Skip to content

Commit 1b475fe

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-9c4h-pwmf-m6fj GHSA-f7pm-6hr8-7ggm GHSA-xv8g-fj9h-6gmv
1 parent f2ca60d commit 1b475fe

3 files changed

Lines changed: 224 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-9c4h-pwmf-m6fj/GHSA-9c4h-pwmf-m6fj.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9c4h-pwmf-m6fj",
4+
"modified": "2026-03-10T01:19:29Z",
5+
"published": "2026-03-10T01:19:29Z",
6+
"aliases": [
7+
"CVE-2026-30960"
8+
],
9+
"summary": "RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface",
10+
"details": "## Impact\n\n**Vulnerability Type**: \nImproper Control of Generation of Code ('Code Injection') (CWE-94) / Improper Check for Unusual or Exceptional Conditions (CWE-754) / Improper Input Validation (CWE-20) / Use of Low-Level Functionality (CWE-695) / Improper Privilege Management (CWE-269) / External Control of System or Configuration Setting (CWE-15).\n\n**Technical Details**:\nThe vulnerability exists in the JIT (Just-In-Time) compilation engine, which is fully exposed via the CFFI (Foreign Function Interface). Due to Improper Input Validation and External Control of Code Generation, an attacker can supply malicious parameters or instruction sequences through the CFFI layer. Since the library often operates with elevated privileges or within high-performance computing contexts, this allows for Arbitrary Code Execution (ACE) at the privilege level of the host process.\n\n## Who is Impacted?\n\n * Developers using the library as a dynamic linked library (.so, .dll, .dylib) in multi-language environments (e.g., Python, Node.js, C++).\n * Cloud Service Providers running the library in multi-tenant environments or automated model-training pipelines.\n * Users processing untrusted or third-party datasets/models that may trigger malicious JIT instruction generation.\nPatches\n * Affected versions: < 0.2.8\n * Patched version: 0.2.9\n\n## Workarounds\n\nIf you cannot upgrade immediately, please consider the following mitigations:\n * Strict Sandboxing: Run the library within a restricted sandbox (e.g., WebAssembly, Docker with non-root user, or seccomp profiles) to limit system call access.\n * Principle of Least Privilege: Ensure the process calling the library does not have administrative or root privileges.\n * Input Filtering: If possible, implement an application-level validation layer to sanitize any data passed to the CFFI interfaces.\n * Disable JIT (if applicable): If your workload allows, use the interpreter-only mode (if provided by the library) to bypass the JIT engine entirely.\nCVSS Score\n * Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n * Base Score: 9.4 (Critical)\n\n## References\n\n[Apich Organization Security Team Homepage](https://security.apich.org/)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "rssn"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.2.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/Apich-Organization/rssn/security/advisories/GHSA-9c4h-pwmf-m6fj"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/Apich-Organization/rssn"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/Apich-Organization/rssn/releases/tag/v0.2.9"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-15",
55+
"CWE-20",
56+
"CWE-269",
57+
"CWE-695",
58+
"CWE-754",
59+
"CWE-94"
60+
],
61+
"severity": "CRITICAL",
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-03-10T01:19:29Z",
64+
"nvd_published_at": null
65+
}
66+
}

‎advisories/github-reviewed/2026/03/GHSA-f7pm-6hr8-7ggm/GHSA-f7pm-6hr8-7ggm.json‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-f7pm-6hr8-7ggm",
4+
"modified": "2026-03-10T01:19:46Z",
5+
"published": "2026-03-10T01:19:46Z",
6+
"aliases": [
7+
"CVE-2026-30964"
8+
],
9+
"summary": "Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation",
10+
"details": "### Summary\nWhen `allowed_origins` is configured, `CheckAllowedOrigins` reduces URL-like values to their `host` and accepts on host match. This makes exact origin policies impossible to express: scheme and port differences are lost for URL-like entries.\n\n### Details\n`CheckAllowedOrigins` stores each configured allowed origin as:\n\n- `parse_url($allowedOrigin)['host'] ?? $allowedOrigin`\n\nand later reduces the received `clientDataJSON.origin` the same way:\n\n- `parse_url($C->origin)['host'] ?? $C->origin`\n\nIf the reduced value matches, the method returns early. As a result, for the normal `allowed_origins` path, the later HTTPS check is not reached.\n\nThis differs from WebAuthn Level 2, which requires verifying that `C.origin` matches the RP’s origin, separately from verifying that `authData.rpIdHash` matches the expected RP ID.\n\nCode:\n- [CheckAllowedOrigins.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/webauthn/src/CeremonyStep/CheckAllowedOrigins.php)\n- [CeremonyStepManagerFactoryCompilerPass.php](https://github.com/web-auth/webauthn-framework/blob/d58906e/src/symfony/src/DependencyInjection/Compiler/CeremonyStepManagerFactoryCompilerPass.php)\n\nSpec:\n\n- [WebAuthn Level 2 - §7.1 Registering a New Credential](https://www.w3.org/TR/webauthn-2/#sctn-registering-a-new-credential)\n- [WebAuthn Level 2 - §7.2 Verifying an Authentication Assertion](https://www.w3.org/TR/webauthn-2/#sctn-verifying-assertion)\n- [WebAuthn Level 2 - RP ID definition / origin constraints](https://www.w3.org/TR/webauthn-2/#relying-party-identifier)\n- [WebAuthn Level 2 - CollectedClientData.origin](https://www.w3.org/TR/webauthn-2/#dom-collectedclientdata-origin)\n\n### PoC\nConfiguration:\n\n```yaml\nwebauthn:\n allowed_origins:\n - https://login.example.com:8443\n allow_subdomains: false\n````\n\nSend a registration or authentication response whose `clientDataJSON.origin` is:\n\n```text\nhttps://login.example.com:9443\n```\n\nObserved result:\nthe response is accepted by `CheckAllowedOrigins`, because both values are reduced to `login.example.com`.\n\nExpected result:\nthe response should be rejected, because `https://login.example.com:8443` and `https://login.example.com:9443` are different origins.\n\n### Impact\n\nThis is an origin validation error affecting deployments that use `allowed_origins`.\n\nIt bypasses the separate exact-origin check required by WebAuthn. The most practical browser-facing example is same-host / different-port origin confusion. In non-browser or custom clients, scheme confusion for URL-like entries may also be relevant.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "web-auth/webauthn-framework"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "5.2.4"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "web-auth/webauthn-lib"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "5.2.4"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Packagist",
59+
"name": "web-auth/webauthn-symfony-bundle"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "5.2.4"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-f7pm-6hr8-7ggm"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/web-auth/webauthn-framework/commit/535cc3c2dcbd9c3dfd5e00a254ad4a984e5e7839"
84+
},
85+
{
86+
"type": "PACKAGE",
87+
"url": "https://github.com/web-auth/webauthn-framework"
88+
}
89+
],
90+
"database_specific": {
91+
"cwe_ids": [
92+
"CWE-346"
93+
],
94+
"severity": "MODERATE",
95+
"github_reviewed": true,
96+
"github_reviewed_at": "2026-03-10T01:19:46Z",
97+
"nvd_published_at": null
98+
}
99+
}

‎advisories/github-reviewed/2026/03/GHSA-xv8g-fj9h-6gmv/GHSA-xv8g-fj9h-6gmv.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xv8g-fj9h-6gmv",
4+
"modified": "2026-03-10T01:18:20Z",
5+
"published": "2026-03-10T01:18:20Z",
6+
"aliases": [],
7+
"summary": "Linkdave Missing Authentication on REST and WebSocket endpoints",
8+
"details": "### Impact\nThe `linkdave` HTTP server does not enforce authentication on its REST and WebSocket routes. Because this server may be exposed to the internet, any unauthenticated remote attacker can connect to these endpoints.\n\n### Patches\n[1.2.5](https://github.com/shi-gg/linkdave/commit/0f9a00d9d549b16278db81fce6dfec350c2abc01)\n\n### Workarounds\nIf upgrading is not immediately possible, users can mitigate this issue by:\n- Restricting network access to the server's port using a firewall so it is only accessible from trusted internal IP addresses.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Go",
19+
"name": "github.com/shi-gg/linkdave"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "0.1.5"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/shi-gg/linkdave/security/advisories/GHSA-xv8g-fj9h-6gmv"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/shi-gg/linkdave/commit/0f9a00d9d549b16278db81fce6dfec350c2abc01"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/shi-gg/linkdave"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-306"
53+
],
54+
"severity": "CRITICAL",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-10T01:18:20Z",
57+
"nvd_published_at": null
58+
}
59+
}

0 commit comments

Comments
 (0)