Skip to content

Commit 2ba26f7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-364q-w7vh-vhpc GHSA-6w48-2g9j-v9q5 GHSA-6xvm-j4wr-6v98 GHSA-74cf-pgh9-m5q2 GHSA-6w48-2g9j-v9q5 GHSA-74cf-pgh9-m5q2
1 parent 2900bb7 commit 2ba26f7

6 files changed

Lines changed: 335 additions & 81 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-364q-w7vh-vhpc/GHSA-364q-w7vh-vhpc.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-364q-w7vh-vhpc",
4+
"modified": "2026-03-11T00:09:41Z",
5+
"published": "2026-03-11T00:09:41Z",
6+
"aliases": [
7+
"CVE-2026-31817"
8+
],
9+
"summary": "OliveTin's unsafe parsing of UniqueTrackingId can be used to write files",
10+
"details": "When the `saveLogs` feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied `UniqueTrackingId` field in the `StartAction` API request. This value is not validated or sanitized before being used in a file path, allowing an attacker to use directory traversal sequences (e.g., `../../../`) to write files to arbitrary locations on the filesystem.\n### Affected Code\n\n**Entry point — `service/internal/api/api.go` (line 130):**\n\nThe `UniqueTrackingId` from the API request is passed directly to the executor without validation:\n\n```go\nexecReq := executor.ExecutionRequest{\n Binding: pair,\n TrackingID: req.Msg.UniqueTrackingId, // user-controlled, no validation\n // ...\n}\n```\n\n**Tracking ID accepted as-is — `service/internal/executor/executor.go` (lines 508–512):**\n\nThe tracking ID is only replaced with a UUID if it is empty or a duplicate. Any other string, including one containing path separators, is accepted:\n\n```go\n_, isDuplicate := e.GetLog(req.TrackingID)\n\nif isDuplicate || req.TrackingID == \"\" {\n req.TrackingID = uuid.NewString()\n}\n```\n\n**Filename construction — `service/internal/executor/executor.go` (line 1042):**\n\nThe tracking ID is interpolated directly into the log filename:\n\n```go\nfilename := fmt.Sprintf(\"%v.%v.%v\",\n req.logEntry.ActionTitle,\n req.logEntry.DatetimeStarted.Unix(),\n req.logEntry.ExecutionTrackingID,\n)\n```\n\n**File write — `service/internal/executor/executor.go` (lines 1068–1069 and 1082–1083):**\n\nThe filename is joined to the configured log directory using `path.Join`, which calls `path.Clean` internally. `path.Clean` resolves `..` path segments, causing the final file path to escape the intended directory:\n\n```go\n// Results file (.yaml)\nfilepath := path.Join(dir, filename+\".yaml\")\nerr = os.WriteFile(filepath, data, 0600)\n\n// Output file (.log)\nfilepath := path.Join(dir, filename+\".log\")\nerr := os.WriteFile(filepath, []byte(data), 0600)\n```\n\n### Proof of Concept\n\nAn attacker sends the following `StartAction` request (Connect RPC or REST):\n\n```json\n{\n \"bindingId\": \"<any-executable-action-id>\",\n \"uniqueTrackingId\": \"../../../tmp/pwned\"\n}\n```\n\nAssuming the action title is `Ping the Internet` and the timestamp is `1741320000`, the constructed filename becomes:\n\n```\nPing the Internet.1741320000.../../../tmp/pwned\n```\n\nWhen `path.Join` processes this with a configured results directory like `/var/olivetin/logs`:\n\n```\npath.Join(\"/var/olivetin/logs\", \"Ping the Internet.1741320000.../../../tmp/pwned.yaml\")\n```\n\n`path.Clean` resolves the traversal:\n\n1. Path segments: `[\"var\", \"olivetin\", \"logs\", \"Ping the Internet.1741320000...\", \"..\", \"..\", \"..\", \"tmp\", \"pwned.yaml\"]`\n2. The `..` segments traverse upward past the log directory.\n3. Final resolved path: `/tmp/pwned.yaml`\n\nTwo files are written:\n\n- **`.yaml` file** — contains YAML-serialized `InternalLogEntry` (action title, icon, timestamps, exit code, output, tags, username, tracking ID)\n- **`.log` file** — contains the raw command output (potentially attacker-influenced if the action echoes its arguments)\n\n### Impact\n\n- **Arbitrary file write** to any path writable by the OliveTin process.\n- OliveTin frequently runs as root inside Docker containers, so the writable scope is often the entire filesystem.\n- An attacker could:\n - Overwrite OliveTin's own `sessions.yaml` to inject authenticated sessions.\n - Write to entity file directories to inject malicious entity data.\n - Write to system cron directories or other locations to achieve remote code execution.\n - Cause denial of service by overwriting critical system files.\n\n### Suggested Fix\n\nValidate the `UniqueTrackingId` to ensure it only contains safe characters before use. A strict UUID format check is the simplest approach:\n\n```go\nimport \"regexp\"\n\nvar validTrackingID = regexp.MustCompile(`^[a-fA-F0-9\\-]+$`)\n\n// In ExecRequest, before accepting the user-supplied ID:\nif req.TrackingID == \"\" || !validTrackingID.MatchString(req.TrackingID) {\n req.TrackingID = uuid.NewString()\n}\n```\n\nAlternatively, sanitize the filename in `stepSaveLog` by stripping or rejecting path separators and `..` sequences.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/OliveTin/OliveTin"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.0.0-20260309102040-b03af0e2eca3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-364q-w7vh-vhpc"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/OliveTin/OliveTin/commit/2f77000de44f65690f257e3cf8e2c8462b0e74c7"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/OliveTin/OliveTin"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.2"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-22"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-11T00:09:41Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-6w48-2g9j-v9q5/GHSA-6w48-2g9j-v9q5.json‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6w48-2g9j-v9q5",
4+
"modified": "2026-03-11T00:08:54Z",
5+
"published": "2026-03-09T09:30:31Z",
6+
"aliases": [
7+
"CVE-2026-24713"
8+
],
9+
"summary": "Apache IoTDB has an Improper Input Validation vulnerability",
10+
"details": "Improper Input Validation vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.iotdb:iotdb-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.0.0"
29+
},
30+
{
31+
"fixed": "1.3.7"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.iotdb:iotdb-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "2.0.0"
48+
},
49+
{
50+
"fixed": "2.0.7"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24713"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/apache/iotdb/commit/8fbfddc5f83771f1b339c457de597fe877f686d2"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/apache/iotdb"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/apache/iotdb/compare/v1.3.6...v1.3.7"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/apache/iotdb/compare/v2.0.6...v2.0.7"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/apache/iotdb/releases/tag/v1.3.7"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://github.com/apache/iotdb/releases/tag/v2.0.7"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p"
89+
},
90+
{
91+
"type": "WEB",
92+
"url": "http://www.openwall.com/lists/oss-security/2026/03/09/4"
93+
}
94+
],
95+
"database_specific": {
96+
"cwe_ids": [
97+
"CWE-20",
98+
"CWE-917"
99+
],
100+
"severity": "CRITICAL",
101+
"github_reviewed": true,
102+
"github_reviewed_at": "2026-03-11T00:08:54Z",
103+
"nvd_published_at": "2026-03-09T09:16:02Z"
104+
}
105+
}

‎advisories/github-reviewed/2026/03/GHSA-6xvm-j4wr-6v98/GHSA-6xvm-j4wr-6v98.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6xvm-j4wr-6v98",
4+
"modified": "2026-03-11T00:09:19Z",
5+
"published": "2026-03-11T00:09:19Z",
6+
"aliases": [
7+
"CVE-2026-31812"
8+
],
9+
"summary": "Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing",
10+
"details": "### Summary\nA remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable `quinn` versions by sending a crafted QUIC Initial packet containing malformed `quic_transport_parameters`. `In quinn-proto` parsing logic, attacker-controlled varints are decoded with `unwrap()`, so truncated encodings cause `Err(UnexpectedEnd)` and `panic`. This is reachable over the network with a single packet and no prior trust or authentication.\n\n### Details\nThe issue is panic-on-untrusted-input in QUIC transport parameter parsing.\nIn `quinn-proto` (observed in `quinn-proto 0.11.13`), parsing of some transport parameters uses a fallible varint decode followed by `unwrap()`. For malformed/truncated parameter values, decode returns `UnexpectedEnd`, and `unwrap()` panics.\n\n#### Observed output:\n```\nthread 'tokio-rt-worker' (2366474) panicked at quinn-proto/src/transport_parameters.rs:473:67:\ncalled `Result::unwrap()` on an `Err` value: UnexpectedEnd\n```\n\n### PoC\n#### Reproduces against the upstream Quinn server example.\n1. Start server:\n```\ncargo run --example server -- ./\n```\n2. Prepare PoC client environment:\n```\npython3 -m venv .venv\nsource .venv/bin/activate\npip install aioquic\n```\n3. Run PoC script [attack.py](https://github.com/user-attachments/files/25741713/attack.py) against server QUIC listener (default example target shown):\n```\npython attack.py\n```\n#### Observed output\n```\nthread 'tokio-rt-worker' (2366903) panicked at quinn-proto/src/transport_parameters.rs:473:67:\ncalled `Result::unwrap()` on an `Err` value: UnexpectedEnd\n```\n\n\n\n### Impact\nVulnerability type: Remote Denial of Service (panic/crash)\nAttack requirements: Network reachability to UDP QUIC listener\nAuthentication/privileges: None\nWho is impacted: Any server/application using affected `quinn/quinn-proto` versions where this parse path is reachable; process-level impact depends on integration panic handling policy\n\n\nThis vulnerability was originally submitted by @revofusion to the Ethereum Foundation bug bounty program",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "crates.io",
21+
"name": "quinn-proto"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.11.14"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/quinn-rs/quinn/pull/2559"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/quinn-rs/quinn"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0037.html"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-248"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-11T00:09:19Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-74cf-pgh9-m5q2/GHSA-74cf-pgh9-m5q2.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-74cf-pgh9-m5q2",
4+
"modified": "2026-03-11T00:08:44Z",
5+
"published": "2026-03-09T09:30:31Z",
6+
"aliases": [
7+
"CVE-2026-24015"
8+
],
9+
"summary": "Apache IoTDB has an Insecure Default Configuration Vulnerability",
10+
"details": "A vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.iotdb:iotdb-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.0.0"
29+
},
30+
{
31+
"fixed": "1.3.7"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.iotdb:iotdb-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "2.0.0"
48+
},
49+
{
50+
"fixed": "2.0.7"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24015"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/apache/iotdb"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/apache/iotdb/compare/v1.3.6...v1.3.7"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/apache/iotdb/compare/v2.0.6...v2.0.7"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/apache/iotdb/releases/tag/v1.3.7"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/apache/iotdb/releases/tag/v2.0.7"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://lists.apache.org/thread/j769ywdqm46zl3oz5lbffsldklg0ow7p"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "http://www.openwall.com/lists/oss-security/2026/03/09/5"
89+
}
90+
],
91+
"database_specific": {
92+
"cwe_ids": [
93+
"CWE-1327"
94+
],
95+
"severity": "CRITICAL",
96+
"github_reviewed": true,
97+
"github_reviewed_at": "2026-03-11T00:08:44Z",
98+
"nvd_published_at": "2026-03-09T09:16:02Z"
99+
}
100+
}

‎advisories/unreviewed/2026/03/GHSA-6w48-2g9j-v9q5/GHSA-6w48-2g9j-v9q5.json‎

Lines changed: 0 additions & 41 deletions
This file was deleted.

0 commit comments

Comments
 (0)