_at": "2025-10-28T14:15:57Z"
3964
}
4065
}

0 commit comments

Comments
 (0)