Skip to content

Commit 5ffb532

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3vxg-x5f8-f5qf GHSA-4f7c-pmjv-c25w GHSA-xm5m-wgh2-rrg3
1 parent e125dea commit 5ffb532

File tree

3 files changed

+189
-5
lines changed

3 files changed

+189
-5
lines changed

‎advisories/github-reviewed/2026/04/GHSA-3vxg-x5f8-f5qf/GHSA-3vxg-x5f8-f5qf.json‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3vxg-x5f8-f5qf",
4+
"modified": "2026-04-14T01:01:17Z",
5+
"published": "2026-04-14T01:01:17Z",
6+
"aliases": [
7+
"CVE-2026-32270"
8+
],
9+
"summary": "Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments",
10+
"details": "### Summary\n\n`PaymentsController::actionPay` discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment.\n\nThe JSON error response includes the serialized order object (`order`), which contains some sensitive fields such as customer email, shipping address, and billing address.\n\n### Details\n\nI manually audited frontend payment flows and found that `actionPay()` retrieves orders by number before authorization is fully enforced.\n\nCode path:\n\n1. Load order by `number`.\n2. Evaluate whether payment is authorized for completed orders (`number + matching email`).\n3. If unauthorized, return failure.\n4. Failure response still includes `cartArray($order)`, which serializes sensitive order data.\n\nWhy is this a vulnerability?\n\n- Authorization logic says the requester is not allowed to pay for a completed order without an email.\n- But the response still returns the same completed order’s contents.\n\n### Impact\n\nType: Information Disclosure / Broken Access Control\n\nWho is impacted:\n\n- Any Commerce deployment where completed order numbers can be obtained or leaked.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "craftcms/commerce"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.0.0"
29+
},
30+
{
31+
"fixed": "5.6.0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 5.5.4"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "craftcms/commerce"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "4.0.0"
51+
},
52+
{
53+
"fixed": "4.11.0"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 4.10.2"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32270"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08"
75+
},
76+
{
77+
"type": "PACKAGE",
78+
"url": "https://github.com/craftcms/commerce"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/craftcms/commerce/releases/tag/4.11.0"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/craftcms/commerce/releases/tag/5.6.0"
87+
}
88+
],
89+
"database_specific": {
90+
"cwe_ids": [
91+
"CWE-200",
92+
"CWE-862"
93+
],
94+
"severity": "LOW",
95+
"github_reviewed": true,
96+
"github_reviewed_at": "2026-04-14T01:01:17Z",
97+
"nvd_published_at": "2026-04-13T20:16:33Z"
98+
}
99+
}

advisories/unreviewed/2026/04/GHSA-4f7c-pmjv-c25w/GHSA-4f7c-pmjv-c25w.json renamed to advisories/github-reviewed/2026/04/GHSA-4f7c-pmjv-c25w/GHSA-4f7c-pmjv-c25w.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4f7c-pmjv-c25w",
4-
"modified": "2026-04-10T18:31:18Z",
4+
"modified": "2026-04-14T01:02:41Z",
55
"published": "2026-04-10T18:31:18Z",
66
"aliases": [
77
"CVE-2026-40021"
88
],
9+
"summary": "Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters",
910
"details": "Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.\n\nAn attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "NuGet",
21+
"name": "log4net"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.3.0"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://github.com/apache/logging-log4net/pull/280"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/apache/logging-log4net"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7"
@@ -49,8 +74,8 @@
4974
"CWE-116"
5075
],
5176
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
77+
"github_reviewed": true,
78+
"github_reviewed_at": "2026-04-14T01:02:41Z",
5479
"nvd_published_at": "2026-04-10T16:16:32Z"
5580
}
5681
}

‎advisories/github-reviewed/2026/04/GHSA-xm5m-wgh2-rrg3/GHSA-xm5m-wgh2-rrg3.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xm5m-wgh2-rrg3",
4+
"modified": "2026-04-14T01:01:59Z",
5+
"published": "2026-04-14T01:01:59Z",
6+
"aliases": [
7+
"CVE-2026-39984"
8+
],
9+
"summary": "Sigstore Timestamp Authority has Improper Certificate Validation in verifier",
10+
"details": "### Authorization bypass via certificate bag manipulation in sigstore/timestamp-authority verifier\n\nAn authorization bypass vulnerability exists in sigstore/timestamp-authority verifier (timestamp-authority/v2/pkg/verification): `VerifyTimestampResponse` function correctly verifies the certificate chain but when the TSA specific constraints are verified in `VerifyLeafCert`, the first non-CA certificate from the PKCS#7 certificate bag is used instead of the leaf certificate from the certificate chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key. The library validates the signature using the one certificate but performs authorization checks on the another, allowing an attacker to bypass some authorization controls. \n\nThis vulnerability does **not** apply to timestamp-authority service, only to users of `timestamp-authority/v2/pkg/verification` package.\n\nThis vulnerability does **not** apply to sigstore-go even though it is a user of `timestamp-authority/v2/pkg/verification`: Providing `TSACertificate` option to `VerifyTimestampResponse` fully mitigates the issue.\n\n\n### Patches\n\nThe issue will be fixed in timestamp-authority 2.0.6\n\n### Workarounds\n\nUsers of `VerifyTimestampResponse` can use the `TSACertificate` option to specify the exact certificate they expect to be used: this fully mitigates the issue.\n\n### References\n\nThis issue was found after reading CVE-2026-33753 / GHSA-3xxc-pwj6-jgrj (originally reported by @Jaynornj and @Pr00fOf3xpl0it)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/sigstore/timestamp-authority/v2"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.0.6"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 2.0.5"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/sigstore/timestamp-authority"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-295"
54+
],
55+
"severity": "MODERATE",
56+
"github_reviewed": true,
57+
"github_reviewed_at": "2026-04-14T01:01:59Z",
58+
"nvd_published_at": null
59+
}
60+
}

0 commit comments

Comments
 (0)