Skip to content

Commit d068377

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-gxp5-mv27-vjcj GHSA-mw8h-g64c-rxv4 GHSA-w96v-gf22-crwp GHSA-whqx-f9j3-ch6m
1 parent 53d006f commit d068377

4 files changed

Lines changed: 260 additions & 5 deletions

File tree

‎advisories/github-reviewed/2026/01/GHSA-gxp5-mv27-vjcj/GHSA-gxp5-mv27-vjcj.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gxp5-mv27-vjcj",
4+
"modified": "2026-01-13T14:56:49Z",
5+
"published": "2026-01-13T14:56:49Z",
6+
"aliases": [
7+
"CVE-2025-68931"
8+
],
9+
"summary": "Jervis's AES CBC Mode is Without Authentication",
10+
"details": "### Vulnerability\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L682-L684\n\nhttps://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L720-L722\n\n`AES/CBC/PKCS5Padding` lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation.\n\n### Impact\n\nSeverity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical.\n\nUnlikely to matter due to the design of how AES-256-CBC is used in conjunction with RSA and SHA-256 checksum within Jervis.\n\nJervis uses RSA to encrypt AES keys and a SHA-256 checksum of the encrypted data in local-only storage inaccessible from the web. After asymmetric decryption and before symmetric decryption, a SHA-256 checksum is performed on the metadata and encrypted data. All encrypted data is discarded if the checksum does not match without attempting to decrypt since the encrypted data is assumed invalid. The data stored is GitHub App authentication tokens which will expire within one hour.\n\n### Patches\n\nJervis patch will migrate from `AES/CBC/PKCS5Padding` to `AES/GCM/NoPadding`.\n\nUpgrade to Jervis 2.2.\n\n### Workarounds\n\nNone\n\n### References\n\n- [Padding Oracle Attacks](https://en.wikipedia.org/wiki/Padding_oracle_attack)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "net.gleske:jervis"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/samrocketman/jervis/security/advisories/GHSA-gxp5-mv27-vjcj"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/samrocketman/jervis"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L682-L684"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L720-L722"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "http://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-287",
63+
"CWE-327"
64+
],
65+
"severity": "HIGH",
66+
"github_reviewed": true,
67+
"github_reviewed_at": "2026-01-13T14:56:49Z",
68+
"nvd_published_at": null
69+
}
70+
}

advisories/unreviewed/2026/01/GHSA-mw8h-g64c-rxv4/GHSA-mw8h-g64c-rxv4.json renamed to advisories/github-reviewed/2026/01/GHSA-mw8h-g64c-rxv4/GHSA-mw8h-g64c-rxv4.json

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mw8h-g64c-rxv4",
4-
"modified": "2026-01-10T00:30:30Z",
4+
"modified": "2026-01-13T14:58:03Z",
55
"published": "2026-01-09T21:31:35Z",
66
"aliases": [
77
"CVE-2025-60538"
88
],
9+
"summary": "Shiori is vulnerable to authentication bypass via a brute force attack",
910
"details": "A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-shiori/shiori"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.7.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -24,7 +45,7 @@
2445
"url": "https://github.com/go-shiori/shiori/issues/1138"
2546
},
2647
{
27-
"type": "WEB",
48+
"type": "PACKAGE",
2849
"url": "https://github.com/go-shiori/shiori"
2950
}
3051
],
@@ -33,8 +54,8 @@
3354
"CWE-290"
3455
],
3556
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-01-13T14:58:03Z",
3859
"nvd_published_at": "2026-01-09T21:16:13Z"
3960
}
4061
}

‎advisories/github-reviewed/2026/01/GHSA-w96v-gf22-crwp/GHSA-w96v-gf22-crwp.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w96v-gf22-crwp",
4+
"modified": "2026-01-13T14:57:12Z",
5+
"published": "2026-01-13T14:57:12Z",
6+
"aliases": [
7+
"CVE-2025-68949"
8+
],
9+
"summary": "n8n: Webhook Node IP Whitelist Bypass via Partial String Matching",
10+
"details": "## Impact\nThe Webhook node’s IP whitelist validation performed partial string matching instead of exact IP comparison. As a result, an incoming request could be accepted if the source IP address merely contained the configured whitelist entry as a substring.\n\nThis issue affected instances where workflow editors relied on IP-based access controls to restrict webhook access. Both IPv4 and IPv6 addresses were impacted. An attacker with a non-whitelisted IP could bypass restrictions if their IP shared a partial prefix with a trusted address, undermining the intended security boundary.\n\n## Patches\nThis issue has been patched in version 2.2.0.\n\nUsers are advised to upgrade to v2.2.0 or later, where IP whitelist validation uses strict IP comparison logic rather than partial string matching.\n\n## Workarounds\nUsers unable to upgrade immediately should avoid relying solely on IP whitelisting for webhook security. Recommended mitigations include:\n- Adding authentication mechanisms such as shared secrets, HMAC signatures, or API keys.\n- Avoiding short or prefix-based whitelist entries.\n- Enforcing IP filtering at the network layer (for example, via reverse proxies or firewalls).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "n8n"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "1.36.0"
29+
},
30+
{
31+
"fixed": "2.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-w96v-gf22-crwp"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/n8n-io/n8n/issues/23399"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/n8n-io/n8n/pull/23399"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/n8n-io/n8n/commit/11f8597d4ad69ea3b58941573997fdbc4de1fec5"
54+
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/n8n-io/n8n"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-183",
63+
"CWE-284"
64+
],
65+
"severity": "MODERATE",
66+
"github_reviewed": true,
67+
"github_reviewed_at": "2026-01-13T14:57:12Z",
68+
"nvd_published_at": null
69+
}
70+
}

‎advisories/github-reviewed/2026/01/GHSA-whqx-f9j3-ch6m/GHSA-whqx-f9j3-ch6m.json‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-whqx-f9j3-ch6m",
4+
"modified": "2026-01-13T14:58:50Z",
5+
"published": "2026-01-13T14:58:50Z",
6+
"aliases": [
7+
"CVE-2026-22703"
8+
],
9+
"summary": "Cosign verification accepts any valid Rekor entry under certain conditions",
10+
"details": "### Impact\n\nA Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event.\n\nThis vulnerability only affects users that provide a trusted root via `--trusted-root` or when fetched automatically from a TUF repository, when no trusted key material is provided via `SIGSTORE_REKOR_PUBLIC_KEY`. When using the default flag values in Cosign v3 to sign and verify (`--use-signing-config=true` and `--new-bundle-format=true` for signing, `--new-bundle-format=true` for verification), users are unaffected. Cosign v2 users are affected using the default flag values.\n\nThis issue had previously been fixed in https://github.com/sigstore/cosign/security/advisories/GHSA-8gw7-4j42-w388 but recent refactoring caused a regression. We have added testing to prevent a future regression.\n\n#### Steps to Reproduce\n\n```\necho blob > /tmp/blob\ncosign sign-blob -y --new-bundle-format=false --bundle /tmp/bundle.1 --use-signing-config=false /tmp/blob\ncosign sign-blob -y --new-bundle-format=false --bundle /tmp/bundle.2 --use-signing-config=false /tmp/blob\njq \".rekorBundle |= $(jq .rekorBundle /tmp/bundle.2)\" /tmp/bundle.1 > /tmp/bundle.3\ncosign verify-blob --bundle /tmp/bundle.3 --certificate-identity-regexp='.*' --certificate-oidc-issuer-regexp='.*' /tmp/blob\n```\n\n### Patches\n\nUpgrade to Cosign v2.6.2 or Cosign v3.0.4. This does not affect Cosign v1.\n\n### Workarounds\n\nYou can provide trusted key material via a set of flags under certain conditions. The simplest fix is to upgrade to the latest Cosign v2 or v3 release.\n\nNote that the example below works for `cosign verify`, `cosign verify-blob, `cosign verify-blob-attestation`, and `cosign verify-attestation`.\n\n```\nSIGSTORE_REKOR_PUBLIC_KEY=<path to Rekor pub key> cosign verify-blob --use-signing-config=false --new-bundle-format=false --bundle=<path to bundle> <artifact>\n```",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/sigstore/cosign/v3"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.0.4"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.0.3"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Go",
43+
"name": "github.com/sigstore/cosign/v2"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0"
51+
},
52+
{
53+
"fixed": "2.6.2"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 2.6.1"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22703"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/sigstore/cosign/pull/4623"
75+
},
76+
{
77+
"type": "WEB",
78+
"url": "https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176"
79+
},
80+
{
81+
"type": "PACKAGE",
82+
"url": "https://github.com/sigstore/cosign"
83+
}
84+
],
85+
"database_specific": {
86+
"cwe_ids": [
87+
"CWE-345"
88+
],
89+
"severity": "MODERATE",
90+
"github_reviewed": true,
91+
"github_reviewed_at": "2026-01-13T14:58:50Z",
92+
"nvd_published_at": "2026-01-10T07:16:03Z"
93+
}
94+
}

0 commit comments

Comments
 (0)