Skip to content

Commit dc128b7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-wp4m-7hpj-8qp8 GHSA-jqfc-9q34-prhg GHSA-hgf8-39gv-g3f2 GHSA-mj73-j457-8x9q GHSA-pq5v-rwp8-p7gm GHSA-wp4m-7hpj-8qp8 GHSA-jqfc-9q34-prhg
1 parent 8f6828a commit dc128b7

7 files changed

Lines changed: 370 additions & 85 deletions

File tree

‎advisories/github-reviewed/2024/01/GHSA-wp4m-7hpj-8qp8/GHSA-wp4m-7hpj-8qp8.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wp4m-7hpj-8qp8",
4+
"modified": "2025-12-02T00:28:45Z",
5+
"published": "2024-01-20T00:30:27Z",
6+
"withdrawn": "2025-12-02T00:28:45Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: Discovery uses the same AES/GCM Nonce throughout the session",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w3hj-wr2q-x83g. This link is maintained to preserve external references.\n\n### Original Description\nConsensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [
17+
{
18+
"package": {
19+
"ecosystem": "Maven",
20+
"name": "tech.pegasys.discovery:discovery"
21+
},
22+
"ranges": [
23+
{
24+
"type": "ECOSYSTEM",
25+
"events": [
26+
{
27+
"introduced": "0"
28+
},
29+
{
30+
"fixed": "0.4.5"
31+
}
32+
]
33+
}
34+
]
35+
}
36+
],
37+
"references": [
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/ConsenSys/discovery/security/advisories/GHSA-w3hj-wr2q-x83g"
41+
},
42+
{
43+
"type": "ADVISORY",
44+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23688"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/advisories/GHSA-w3hj-wr2q-x83g"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-w3hj-wr2q-x83g"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-323",
58+
"CWE-330"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-12-02T00:28:45Z",
63+
"nvd_published_at": "2024-01-19T22:15:08Z"
64+
}
65+
}

‎advisories/github-reviewed/2025/11/GHSA-jqfc-9q34-prhg/GHSA-jqfc-9q34-prhg.json‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jqfc-9q34-prhg",
4+
"modified": "2025-12-02T00:30:16Z",
5+
"published": "2025-11-30T03:30:26Z",
6+
"aliases": [
7+
"CVE-2025-66422"
8+
],
9+
"summary": "trytond allows remote attackers to obtain sensitive trace-back (server setup) information",
10+
"details": "Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "trytond"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "7.5.0"
29+
},
30+
{
31+
"fixed": "7.6.11"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "PyPI",
40+
"name": "trytond"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "7.1.0"
48+
},
49+
{
50+
"fixed": "7.4.21"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "PyPI",
59+
"name": "trytond"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "7.0.0"
67+
},
68+
{
69+
"fixed": "7.0.40"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "PyPI",
78+
"name": "trytond"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "0"
86+
},
87+
{
88+
"fixed": "6.0.70"
89+
}
90+
]
91+
}
92+
]
93+
}
94+
],
95+
"references": [
96+
{
97+
"type": "ADVISORY",
98+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66422"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://discuss.tryton.org/t/security-release-for-issue-14354/8950"
103+
},
104+
{
105+
"type": "WEB",
106+
"url": "https://foss.heptapod.net/tryton/tryton/-/issues/14354"
107+
},
108+
{
109+
"type": "PACKAGE",
110+
"url": "https://github.com/tryton/trytond"
111+
}
112+
],
113+
"database_specific": {
114+
"cwe_ids": [
115+
"CWE-402"
116+
],
117+
"severity": "MODERATE",
118+
"github_reviewed": true,
119+
"github_reviewed_at": "2025-12-02T00:30:16Z",
120+
"nvd_published_at": "2025-11-30T03:15:47Z"
121+
}
122+
}

‎advisories/github-reviewed/2025/12/GHSA-hgf8-39gv-g3f2/GHSA-hgf8-39gv-g3f2.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hgf8-39gv-g3f2",
4+
"modified": "2025-12-02T00:27:38Z",
5+
"published": "2025-12-02T00:27:38Z",
6+
"aliases": [
7+
"CVE-2025-66221"
8+
],
9+
"summary": "Werkzeug safe_join() allows Windows special device names",
10+
"details": "Werkzeug's `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "werkzeug"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.1.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66221"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/pallets/werkzeug"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/pallets/werkzeug/releases/tag/3.1.4"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-67"
63+
],
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-02T00:27:38Z",
67+
"nvd_published_at": "2025-11-29T03:16:00Z"
68+
}
69+
}

‎advisories/github-reviewed/2025/12/GHSA-mj73-j457-8x9q/GHSA-mj73-j457-8x9q.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mj73-j457-8x9q",
4+
"modified": "2025-12-02T00:29:11Z",
5+
"published": "2025-12-02T00:29:11Z",
6+
"aliases": [],
7+
"summary": "maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe",
8+
"details": "maxminddb prior to version 0.27 declared `Reader::open_mmap` as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while the memory map was still active.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "maxminddb"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0.11.0"
27+
},
28+
{
29+
"fixed": "0.27.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/oschwald/maxminddb-rust/issues/86"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/oschwald/maxminddb-rust/commit/98f0e4fff9678c841ed33f3b8a46322f6163c32a"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/oschwald/maxminddb-rust"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0132.html"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-915"
57+
],
58+
"severity": "LOW",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2025-12-02T00:29:11Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2025/12/GHSA-pq5v-rwp8-p7gm/GHSA-pq5v-rwp8-p7gm.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pq5v-rwp8-p7gm",
4+
"modified": "2025-12-02T00:27:10Z",
5+
"published": "2025-12-02T00:27:10Z",
6+
"aliases": [],
7+
"summary": " rtvm-interpreter lacks sufficient checks in public API",
8+
"details": "The affected function is unsound due to insufficient checks on public struct field.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "rtvm-interpreter"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"last_affected": "4.0.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0131.html"
40+
}
41+
],
42+
"database_specific": {
43+
"cwe_ids": [
44+
"CWE-475"
45+
],
46+
"severity": "LOW",
47+
"github_reviewed": true,
48+
"github_reviewed_at": "2025-12-02T00:27:10Z",
49+
"nvd_published_at": null
50+
}
51+
}

0 commit comments

Comments
 (0)