Skip to content

Commit 8587b72

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-gc59-r5jq-98qw GHSA-hqxq-hwqf-wg83 GHSA-jpcj-7wfg-mqxv GHSA-p423-j2cm-9vmq GHSA-v6ph-xcq9-qxxj GHSA-wr8q-c73g-m7gp GHSA-gc59-r5jq-98qw GHSA-wr8q-c73g-m7gp
1 parent 0774895 commit 8587b72

File tree

8 files changed

+508
-83
lines changed

8 files changed

+508
-83
lines changed

‎advisories/github-reviewed/2026/04/GHSA-gc59-r5jq-98qw/GHSA-gc59-r5jq-98qw.json‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gc59-r5jq-98qw",
4+
"modified": "2026-04-08T19:24:59Z",
5+
"published": "2026-04-08T15:31:44Z",
6+
"aliases": [
7+
"CVE-2026-5795"
8+
],
9+
"summary": "Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables",
10+
"details": "In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.eclipse.jetty.ee10:jetty-ee10"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "12.1.0"
29+
},
30+
{
31+
"fixed": "12.1.7"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.eclipse.jetty.ee10:jetty-ee10"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "12.0.0"
48+
},
49+
{
50+
"fixed": "12.0.33"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.eclipse.jetty.ee10:jetty-ee10"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "11.0.0"
67+
},
68+
{
69+
"fixed": "11.0.28"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Maven",
78+
"name": "org.eclipse.jetty.ee10:jetty-ee10"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "10.0.0"
86+
},
87+
{
88+
"fixed": "10.0.28"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Maven",
97+
"name": "org.eclipse.jetty.ee10:jetty-ee10"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "9.4.0"
105+
},
106+
{
107+
"fixed": "9.4.60"
108+
}
109+
]
110+
}
111+
]
112+
}
113+
],
114+
"references": [
115+
{
116+
"type": "WEB",
117+
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c"
118+
},
119+
{
120+
"type": "ADVISORY",
121+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5795"
122+
},
123+
{
124+
"type": "PACKAGE",
125+
"url": "https://github.com/jetty/jetty.project"
126+
},
127+
{
128+
"type": "WEB",
129+
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/92"
130+
}
131+
],
132+
"database_specific": {
133+
"cwe_ids": [
134+
"CWE-226"
135+
],
136+
"severity": "HIGH",
137+
"github_reviewed": true,
138+
"github_reviewed_at": "2026-04-08T19:24:59Z",
139+
"nvd_published_at": "2026-04-08T14:16:32Z"
140+
}
141+
}

‎advisories/github-reviewed/2026/04/GHSA-hqxq-hwqf-wg83/GHSA-hqxq-hwqf-wg83.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hqxq-hwqf-wg83",
4+
"modified": "2026-04-08T19:23:00Z",
5+
"published": "2026-04-08T19:23:00Z",
6+
"aliases": [
7+
"CVE-2026-39901"
8+
],
9+
"summary": "monetr: Protected Transactions Deletable via PUT",
10+
"details": "### Summary\nA transaction integrity flaw allows an authenticated tenant user to soft-delete synced non-manual transactions through the transaction update endpoint, despite the application explicitly blocking deletion of those transactions via the normal `DELETE` path. This bypass undermines the intended protection for imported transaction records and allows protected transactions to be hidden from normal views.\n\n### Details\nThe issue affects the transaction update path for synced transactions associated with non-manual links. The intended policy is clearly enforced in the `DELETE` handler: deletion of synced transactions for non-manual links is rejected with an error indicating that such transactions cannot be deleted.\n\nHowever, the `PUT` update path still accepts a client-controlled full `Transaction` object and persists fields that should be server-managed, including `deletedAt`. The update logic appears to restrict only selected fields, which leaves `deletedAt` attacker-controllable.\n\nVerified behavior on the same synced transaction showed:\n\n- `DELETE` was denied with the expected protection error for non-manual links\n- `PUT` with a user-supplied `deletedAt` value succeeded and returned `200 OK`\n- a subsequent transaction list no longer showed the transaction\n- `GET` by transaction ID still returned the record with `deletedAt` populated\n\nThis demonstrates a policy bypass: although the server explicitly defines synced transactions on non-manual links as non-deletable through the dedicated delete route, the same outcome can still be achieved through the update route by setting the soft-delete field directly.\n\nThe vulnerability is therefore not a simple UI inconsistency. It is a server-side authorization and integrity flaw caused by trusting a client-supplied full transaction object and failing to protect sensitive server-managed fields from modification.\n\n### PoC\nThe issue can be reproduced by identifying a synced transaction on a non-manual link, confirming that the normal `DELETE` route rejects deletion, then submitting an update request that sets the transaction’s `deletedAt` field. The transaction will then disappear from normal listing views even though direct retrieval still shows the record as soft-deleted.\n\n### Impact\n- **Type:** Authorization bypass / integrity violation\n- **Who is impacted:** Authenticated tenant users and any deployment relying on synced transaction immutability for non-manual links\n- **Security impact:** Attackers can hide or effectively delete protected imported transactions that should not be deletable, compromising transaction history, bookkeeping integrity, and trust in audit-relevant server-managed fields\n- **Attack preconditions:** The attacker must be authenticated and able to access a synced transaction within their own tenant/account scope",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/monetr/monetr"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.12.2"
29+
},
30+
{
31+
"fixed": "1.12.3"
32+
}
33+
]
34+
}
35+
],
36+
"versions": [
37+
"1.12.2"
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/monetr/monetr/security/advisories/GHSA-hqxq-hwqf-wg83"
45+
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/monetr/monetr"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/monetr/monetr/releases/tag/v1.12.3"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-285"
58+
],
59+
"severity": "MODERATE",
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-04-08T19:23:00Z",
62+
"nvd_published_at": null
63+
}
64+
}

advisories/unreviewed/2026/04/GHSA-jpcj-7wfg-mqxv/GHSA-jpcj-7wfg-mqxv.json renamed to advisories/github-reviewed/2026/04/GHSA-jpcj-7wfg-mqxv/GHSA-jpcj-7wfg-mqxv.json

Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jpcj-7wfg-mqxv",
4-
"modified": "2026-04-08T18:34:06Z",
4+
"modified": "2026-04-08T19:24:12Z",
55
"published": "2026-04-08T18:34:06Z",
66
"aliases": [
77
"CVE-2026-31040"
88
],
9+
"summary": "stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution",
910
"details": "A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "stata-mcp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.13.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
@@ -29,13 +55,19 @@
2955
{
3056
"type": "WEB",
3157
"url": "https://github.com/SepineTam/stata-mcp/releases/tag/v1.13.0"
58+
},
59+
{
60+
"type": "PACKAGE",
61+
"url": "https://github.com/sepinetam/stata-mcp"
3262
}
3363
],
3464
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
37-
"github_reviewed": false,
38-
"github_reviewed_at": null,
65+
"cwe_ids": [
66+
"CWE-20"
67+
],
68+
"severity": "HIGH",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-04-08T19:24:12Z",
3971
"nvd_published_at": "2026-04-08T16:16:22Z"
4072
}
4173
}

‎advisories/github-reviewed/2026/04/GHSA-p423-j2cm-9vmq/GHSA-p423-j2cm-9vmq.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-p423-j2cm-9vmq",
4+
"modified": "2026-04-08T19:23:08Z",
5+
"published": "2026-04-08T19:23:08Z",
6+
"aliases": [
7+
"CVE-2026-39892"
8+
],
9+
"summary": "Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs",
10+
"details": "If a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. `Hash.update()`), this could lead to buffer overflows. For example:\n\n```python\nh = Hash(SHA256())\nb.update(buf[::-1])\n```\n\nwould read past the end of the buffer on Python >3.11",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "cryptography"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "45.0.0"
29+
},
30+
{
31+
"fixed": "46.0.7"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/pyca/cryptography"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-119"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-08T19:23:08Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)