Skip to content

Commit 310fbbb

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-6gx3-4362-rf54 GHSA-px7x-gq96-rmp5
1 parent a9e916b commit 310fbbb

2 files changed

Lines changed: 120 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-6gx3-4362-rf54/GHSA-6gx3-4362-rf54.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6gx3-4362-rf54",
4+
"modified": "2026-03-17T19:49:35Z",
5+
"published": "2026-03-17T19:49:35Z",
6+
"aliases": [
7+
"CVE-2026-32766"
8+
],
9+
"summary": "astral-tokio-tar insufficiently validates PAX extensions during extraction",
10+
"details": "## Impact\n\nIn versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by having astral-tokio-tar silently skip a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension.\n\nIn practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. Consequently this advisory is considered low-severity within astral-tokio-tar itself, as it requires a separate vulnerability against any unrelated tar parser.\n\n## Patches\n\nVersions 0.6.0 and newer of astral-tokio-tar reject invalid PAX extensions, rather than silently skipping them. \n\n## Workarounds\n\nUsers are advised to upgrade to version 0.6.0 or newer to address this advisory.\n\nMost users should experience no breaking changes as a result of the patch above. Some users who attempt to extract poorly constructed tar files may experience errors; users should re-construct their tar files with a conforming tar parser.\n\n## Attribution\n\n- Sergei Zimmerman (@xokdvium)",
11+
"severity": [],
12+
"affected": [
13+
{
14+
"package": {
15+
"ecosystem": "crates.io",
16+
"name": "astral-tokio-tar"
17+
},
18+
"ranges": [
19+
{
20+
"type": "ECOSYSTEM",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.6.0"
27+
}
28+
]
29+
}
30+
],
31+
"database_specific": {
32+
"last_known_affected_version_range": "<= 0.5.6"
33+
}
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/astral-sh/tokio-tar"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-436"
53+
],
54+
"severity": "LOW",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-03-17T19:49:35Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/03/GHSA-px7x-gq96-rmp5/GHSA-px7x-gq96-rmp5.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-px7x-gq96-rmp5",
4+
"modified": "2026-03-17T19:48:35Z",
5+
"published": "2026-03-17T19:48:35Z",
6+
"aliases": [
7+
"CVE-2026-33041"
8+
],
9+
"summary": "Avideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php",
10+
"details": "### Summary\n\n`/objects/encryptPass.json.php` exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes.\n\n### Details\n\n**File:** `objects/encryptPass.json.php`\n\n```php\n$obj->password = @$_REQUEST['pass'];\n$obj->encryptedPassword = encryptPassword($obj->password);\necho json_encode($obj);\n```\n\nNo authentication is required. The `encryptPassword()` function in `objects/functions.php` (line ~2101) uses:\n\n```php\nfunction encryptPassword($password, $noSalt = false) {\n if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {\n $password .= $global['salt'];\n }\n return md5(hash('whirlpool', sha1($password)));\n}\n```\n\nBy default, salt is NOT enabled (`encryptPasswordsWithSalt` is off), making the hash deterministic and identical to what's stored in the database.\n\n### PoC\n\n```bash\n# Get the hash for any password\ncurl 'https://TARGET/objects/encryptPass.json.php?pass=admin123'\n# Response: {\"password\":\"admin123\",\"encryptedPassword\":\"<hash>\"}\n\n# Build a rainbow table for common passwords\nfor pass in $(cat rockyou-top1000.txt); do\n curl -s \"https://TARGET/objects/encryptPass.json.php?pass=$pass\"\ndone\n```\n\nIf an attacker obtains password hashes from the database (via SQL injection, backup exposure, etc.), they can instantly crack them by comparing against pre-computed hashes from this endpoint.\n\n### Impact\n\n**Password Cracking Acceleration** — This endpoint eliminates the need for an attacker to reverse-engineer the hashing algorithm. Combined with the weak hash chain (md5+whirlpool+sha1, no salt by default), an attacker with access to database hashes can crack passwords extremely quickly.\n\nAdditionally, this reveals whether salt is enabled and the exact hashing implementation, which is sensitive cryptographic configuration.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "wwbn/avideo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "25.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-px7x-gq96-rmp5"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/WWBN/AVideo/commit/ea2efd04464560cca93c9ab48b445dbb944a4e46"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/WWBN/AVideo"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-200"
55+
],
56+
"severity": "MODERATE",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-17T19:48:35Z",
59+
"nvd_published_at": null
60+
}
61+
}

0 commit comments

Comments
 (0)