Merge pull request #409 from ignasi35/prepare-cve-ann

Author: ignasi35

app/views/vulnerabilities.scala.html

@@ -27,13 +27,19 @@ <h2>Reporting vulnerabilities</h2>
 
             <h2>Play 2.8.x<h2>
 
+            <h3>Fixed in Play 2.8.5</h3>
+            <ul>
+                <li><a href="@routes.Security.vulnerability("CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeStorageorTransfer")">CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeStorageorTransfer </a> - Improper Removal of Sensitive Information Before Storage or Transfer
+                </li>
+            </ul>
+            
             <h3>Fixed in Play 2.8.3</h3>
             <ul>
                 <li><a href="@routes.Security.vulnerability("CVE-2020-26882-JsonParseDataAmplification")">CVE-2020-26882-JsonParseDataAmplification </a> - JSON parse Data Amplification</li>
                 <li><a href="@routes.Security.vulnerability("CVE-2020-26883-JsonParseUncontrolledRecursion")">CVE-2020-26883-JsonParseUncontrolledRecursion</a> - JSON parse Uncontrolled Recursion</li>
                 <li><a href="@routes.Security.vulnerability("CVE-2020-27196-DosViaJsonStackOverflow")">CVE-2020-27196-DosViaJsonStackOverflow</a> - DoS via JSON parse Stack Overflow</li>
             </ul>
-            
+
             <h3>Fixed in Play 2.8.2</h3>
             <ul>
                 <a href="@routes.Security.vulnerability("CVE-2020-12480-CsrfBlacklistBypass")">CVE-2020-12480-CsrfBlacklistBypass</a> - Play CSRF Filter Content-Type black list bypass

public/markdown/vulnerabilities/CVE-2020-28923-ImproperRemovalofSensitiveInformationBeforeStorageorTransfer.md

@@ -0,0 +1,34 @@
+# JSON Improper Removal of Sensitive Information Before Storage or Transfer
+
+## CVE-ID
+
+CVE-2020-28923
+
+## Date
+
+7 October 2020
+
+## Description
+
+Play JSON handling on the Java API serializes private and protected fields.
+
+## Impact
+
+Users migrating from Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON. 
+
+## Affected versions
+
+- Play 2.8.0-2.8.4
+
+## Fixes
+
+This issue is fixed on Play 2.8.5. 
+
+## CVSS Metrics ([more info](https://www.first.org/cvss/user-guide))
+
+**Overall: 4.2**
+[AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:X/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:X/RL:O/RC:C&version=3.1)
+
+## Acknowledgements
+
+Credit for reporting this vulnerability goes to Onilton Maciel.