Merge pull request #402 from playframework/rgc/cve-announcements

Author: octonato

app/views/vulnerabilities.scala.html

@@ -27,18 +27,32 @@ <h2>Reporting vulnerabilities</h2>
 
             <h2>Play 2.8.x<h2>
 
+            <h3>Fixed in Play 2.8.3</h3>
+            <ul>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-26882-JsonParseDataAmplification")">CVE-2020-26882-JsonParseDataAmplification </a> - JSON parse Data Amplification</li>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-26883-JsonParseUncontrolledRecursion")">CVE-2020-26883-JsonParseUncontrolledRecursion</a> - JSON parse Uncontrolled Recursion</li>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-27196-DosViaJsonStackOverflow")">CVE-2020-27196-DosViaJsonStackOverflow</a> - DoS via JSON parse Stack Overflow</li>
+            </ul>
+            
             <h3>Fixed in Play 2.8.2</h3>
             <ul>
                 <a href="@routes.Security.vulnerability("CVE-2020-12480-CsrfBlacklistBypass")">CVE-2020-12480-CsrfBlacklistBypass</a> - Play CSRF Filter Content-Type black list bypass
             </ul>
-            
+
             <h2>Play 2.7.x<h2>
 
+            <h3>Fixed in Play 2.7.6</h3>
+            <ul>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-26882-JsonParseDataAmplification")">CVE-2020-26882-JsonParseDataAmplification</a> - JSON parse Data Amplification</li>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-26883-JsonParseUncontrolledRecursion")">CVE-2020-26883-JsonParseUncontrolledRecursion</a> - JSON parse Uncontrolled Recursion</li>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-27196-DosViaJsonStackOverflow")">CVE-2020-27196-DosViaJsonStackOverflow</a> - DoS via JSON parse Stack Overflow</li>
+            </ul>
+            
             <h3>Fixed in Play 2.7.5</h3>
             <ul>
                 <a href="@routes.Security.vulnerability("CVE-2020-12480-CsrfBlacklistBypass")">CVE-2020-12480-CsrfBlacklistBypass</a> - Play CSRF Filter Content-Type black list bypass
             </ul>
-            
+
             <h2>Play 2.6.x<h2>
 
             <h3>Fixed in Play 2.6.24</h3>

conf/playReleases.json

@@ -1,11 +1,19 @@
 {
     "latest": {
-        "version": "2.8.2",
-            "date": "May 21 2020"
+        "version": "2.8.3",
+            "date": "Oct 26 2020"
     },
     "development": [
     ],
     "previous": [
+        {
+            "version": "2.7.6",
+            "date": "Oct 26 2020"
+        },   
+        {
+            "version": "2.8.2",
+            "date": "May 21 2020"
+        },
         {
             "version": "2.7.5",
             "date": "May 20 2020"

public/markdown/changelog.md

@@ -1,3 +1,18 @@
+
+## Play 2.8.3
+
+*Released 26 October 2020
+
+[All changes](https://github.com/playframework/playframework/compare/2.8.2...2.8.3/)
+[GitHub milestone](https://github.com/playframework/playframework/milestone/103?closed=1)
+
+## Play 2.7.6
+
+*Released 26 October 2020
+
+[All changes](https://github.com/playframework/playframework/compare/2.7.5...2.7.6/)
+[GitHub milestone](https://github.com/playframework/playframework/milestone/104?closed=1)
+
 ## Play 2.8.2
 
 *Released 21 May 2020

public/markdown/vulnerabilities/CVE-2020-26882-JsonParseDataAmplification.md

@@ -0,0 +1,37 @@
+# JSON parse Data Amplification
+
+## CVE-ID
+
+CVE-2020-26882
+
+## Date
+
+1 October 2020
+
+## Description
+
+Carefully crafted JSON payloads sent as a form field lead to Data Amplification.
+
+## Impact
+
+Affects users that accept JSON as a field of a Form upload (multipart/form-data).
+
+## Affected versions
+
+- Play 2.8.0-2.8.2
+- Play 2.7.0-2.7.5
+- Play 2.6.x
+
+## Fixes
+
+This issue is fixed on Play 2.8.3 and 2.7.6. There won’t be a 2.6.x release with this fix since this version has reached end-of-life, please
+ upgrade as soon as possible to avoid this security issue.
+
+## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
+
+**Overall: 6.7**
+[AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1)
+
+## Acknowledgements
+
+Credit for finding this vulnerability goes to The Gemini Security Team,  Doyensec and @lucash-dev.

public/markdown/vulnerabilities/CVE-2020-26883-JsonParseUncontrolledRecursion.md

@@ -0,0 +1,37 @@
+# JSON parse Uncontrolled Recursion
+
+## CVE-ID
+
+CVE-2020-26883
+
+## Date
+
+1 October 2020
+
+## Description
+
+Carefully crafted JSON payloads sent as a form field lead to Uncontrolled Recursion.
+
+## Impact
+
+This only impacts Play applications implemented using the `PlayJava` flavor.
+
+## Affected versions
+
+- Play 2.8.0-2.8.2
+- Play 2.7.0-2.7.5
+- Play 2.6.x
+
+## Fixes
+
+This issue is fixed on Play 2.8.3 and 2.7.6. There won’t be a 2.6.x release with this fix since this version has reached end-of-life, please
+ upgrade as soon as possible to avoid this security issue.
+
+## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
+
+**Overall: 6.7**
+[AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C&version=3.1)
+
+## Acknowledgements
+
+Credit for finding this vulnerability goes to The Gemini Security Team,  Doyensec and @lucash-dev.

public/markdown/vulnerabilities/CVE-2020-27196-DosViaJsonStackOverflow.md

@@ -0,0 +1,33 @@
+# DoS via JSON parse Stack Overflow
+
+## CVE-ID
+
+CVE-2020-27196
+
+## Date
+
+1 October 2020
+
+## Description
+
+Play body parsing of HTTP requests eagerly parses a payload given a `Content-Type` header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a `StackOverflowError`.
+
+## Impact
+
+This only impacts Play applications implemented using the `PlayJava` flavor.
+
+## Affected versions
+
+- Play 2.8.0-2.8.2
+- Play 2.7.0-2.7.5
+- Play 2.6.x
+
+## Fixes
+
+This issue is fixed on Play 2.8.3 and 2.7.6. There won’t be a 2.6.x release with this fix since this version has reached end-of-life, please
+ upgrade as soon as possible to avoid this security issue.
+
+## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
+
+**Overall: 7.0**
+[AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C&version=3.1)