Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#103 added initial CVE files #15

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
235 changes: 235 additions & 0 deletions docker/rancher/security.json

Large diffs are not rendered by default.

133 changes: 133 additions & 0 deletions gradle/gradle/security.json

Large diffs are not rendered by default.

127 changes: 127 additions & 0 deletions helm/helm/security.json

Large diffs are not rendered by default.

337 changes: 337 additions & 0 deletions intellij/intellij/security.json

Large diffs are not rendered by default.

7 changes: 7 additions & 0 deletions jasypt/jasypt/security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
[ {
"versionRange" : "(,1.9.1]",
"severity" : 7.5,
"cveName" : "CVE-2014-9970",
"description" : "jasypt before 1.9.2 allows a timing attack against the password hash comparison.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2014-9970"
} ]
2,251 changes: 2,251 additions & 0 deletions jenkins/jenkins/security.json

Large diffs are not rendered by default.

13 changes: 13 additions & 0 deletions mvn/mvn/security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
[ {
"versionRange" : "[3.0.4,3.0.4]",
"severity" : 5.8,
"cveName" : "CVE-2013-0253",
"description" : "The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2013-0253"
}, {
"versionRange" : "(,3.8.1)",
"severity" : 9.1,
"cveName" : "CVE-2021-26291",
"description" : "Apache Maven will follow repositories that are defined in a dependency���s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2021-26291"
} ]
4,357 changes: 4,357 additions & 0 deletions python/python/security.json

Large diffs are not rendered by default.

133 changes: 133 additions & 0 deletions quarkus/quarkus/security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,133 @@
[ {
"versionRange" : "(,2.16.11)",
"severity" : 8.1,
"cveName" : "CVE-2023-4853",
"description" : "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-4853"
}, {
"versionRange" : "[3.0.0,3.2.9)",
"severity" : 9.8,
"cveName" : "CVE-2023-6267",
"description" : "A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-6267"
}, {
"versionRange" : "[2.10.0,2.10.4)",
"severity" : 9.8,
"cveName" : "CVE-2022-2466",
"description" : "It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-2466"
}, {
"versionRange" : "(,2.13.0)",
"severity" : 7.5,
"cveName" : "CVE-2022-42004",
"description" : "In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-42004"
}, {
"versionRange" : "[3.3.0,3.3.3)",
"severity" : 8.1,
"cveName" : "CVE-2023-4853",
"description" : "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-4853"
}, {
"versionRange" : "(,2.16.1)",
"severity" : 3.3,
"cveName" : "CVE-2023-0481",
"description" : "In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp files with insecure permissions that could be read by a local user.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-0481"
}, {
"versionRange" : "(,2.13.9)",
"severity" : 9.8,
"cveName" : "CVE-2023-6267",
"description" : "A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-6267"
}, {
"versionRange" : "(,2.13.7)",
"severity" : 6.1,
"cveName" : "CVE-2023-0044",
"description" : "If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-0044"
}, {
"versionRange" : "(,2.7.0)",
"severity" : 6.6,
"cveName" : "CVE-2022-21363",
"description" : "Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-21363"
}, {
"versionRange" : "(,2.13.5)",
"severity" : 9.8,
"cveName" : "CVE-2022-4116",
"description" : "A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-4116"
}, {
"versionRange" : "[3.0.1,3.2.8)",
"severity" : 7.5,
"cveName" : "CVE-2023-5720",
"description" : "A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-5720"
}, {
"versionRange" : "[2.14.0,2.14.2)",
"severity" : 9.8,
"cveName" : "CVE-2022-4116",
"description" : "A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-4116"
}, {
"versionRange" : "(,2.13.8)",
"severity" : 7.5,
"cveName" : "CVE-2023-1584",
"description" : "A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-1584"
}, {
"versionRange" : "(,3.6.0)",
"severity" : 9.1,
"cveName" : "CVE-2023-6394",
"description" : "A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-6394"
}, {
"versionRange" : "[2.13.9,2.13.9]",
"severity" : 9.8,
"cveName" : "CVE-2023-6267",
"description" : "A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-6267"
}, {
"versionRange" : "(,2.13.3)",
"severity" : 7.5,
"cveName" : "CVE-2022-42003",
"description" : "In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-42003"
}, {
"versionRange" : "[2.14.0,2.14.2)",
"severity" : 7.5,
"cveName" : "CVE-2022-4147",
"description" : "Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-4147"
}, {
"versionRange" : "[3.2.0,3.2.6)",
"severity" : 8.1,
"cveName" : "CVE-2023-4853",
"description" : "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-4853"
}, {
"versionRange" : "[3.2.9,3.2.9]",
"severity" : 9.8,
"cveName" : "CVE-2023-6267",
"description" : "A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-6267"
}, {
"versionRange" : "(,2.7.1)",
"severity" : 8.8,
"cveName" : "CVE-2022-0981",
"description" : "A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-0981"
}, {
"versionRange" : "(,2.7.2)",
"severity" : 9.8,
"cveName" : "CVE-2022-21724",
"description" : "pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. This can lead to code execution loaded via arbitrary classes. Users using plugins are advised to upgrade. There are no known workarounds for this issue.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-21724"
}, {
"versionRange" : "[2.0,2.13.5)",
"severity" : 7.5,
"cveName" : "CVE-2022-4147",
"description" : "Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2022-4147"
} ]
19 changes: 19 additions & 0 deletions terraform/terraform/security.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
[ {
"versionRange" : "(,1.12.0]",
"severity" : 9.8,
"cveName" : "CVE-2018-9057",
"description" : "aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2018-9057"
}, {
"versionRange" : "[1.0.8,1.5.7)",
"severity" : 7.8,
"cveName" : "CVE-2023-4782",
"description" : "Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2023-4782"
}, {
"versionRange" : "(,0.12.17)",
"severity" : 7.5,
"cveName" : "CVE-2019-19316",
"description" : "When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.",
"nistUrl" : "https://nvd.nist.gov/vuln/detail/CVE-2019-19316"
} ]
Loading