Skip to content

Commit dcd6f40

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-fh34-c629-p8xj GHSA-h2h4-5m64-m273 GHSA-qffm-gf3j-6mvg GHSA-qffm-gf3j-6mvg
1 parent b14e3d5 commit dcd6f40

File tree

4 files changed

+137
-43
lines changed

4 files changed

+137
-43
lines changed

advisories/unreviewed/2026/04/GHSA-fh34-c629-p8xj/GHSA-fh34-c629-p8xj.json renamed to advisories/github-reviewed/2026/04/GHSA-fh34-c629-p8xj/GHSA-fh34-c629-p8xj.json

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-fh34-c629-p8xj",
4-
"modified": "2026-04-07T18:31:37Z",
4+
"modified": "2026-04-08T19:31:30Z",
55
"published": "2026-04-07T18:31:37Z",
66
"aliases": [
77
"CVE-2026-27315"
88
],
9+
"summary": "Apache Cassandra has sensitive Information Leak in cqlsh",
910
"details": "Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via  ~/.cassandra/cqlsh_history local file access.\n\nUsers are recommended to upgrade to version 4.0.20, which fixes this issue.\n\n--\nDescription: Cassandra's command-line tool, cqlsh, provides a command history feature that allows users to recall previously executed commands using the up/down arrow keys. These history records are saved in the ~/.cassandra/cqlsh_history file in the user's home directory.\n\nHowever, cqlsh does not redact sensitive information when saving command history. This means that if a user executes operations involving passwords (such as logging in or creating users) within cqlsh, these passwords are permanently stored in cleartext in the history file on the disk.",
10-
"severity": [],
11-
"affected": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.cassandra:cassandra-all"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0"
29+
},
30+
{
31+
"fixed": "4.0.20"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1238
"references": [
1339
{
1440
"type": "ADVISORY",
1541
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27315"
1642
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/cassandra"
46+
},
1747
{
1848
"type": "WEB",
1949
"url": "https://issues.apache.org/jira/browse/CASSANDRA-21180"
@@ -31,9 +61,9 @@
3161
"cwe_ids": [
3262
"CWE-532"
3363
],
34-
"severity": null,
35-
"github_reviewed": false,
36-
"github_reviewed_at": null,
64+
"severity": "MODERATE",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-04-08T19:31:30Z",
3767
"nvd_published_at": "2026-04-07T17:16:27Z"
3868
}
3969
}

‎advisories/github-reviewed/2026/04/GHSA-h2h4-5m64-m273/GHSA-h2h4-5m64-m273.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h2h4-5m64-m273",
4-
"modified": "2026-04-08T15:04:05Z",
4+
"modified": "2026-04-08T19:31:03Z",
55
"published": "2026-04-07T09:31:22Z",
66
"aliases": [
77
"CVE-2026-33227"
88
],
99
"summary": "Apache ActiveMQ: Improper validation and restriction of a classpath path name",
10-
"details": "Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit.This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.",
10+
"details": "Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.\n\nIn two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided \"key\" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.\n\nUsers are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.",
1111
"severity": [
1212
{
1313
"type": "CVSS_V3",

‎advisories/github-reviewed/2026/04/GHSA-qffm-gf3j-6mvg/GHSA-qffm-gf3j-6mvg.json‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qffm-gf3j-6mvg",
4+
"modified": "2026-04-08T19:31:59Z",
5+
"published": "2026-04-07T18:31:37Z",
6+
"aliases": [
7+
"CVE-2026-32588"
8+
],
9+
"summary": "Apache Cassandra has an authenticated DoS over CQL",
10+
"details": "Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.\nUsers are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.cassandra:cassandra-all"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0"
29+
},
30+
{
31+
"fixed": "4.0.20"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.cassandra:cassandra-all"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "4.1"
48+
},
49+
{
50+
"fixed": "4.1.11"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Maven",
59+
"name": "org.apache.cassandra:cassandra-all"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "5.0"
67+
},
68+
{
69+
"fixed": "5.0.7"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "ADVISORY",
79+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32588"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "http://www.openwall.com/lists/oss-security/2026/04/07/9"
88+
}
89+
],
90+
"database_specific": {
91+
"cwe_ids": [
92+
"CWE-400"
93+
],
94+
"severity": "LOW",
95+
"github_reviewed": true,
96+
"github_reviewed_at": "2026-04-08T19:31:59Z",
97+
"nvd_published_at": "2026-04-07T17:16:28Z"
98+
}
99+
}

‎advisories/unreviewed/2026/04/GHSA-qffm-gf3j-6mvg/GHSA-qffm-gf3j-6mvg.json‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

0 commit comments

Comments
 (0)