Skip to content

Commit 0dd36fd

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4ppj-4p4v-jf4p GHSA-qvpr-qm6w-6rcc GHSA-9jpj-g8vv-j5mf GHSA-ch86-pxr9-j9h9 GHSA-w48f-fwg7-ww6p GHSA-x3ff-w252-2g7j GHSA-ch86-pxr9-j9h9
1 parent 053e477 commit 0dd36fd

7 files changed

Lines changed: 112 additions & 77 deletions

File tree

‎advisories/github-reviewed/2022/05/GHSA-4ppj-4p4v-jf4p/GHSA-4ppj-4p4v-jf4p.json‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,19 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-4ppj-4p4v-jf4p",
4-
"modified": "2024-05-13T16:11:49Z",
4+
"modified": "2026-04-07T14:23:46Z",
55
"published": "2022-05-05T02:48:42Z",
66
"aliases": [
77
"CVE-2013-0270"
88
],
99
"summary": "OpenStack Keystone Denial of Service vulnerability via a large HTTP request",
1010
"details": "OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.",
11-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
15+
}
16+
],
1217
"affected": [
1318
{
1419
"package": {
@@ -43,6 +48,10 @@
4348
"type": "WEB",
4449
"url": "https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc"
4550
},
51+
{
52+
"type": "WEB",
53+
"url": "https://access.redhat.com/security/cve/CVE-2013-0270"
54+
},
4655
{
4756
"type": "WEB",
4857
"url": "https://bugs.launchpad.net/keystone/+bug/1099025"
@@ -62,7 +71,8 @@
6271
],
6372
"database_specific": {
6473
"cwe_ids": [
65-
"CWE-119"
74+
"CWE-119",
75+
"CWE-1284"
6676
],
6777
"severity": "MODERATE",
6878
"github_reviewed": true,

‎advisories/github-reviewed/2022/05/GHSA-qvpr-qm6w-6rcc/GHSA-qvpr-qm6w-6rcc.json‎

Lines changed: 15 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,19 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-qvpr-qm6w-6rcc",
4-
"modified": "2024-11-21T21:48:41Z",
4+
"modified": "2026-04-07T14:23:41Z",
55
"published": "2022-05-17T01:39:21Z",
66
"aliases": [
77
"CVE-2012-5571"
88
],
99
"summary": "OpenStack Keystone intended authorization restrictions bypass",
1010
"details": "OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.",
11-
"severity": [],
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
15+
}
16+
],
1217
"affected": [
1318
{
1419
"package": {
@@ -28,22 +33,6 @@
2833
]
2934
}
3035
]
31-
},
32-
{
33-
"package": {
34-
"ecosystem": "PyPI",
35-
"name": "keystone"
36-
},
37-
"ranges": [
38-
{
39-
"type": "ECOSYSTEM",
40-
"events": [
41-
{
42-
"introduced": "0"
43-
}
44-
]
45-
}
46-
]
4736
}
4837
],
4938
"references": [
@@ -63,6 +52,10 @@
6352
"type": "WEB",
6453
"url": "https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff41586ad9653"
6554
},
55+
{
56+
"type": "WEB",
57+
"url": "https://access.redhat.com/security/cve/CVE-2012-5571"
58+
},
6659
{
6760
"type": "WEB",
6861
"url": "https://bugs.launchpad.net/keystone/+bug/1064914"
@@ -117,8 +110,10 @@
117110
}
118111
],
119112
"database_specific": {
120-
"cwe_ids": [],
121-
"severity": "LOW",
113+
"cwe_ids": [
114+
"CWE-639"
115+
],
116+
"severity": "MODERATE",
122117
"github_reviewed": true,
123118
"github_reviewed_at": "2024-01-12T20:22:36Z",
124119
"nvd_published_at": "2012-12-18T01:55:00Z"

‎advisories/github-reviewed/2026/04/GHSA-9jpj-g8vv-j5mf/GHSA-9jpj-g8vv-j5mf.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9jpj-g8vv-j5mf",
4-
"modified": "2026-04-04T06:26:55Z",
4+
"modified": "2026-04-07T14:24:16Z",
55
"published": "2026-04-04T06:26:55Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-34511"
8+
],
79
"summary": "OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter",
810
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth `state` value. Because the provider reflected `state` back in the redirect URL, the verifier could be exposed alongside the authorization code.\n\n## Impact\n\nAnyone who could capture the redirect URL could learn both the authorization code and the PKCE verifier, defeating PKCE's interception protection for that flow and enabling token redemption.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `a26f4d0f3ef0757db6c6c40277cc06a5de76c52f` — separate OAuth state from the PKCE verifier\n\nOpenClaw thanks @BG0ECV for reporting.",
911
"severity": [
@@ -41,13 +43,21 @@
4143
"type": "WEB",
4244
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34511"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/openclaw/openclaw/commit/a26f4d0f3ef0757db6c6c40277cc06a5de76c52f"
4753
},
4854
{
4955
"type": "PACKAGE",
5056
"url": "https://github.com/openclaw/openclaw"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.vulncheck.com/advisories/openclaw-pkce-verifier-exposure-via-oauth-state-parameter"
5161
}
5262
],
5363
"database_specific": {

‎advisories/github-reviewed/2026/04/GHSA-ch86-pxr9-j9h9/GHSA-ch86-pxr9-j9h9.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ch86-pxr9-j9h9",
4+
"modified": "2026-04-07T14:24:10Z",
5+
"published": "2026-04-03T21:31:43Z",
6+
"withdrawn": "2026-04-07T14:24:10Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9jpj-g8vv-j5mf. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.4.2"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34511"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/a26f4d0f3ef0757db6c6c40277cc06a5de76c52f"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-pkce-verifier-exposure-via-oauth-state-parameter"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-330"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-04-07T14:24:10Z",
66+
"nvd_published_at": "2026-04-03T21:17:11Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/04/GHSA-w48f-fwg7-ww6p/GHSA-w48f-fwg7-ww6p.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-w48f-fwg7-ww6p",
4-
"modified": "2026-04-04T04:24:27Z",
4+
"modified": "2026-04-07T14:23:12Z",
55
"published": "2026-04-04T04:24:27Z",
66
"aliases": [],
77
"summary": "@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",
8-
"details": "### Summary\n\n`@stablelib/cbor` decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named `__proto__` therefore changes the prototype of the decoded object instead of becoming an ordinary data property.\n\n### Details\n\nThe decoder builds map results with a plain `{}` and then stores attacker-controlled keys using bracket assignment.\n\nThat is unsafe for special property names. In JavaScript, assigning to `obj[\"__proto__\"]` on a normal object does not create a plain own property. It invokes the built-in `__proto__` setter and replaces the object’s prototype if the supplied value is an object or `null`.\n\nAs a result, a CBOR payload containing a map entry like:\n\n* key: `\"__proto__\"`\n* value: `{ isAdmin: true }`\n\ndoes not decode to an object with an own property called `__proto__`. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values.\n\n### PoC\n\n```js\nimport { decode } from \"@stablelib/cbor\";\n\n// CBOR:\n// {\n// \"__proto__\": { \"isAdmin\": true }\n// }\n//\n// a1 map(1)\n// 69 text(9)\n// \"__proto__\"\n// a1 map(1)\n// 67 text(7)\n// \"isAdmin\"\n// f5 true\n\nconst payload = new Uint8Array([\n 0xa1,\n 0x69, 0x5f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x5f, 0x5f,\n 0xa1,\n 0x67, 0x69, 0x73, 0x41, 0x64, 0x6d, 0x69, 0x6e,\n 0xf5\n]);\n\nconst obj = decode(payload);\n\nconsole.log(Object.hasOwn(obj, \"isAdmin\")); // false\nconsole.log(obj.isAdmin); // true\nconsole.log(Object.getPrototypeOf(obj).isAdmin); // true\n```\n\n### Impact\n\nAny application that decodes untrusted CBOR into JavaScript objects can receive objects with attacker-controlled prototypes.\n\nIn practice, that can corrupt configuration objects, influence authorization checks, alter feature flags, and break application logic that relies on normal property lookup instead of strict own-property checks. If the decoded object is later merged into other objects, the impact can spread further.",
8+
"details": "### Summary\n\n`@stablelib/cbor` decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named `__proto__` therefore changes the prototype of the decoded object instead of becoming an ordinary data property.\n\n### Details\n\nThe decoder builds map results with a plain `{}` and then stores attacker-controlled keys using bracket assignment.\n\nThat is unsafe for special property names. In JavaScript, assigning to `obj[\"__proto__\"]` on a normal object does not create a plain own property. It invokes the built-in `__proto__` setter and replaces the object’s prototype if the supplied value is an object or `null`.\n\nAs a result, a CBOR payload containing a map entry like:\n\n* key: `\"__proto__\"`\n* value: `{ isAdmin: true }`\n\ndoes not decode to an object with an own property called `__proto__`. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values.\n\n### PoC\n\n```js\nimport { decode } from \"@stablelib/cbor\";\n\n// CBOR:\n// {\n// \"__proto__\": { \"isAdmin\": true }\n// }\n//\n// a1 map(1)\n// 69 text(9)\n// \"__proto__\"\n// a1 map(1)\n// 67 text(7)\n// \"isAdmin\"\n// f5 true\n\nconst payload = new Uint8Array([\n 0xa1,\n 0x69, 0x5f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x5f, 0x5f,\n 0xa1,\n 0x67, 0x69, 0x73, 0x41, 0x64, 0x6d, 0x69, 0x6e,\n 0xf5\n]);\n\nconst obj = decode(payload);\n\nconsole.log(Object.hasOwn(obj, \"isAdmin\")); // false\nconsole.log(obj.isAdmin); // true\nconsole.log(Object.getPrototypeOf(obj).isAdmin); // true\n```\n\n### Impact\n\nAny application that decodes untrusted CBOR into JavaScript objects can receive objects with attacker-controlled prototypes.\n\nIn practice, that can corrupt configuration objects, influence authorization checks, alter feature flags, and break application logic that relies on normal property lookup instead of strict own-property checks. If the decoded object is later merged into other objects, the impact can spread further.\n\n### Solution\n\nUpgrade to version 2.0.4.",
99
"severity": [
1010
{
1111
"type": "CVSS_V4",

0 commit comments

Comments
 (0)