Skip to content

Commit 67a4c30

Browse files
dacongdadacongda
authored
feat: add the data
1 parent 838486f commit 67a4c30

211 files changed

Lines changed: 3284 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/deploy-pages.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Deploy GitHub Pages
2+
3+
on:
4+
push:
5+
branches: [master]
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
pages: write
11+
id-token: write
12+
13+
concurrency:
14+
group: pages
15+
cancel-in-progress: false
16+
17+
jobs:
18+
build:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- name: Aggregate JSON data
24+
run: |
25+
python3 -c "
26+
import json, glob, os
27+
28+
cve_list = []
29+
for f in sorted(glob.glob('cve/*.json')):
30+
with open(f, 'r', encoding='utf-8') as fp:
31+
cve_list.append(json.load(fp))
32+
33+
fingerprint_list = []
34+
for f in sorted(glob.glob('fingerprint/*.json')):
35+
with open(f, 'r', encoding='utf-8') as fp:
36+
fingerprint_list.append(json.load(fp))
37+
38+
result = {
39+
'cveList': cve_list,
40+
'fingerprintList': fingerprint_list
41+
}
42+
43+
os.makedirs('_site', exist_ok=True)
44+
with open('_site/data.json', 'w', encoding='utf-8') as fp:
45+
json.dump(result, fp, ensure_ascii=False, indent=2)
46+
"
47+
48+
- name: Upload artifact
49+
uses: actions/upload-pages-artifact@v3
50+
51+
deploy:
52+
needs: build
53+
runs-on: ubuntu-latest
54+
environment:
55+
name: github-pages
56+
url: ${{ steps.deployment.outputs.page_url }}
57+
steps:
58+
- name: Deploy to GitHub Pages
59+
id: deployment
60+
uses: actions/deploy-pages@v4

‎cve/CVE-2019-9644.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"name": "jupyter-notebook",
3+
"code": "CVE-2019-9644",
4+
"summary": "An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server.",
5+
"description": "An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.",
6+
"severity": "MEDIUM",
7+
"suggestion": "1. Upgrade to jupyter-notebook>=5.7.6\n2. Ensure that all users are using browsers that do not include error messages in JavaScript execution contexts\n3. Regularly update and patch Jupyter Notebook to the latest version",
8+
"rule": "version < \"5.7.6\"",
9+
"references": [
10+
"https://nvd.nist.gov/vuln/detail/CVE-2019-9644",
11+
"https://github.com/jupyter/notebook",
12+
"https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2",
13+
"https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2019-159.yaml",
14+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D",
15+
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO"
16+
]
17+
}

‎cve/CVE-2020-26232.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"name": "jupyter-server",
3+
"code": "CVE-2020-26232",
4+
"summary": "The open redirect vulnerability in Jupyter Server allows a maliciously crafted link to redirect the browser to a different website.",
5+
"description": "The open redirect vulnerability in Jupyter Server allows a maliciously crafted link to redirect the browser to a different website. While all Jupyter servers are technically affected, such links can only be reasonably crafted for known Jupyter server hosts, potentially leading users to spoofed servers on the public internet.\nThis vulnerability originated in the jupyter/notebook project and was later addressed in the jupyter-server package.",
6+
"severity": "MEDIUM",
7+
"suggestion": "1. Upgrade to jupyter-server version 1.0.6 or later.\n2. Review and validate all external links to ensure they do not point to untrusted domains.\n3. Implement additional security measures such as Content Security Policies (CSP) to mitigate the risk of open redirects.",
8+
"rule": "version < \"1.0.6\"",
9+
"references": [
10+
"https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v",
11+
"https://nvd.nist.gov/vuln/detail/CVE-2020-26232",
12+
"https://github.com/jupyter-server/jupyter_server",
13+
"https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html"
14+
]
15+
}

‎cve/CVE-2021-32797.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"name": "jupyterlab",
3+
"code": "CVE-2021-32797",
4+
"summary": "Untrusted notebook can execute code on load.",
5+
"description": "Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.",
6+
"severity": "MEDIUM",
7+
"suggestion": "1. Upgrade to jupyterlab>=3.1.4 or jupyterlab>=3.0.17 or jupyterlab>=2.3.2 or jupyterlab>=2.2.10 or jupyterlab>=1.2.21\n2. Ensure that all notebooks are from trusted sources\n3. Implement Content Security Policy (CSP) to restrict form submissions",
8+
"rule": "version < \"1.2.21\" || (version >= \"2.0.0a0\" && version < \"2.2.10\") || (version >= \"2.3.0a0\" && version < \"2.3.2\") || (version >= \"3.0.0a0\" && version < \"3.0.17\") || (version >= \"3.1.0a0\" && version < \"3.1.4\")",
9+
"references": [
10+
"https://github.com/google/security-research/security/advisories/GHSA-c469-p3jp-2vhx",
11+
"https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx",
12+
"https://nvd.nist.gov/vuln/detail/CVE-2021-32797",
13+
"https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed",
14+
"https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2021-130.yaml"
15+
]
16+
}

‎cve/CVE-2021-41134.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"name": "jupyterlab",
3+
"code": "CVE-2021-41134",
4+
"summary": "Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability.",
5+
"description": "Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.\nSecurity patches have been released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.",
6+
"severity": "MEDIUM",
7+
"suggestion": "1. Upgrade nbdime python package to:\n - 1.x: v1.1.1 or higher\n - 2.x: v2.1.1 or higher\n - 3.x: v3.1.1 or higher\n2. Upgrade nbdime npm package to:\n - 5.x: v5.0.2 or higher\n - 6.x: v6.1.2 or higher\n3. Upgrade nbdime-jupyterlab npm package to:\n - 1.x: v1.0.1 or higher\n - 2.x: v2.1.1 or higher",
8+
"rule": "version < \"1.1.1\" || (version >= \"2.0.0\" && version < \"2.1.1\") || (version >= \"3.0.0\" && version < \"3.1.1\") || version < \"5.0.2\" || version >= \"6.0.0\" && version < \"6.1.2\" || version < \"1.0.1\" || version >= \"2.0.0\" && version < \"2.1.1\"",
9+
"references": [
10+
"https://github.com/jupyter/nbdime/security/advisories/GHSA-p6rw-44q7-3fw4",
11+
"https://nvd.nist.gov/vuln/detail/CVE-2021-41134",
12+
"https://github.com/jupyter/nbdime/commit/e44a5cc7677f24b45ebafc756db49058c2f750ea",
13+
"https://github.com/jupyter/nbdime",
14+
"https://github.com/pypa/advisory-database/tree/main/vulns/nbdime/PYSEC-2021-428.yaml"
15+
]
16+
}

‎cve/CVE-2022-21697.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"name": "jupyter-server",
3+
"code": "CVE-2022-21697",
4+
"summary": "### Impact **What kind of vulnerability is it?** Server-Side Request Forgery (SSRF) **Who is impacted?** Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled.",
5+
"description": "### Impact\n**What kind of vulnerability is it?** Server-Side Request Forgery (SSRF)\n**Who is impacted?** Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled.\nA lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity.\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nUpgrade to 3.2.1, or apply the patch https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch",
6+
"severity": "MEDIUM",
7+
"suggestion": "1. Upgrade to jupyter-server-proxy version 3.2.1 or higher.\n2. Apply the patch available at https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch if upgrading is not immediately feasible.",
8+
"rule": "version <= \"3.2.0\"",
9+
"references": [
10+
"https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw",
11+
"https://nvd.nist.gov/vuln/detail/CVE-2022-21697",
12+
"https://github.com/jupyterhub/jupyter-server-proxy/commit/fd31930bacd12188c448c886e0783529436b99eb",
13+
"https://github.com/jupyterhub/jupyter-server-proxy",
14+
"https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch",
15+
"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2022-16.yaml"
16+
]
17+
}

‎cve/CVE-2022-29241.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"name": "jupyter-server",
3+
"code": "CVE-2022-29241",
4+
"summary": "Affects: Notebook and Lab between 6.4.0 (potentially earlier) and 6.4.11 (currently latest).",
5+
"description": "Affects: Notebook and Lab between 6.4.0 (potentially earlier) and 6.4.11 (currently latest). Jupyter Server <=1.16.0. If the responsible code is as described, it will also affect Jupyter-Server 1.17.0 and 2.0.0a0.\n\nDescription: If notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this url can be used from an XSS payload (as in CVE-2021-32798) or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact with Jupyter services/notebooks such as modifying or overwriting critical files, such as .bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially sensitive data and possibly gain control of the impacted system.",
6+
"severity": "HIGH",
7+
"suggestion": "1. Upgrade to jupyter-server >=1.17.1\n2. Upgrade to jupyter-server >=2.0.0a1 if using version 2.0.0a0\n3. Ensure `root_dir` does not contain the user's home directory to mitigate the risk of token leakage",
8+
"rule": "(version >= \"6.4.0\" && version <= \"6.4.11\") || (version >= \"1.16.0\" && version < \"1.17.1\") || (version == \"2.0.0a0\")",
9+
"references": [
10+
"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-q874-g24w-4q9g",
11+
"https://nvd.nist.gov/vuln/detail/CVE-2022-29241",
12+
"https://github.com/jupyter-server/jupyter_server/commit/3485007abbb459585357212dcaa20521989272e8",
13+
"https://github.com/jupyter-server/jupyter_server/commit/877da10cd0d7ae45f8b1e385fa1f5a335e7adf1f",
14+
"https://github.com/jupyter-server/jupyter_server",
15+
"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2022-211.yaml"
16+
]
17+
}

‎cve/CVE-2023-0297.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"name": "pyload-ng",
3+
"code": "CVE-2023-0297",
4+
"summary": "Code Injection vulnerability exists in the GitHub repository pyload/pyload prior to version 0.5.0b3.dev31.",
5+
"description": "Code Injection vulnerability exists in the GitHub repository pyload/pyload prior to version 0.5.0b3.dev31.\nAttackers could exploit this vulnerability to execute arbitrary code.",
6+
"severity": "CRITICAL",
7+
"suggestion": "1. Upgrade to pyload-ng >= 0.5.0b3.dev31\n2. Review and patch any custom code that interacts with pyload-ng to ensure secure usage",
8+
"rule": "version < \"0.5.0b3.dev31\"",
9+
"references": [
10+
"https://nvd.nist.gov/vuln/detail/CVE-2023-0297",
11+
"https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d",
12+
"https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65",
13+
"http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html",
14+
"http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html"
15+
]
16+
}

‎cve/CVE-2023-0488.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"name": "pyload-ng",
3+
"code": "CVE-2023-0488",
4+
"summary": "Cross-site Scripting (XSS) vulnerability was found in the GitHub repository pyload/pyload prior to version 0.5.0b3.dev42.",
5+
"description": "Cross-site Scripting (XSS) vulnerability was found in the GitHub repository pyload/pyload prior to version 0.5.0b3.dev42.\nThis vulnerability allows attackers to inject malicious scripts into web pages viewed by other users.",
6+
"severity": "MEDIUM",
7+
"suggestion": "1. Upgrade to pyload-ng >= 0.5.0b3.dev42\n2. Review and sanitize all user input to prevent XSS attacks\n3. Regularly update and patch the software to mitigate future vulnerabilities",
8+
"rule": "version < \"0.5.0b3.dev42\"",
9+
"references": [
10+
"https://nvd.nist.gov/vuln/detail/CVE-2023-0488",
11+
"https://github.com/pyload/pyload/commit/46d75a3087f3237d06530d55998938e2e2bda6bd",
12+
"https://github.com/pyload/pyload",
13+
"https://huntr.dev/bounties/4311d8d7-682c-4f2a-b92c-3f9f1a36255a"
14+
]
15+
}

‎cve/CVE-2023-32786.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"name": "langchain",
3+
"code": "CVE-2023-32786",
4+
"summary": "In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.",
5+
"description": "In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.",
6+
"severity": "HIGH",
7+
"suggestion": "1. Upgrade to langchain>=0.0.329\n2. Implement strict input validation to prevent prompt injection\n3. Monitor and restrict outbound network requests from the application",
8+
"rule": "version < \"0.0.329\"",
9+
"references": [
10+
"https://nvd.nist.gov/vuln/detail/CVE-2023-32786",
11+
"https://github.com/langchain-ai/langchain/pull/12747",
12+
"https://gist.github.com/rharang/d265f46fc3161b31ac2e81db44d662e1",
13+
"https://github.com/langchain-ai/langchain",
14+
"https://github.com/langchain-ai/langchain/releases/tag/v0.0.329"
15+
]
16+
}

0 commit comments

Comments
 (0)