Skip to content

Commit a5f0517

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-965h-392x-2mh5 GHSA-v92g-xgxw-vvmm GHSA-xgp8-3hg3-c2mh
1 parent d8eb64e commit a5f0517

3 files changed

Lines changed: 214 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-965h-392x-2mh5/GHSA-965h-392x-2mh5.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-965h-392x-2mh5",
4+
"modified": "2026-04-16T21:16:23Z",
5+
"published": "2026-04-16T21:16:22Z",
6+
"aliases": [],
7+
"summary": "webpki: Name constraints for URI names were incorrectly accepted",
8+
"details": "Name constraints for URI names were ignored and therefore accepted.\n\nNote this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally.\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "rustls-webpki"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0.101.0"
27+
},
28+
{
29+
"fixed": "0.103.12"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "crates.io",
38+
"name": "rustls-webpki"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0.104.0-alpha.1"
46+
},
47+
{
48+
"fixed": "0.104.0-alpha.6"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5"
59+
},
60+
{
61+
"type": "PACKAGE",
62+
"url": "https://github.com/rustls/webpki"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0098.html"
67+
}
68+
],
69+
"database_specific": {
70+
"cwe_ids": [
71+
"CWE-295"
72+
],
73+
"severity": "LOW",
74+
"github_reviewed": true,
75+
"github_reviewed_at": "2026-04-16T21:16:22Z",
76+
"nvd_published_at": null
77+
}
78+
}

‎advisories/github-reviewed/2026/04/GHSA-v92g-xgxw-vvmm/GHSA-v92g-xgxw-vvmm.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v92g-xgxw-vvmm",
4+
"modified": "2026-04-16T21:16:40Z",
5+
"published": "2026-04-16T21:16:40Z",
6+
"aliases": [],
7+
"summary": "Mako: Path traversal via double-slash URI prefix in TemplateLookup",
8+
"details": "### Summary\n\n`TemplateLookup.get_template()` is vulnerable to path traversal when a URI starts with `//` (e.g., `//../../../secret.txt`). The root cause is an inconsistency between two slash-stripping implementations:\n\n- `Template.__init__` strips **one** leading `/` using `if`/slice\n- `TemplateLookup.get_template()` strips **all** leading `/` using `re.sub(r\"^\\/+\", \"\")`\n\nWhen a URI like `//../../../../etc/passwd` is passed:\n1. `get_template()` strips all `/` → `../../../../etc/passwd` → file found via `posixpath.join(dir_, u)`\n2. `Template.__init__` strips one `/` → `/../../../../etc/passwd` → `normpath` → `/etc/passwd`\n3. `/etc/passwd`.startswith(`..`) → `False` → **check bypassed**\n\n### Impact\n\nArbitrary file read: any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to `TemplateLookup.get_template()`.\n\nNote: this is exploitable at the library API level. HTTP-based exploitation is mitigated by Python's `BaseHTTPRequestHandler` which normalizes double-slash prefixes since CPython gh-87389. Applications using other HTTP servers that do not normalize paths may be affected.\n\n### Fix\n\nChanged `Template.__init__` to use `lstrip(\"/\")` instead of stripping only a single leading slash, so both code paths handle leading slashes consistently.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "Mako"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "1.3.11"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 1.3.10"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/sqlalchemy/mako"
47+
}
48+
],
49+
"database_specific": {
50+
"cwe_ids": [
51+
"CWE-22"
52+
],
53+
"severity": "MODERATE",
54+
"github_reviewed": true,
55+
"github_reviewed_at": "2026-04-16T21:16:40Z",
56+
"nvd_published_at": null
57+
}
58+
}

‎advisories/github-reviewed/2026/04/GHSA-xgp8-3hg3-c2mh/GHSA-xgp8-3hg3-c2mh.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xgp8-3hg3-c2mh",
4+
"modified": "2026-04-16T21:17:12Z",
5+
"published": "2026-04-16T21:17:12Z",
6+
"aliases": [],
7+
"summary": "webpki: Name constraints were accepted for certificates asserting a wildcard name",
8+
"details": "Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.\n\nThis was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.\nThis is very similar to [CVE-2025-61727](https://go.dev/issue/76442).\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "rustls-webpki"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0.101.0"
27+
},
28+
{
29+
"fixed": "0.103.12"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "crates.io",
38+
"name": "rustls-webpki"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "0.104.0-alpha.1"
46+
},
47+
{
48+
"fixed": "0.104.0-alpha.6"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh"
59+
},
60+
{
61+
"type": "PACKAGE",
62+
"url": "https://github.com/rustls/webpki"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0099.html"
67+
}
68+
],
69+
"database_specific": {
70+
"cwe_ids": [
71+
"CWE-295"
72+
],
73+
"severity": "LOW",
74+
"github_reviewed": true,
75+
"github_reviewed_at": "2026-04-16T21:17:12Z",
76+
"nvd_published_at": null
77+
}
78+
}

0 commit comments

Comments
 (0)