Security update for govulncheck-vulndb SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:4042-1 Final 1 1 2024-11-22T10:44:11Z current 2024-11-22T10:44:11Z 2024-11-22T10:44:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for govulncheck-vulndb This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20241112T145010 2024-11-12T14:50:10Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3250 CVE-2024-51744 GHSA-29wx-vh33-7x7r - Update to version 0.0.20241108T172500 2024-11-08T17:25:00Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3260 CVE-2024-45794 GHSA-q78v-cv36-8fxj * GO-2024-3262 CVE-2024-10975 GHSA-2w5v-x29g-jw7j - Update to version 0.0.20241106T172143 2024-11-06T17:21:43Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3251 CVE-2024-10389 GHSA-q3rp-vvm7-j8jg * GO-2024-3252 CVE-2024-51746 GHSA-8pmp-678w-c8xx * GO-2024-3253 CVE-2024-48057 GHSA-ghx4-cgxw-7h9p * GO-2024-3254 CVE-2024-51735 GHSA-wvv7-wm5v-w2gv The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-4042,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-4042,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-4042,openSUSE-SLE-15.5-2024-4042,openSUSE-SLE-15.6-2024-4042 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ Link for SUSE-SU-2024:4042-1 https://lists.suse.com/pipermail/sle-security-updates/2024-November/019840.html E-Mail link for SUSE-SU-2024:4042-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-10389/ SUSE CVE CVE-2024-10389 page https://www.suse.com/security/cve/CVE-2024-10975/ SUSE CVE CVE-2024-10975 page https://www.suse.com/security/cve/CVE-2024-45794/ SUSE CVE CVE-2024-45794 page https://www.suse.com/security/cve/CVE-2024-48057/ SUSE CVE CVE-2024-48057 page https://www.suse.com/security/cve/CVE-2024-51735/ SUSE CVE CVE-2024-51735 page https://www.suse.com/security/cve/CVE-2024-51744/ SUSE CVE CVE-2024-51744 page https://www.suse.com/security/cve/CVE-2024-51746/ SUSE CVE CVE-2024-51746 page SUSE Linux Enterprise Module for Package Hub 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 as a component of openSUSE Leap 15.5 govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 as a component of openSUSE Leap 15.6 There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc CVE-2024-10389 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-10389.html CVE-2024-10389 Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. CVE-2024-10975 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-10975.html CVE-2024-10975 devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-45794 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-45794.html CVE-2024-45794 localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage. CVE-2024-48057 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-48057.html CVE-2024-48057 Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the `general-template.md` template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch. CVE-2024-51735 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-51735.html CVE-2024-51735 golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above. CVE-2024-51744 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-51744.html CVE-2024-51744 https://bugzilla.suse.com/1232936 SUSE Bug 1232936 Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification. Impact is minimal as while gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder. CVE-2024-51746 SUSE Linux Enterprise Module for Package Hub 15 SP5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.5:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 openSUSE Leap 15.6:govulncheck-vulndb-0.0.20241112T145010-150000.1.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20244042-1/ https://www.suse.com/security/cve/CVE-2024-51746.html CVE-2024-51746 https://bugzilla.suse.com/1232903 SUSE Bug 1232903