Skip to content

Commit d4f4331

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2xf7-hmf6-p64j GHSA-7587-4wv6-m68m GHSA-8h58-w33p-wq3g GHSA-8wc6-vgrq-x6cf GHSA-9pj7-jh2r-87g8 GHSA-c7ph-f7jm-xv4w GHSA-rp46-r563-jrc7 GHSA-9pj7-jh2r-87g8 GHSA-rp46-r563-jrc7
1 parent b4e7ce4 commit d4f4331

9 files changed

Lines changed: 502 additions & 75 deletions

File tree

advisories/unreviewed/2026/02/GHSA-2xf7-hmf6-p64j/GHSA-2xf7-hmf6-p64j.json renamed to advisories/github-reviewed/2026/02/GHSA-2xf7-hmf6-p64j/GHSA-2xf7-hmf6-p64j.json

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,52 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2xf7-hmf6-p64j",
4-
"modified": "2026-02-13T12:31:21Z",
4+
"modified": "2026-02-13T20:55:54Z",
55
"published": "2026-02-13T12:31:21Z",
66
"aliases": [
77
"CVE-2026-20796"
88
],
9+
"summary": "Mattermost doesn't properly validate channel membership at the time of data retrieval",
910
"details": "Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "10.11.0"
29+
},
30+
{
31+
"fixed": "10.11.10"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 10.11.9"
38+
}
39+
}
40+
],
1741
"references": [
1842
{
1943
"type": "ADVISORY",
2044
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20796"
2145
},
46+
{
47+
"type": "PACKAGE",
48+
"url": "https://github.com/mattermost/mattermost"
49+
},
2250
{
2351
"type": "WEB",
2452
"url": "https://mattermost.com/security-updates"
@@ -29,8 +57,8 @@
2957
"CWE-367"
3058
],
3159
"severity": "LOW",
32-
"github_reviewed": false,
33-
"github_reviewed_at": null,
60+
"github_reviewed": true,
61+
"github_reviewed_at": "2026-02-13T20:55:54Z",
3462
"nvd_published_at": "2026-02-13T11:16:10Z"
3563
}
3664
}

‎advisories/github-reviewed/2026/02/GHSA-7587-4wv6-m68m/GHSA-7587-4wv6-m68m.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7587-4wv6-m68m",
4+
"modified": "2026-02-13T20:54:19Z",
5+
"published": "2026-02-13T20:54:19Z",
6+
"aliases": [],
7+
"summary": "rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895",
8+
"details": "### Summary\nIt was possible to trigger an unhandled edge case in the Rust Crypto rsa crate through rPGP packet parsing functionality, and crash the process that runs rPGP. This problem has been patched in a new rsa version. The new release of rPGP ensures a patched version of the rsa crate is in use, which prevents this issue.\n\n### Details\nWhile parsing a special RSA secret key packet, rPGP calls the rsa crate with the provided key. On vulnerable versions, this results in a Rust \"panic\" during key construction. Note that an attacker can trigger this situation even in places where applications don't expect to handle foreign key material, for example while attempting to receive a message.\n\nFor more information on the rsa crate vulnerability, see https://github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26 and https://github.com/RustCrypto/RSA/pull/624.\nIn rPGP, this has been fixed via https://github.com/rpgp/rpgp/pull/698.\n\n### Impact\nThis issue impacts availability (i.e. applications can crash).\n\nAffected rPGP versions: rPGP 0.16.0-alpha.0 to 0.18.0\nVulnerable rsa versions: all before version 0.9.10\n\n### Workaround\nThe issue depends on the combination of affected rPGP and rsa versions. Users of affected rPGP versions can pin the patched rsa 0.9.10 via a cargo lockfile to mitigate the issue.\n\n### Attribution\nDiscovered by Christian Reitter from Radically Open Security during a security review for Proton AG.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "pgp"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0.16.0-alpha.0"
27+
},
28+
{
29+
"fixed": "0.19.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-7587-4wv6-m68m"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/rpgp/rpgp/pull/698"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/rpgp/rpgp/commit/38efa49ce18b3821649de9cd8dea88a959b833a5"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/rpgp/rpgp"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-703"
57+
],
58+
"severity": "HIGH",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-02-13T20:54:19Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/02/GHSA-8h58-w33p-wq3g/GHSA-8h58-w33p-wq3g.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8h58-w33p-wq3g",
4+
"modified": "2026-02-13T20:54:27Z",
5+
"published": "2026-02-13T20:54:27Z",
6+
"aliases": [],
7+
"summary": "rPGP affected by crash in message handling for deeply nested messages",
8+
"details": "### Summary\nPrevious rPGP versions could be caused to crash with a \"stack overflow\" when parsing messages that contain deeply nested message layers, such as messages with many signatures.\n\nrPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).\n\n### Impact\nAn attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.\n\n### Attribution\nDiscovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "crates.io",
19+
"name": "pgp"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0.16.0-alpha.0"
27+
},
28+
{
29+
"fixed": "0.19.0"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-8h58-w33p-wq3g"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/rpgp/rpgp/pull/625"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/rpgp/rpgp/commit/e82f2c7494ba277d62fd372d69b2c008473bbef8"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/rpgp/rpgp"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-121"
57+
],
58+
"severity": "HIGH",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-02-13T20:54:27Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/02/GHSA-8wc6-vgrq-x6cf/GHSA-8wc6-vgrq-x6cf.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8wc6-vgrq-x6cf",
4+
"modified": "2026-02-13T20:53:58Z",
5+
"published": "2026-02-13T20:53:58Z",
6+
"aliases": [],
7+
"summary": "Child processes spawned by Renovate incorrectly have full access to environment variables",
8+
"details": "When Renovate spawns child processes, their access to environment variables is filtered to an allowlist, to prevent unauthorized access to privileged credentials that the Renovate process has access to.\n\nSince [42.68.1](https://github.com/renovatebot/renovate/releases/tag/42.68.1) (2025-12-30), this filtering had been **inadvertently removed**, and so any child processes spawned from these versions will have had access to any environment variables that Renovate has access to.\n\nThis could lead to [insider attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) and [outside attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-outsider-attack) being able to exflitrate secrets from the Renovate deployment.\n\nIt is recommended to rotate (+ revoke) any credentials that Renovate has access to, in case any spawned child processes have attempted to exfiltrate any secrets.\n\n## Impact\n\nChild processes spawned by Renovate (i.e. `npm install`, anything defined in [`postUpgradeTasks`](https://docs.renovatebot.com/configuration-options/#postupgradetasks) or [`postUpdateOptions`](https://docs.renovatebot.com/configuration-options/#postupdateoptions)) will have full access to the environment variables that the Renovate process has. \n\nThis could lead to [insider attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-insider-attack) and [outside attackers](https://docs.renovatebot.com/security-and-permissions/#execution-of-code-outsider-attack) being able to exflitrate secrets from the Renovate deployment.\n\n## Patches\n\nThis is patched in [42.96.3](https://github.com/renovatebot/renovate/releases/tag/42.96.3) and [43.4.4](https://github.com/renovatebot/renovate/releases/tag/43.4.4).\n\n## Workarounds\n\nThere are no workarounds, other than upgrading your Renovate version.\n\n## Why did this happen?\n\nAs part of work towards https://github.com/renovatebot/renovate/security/advisories/GHSA-pfq2-hh62-7m96, one of the [preparatory changes](https://github.com/renovatebot/renovate/pull/40212) we made was moving to [`execa`](https://www.npmjs.com/package/execa).\n\nOne of the default behaviours of `execa` is to [extend the process' environment variables with any new ones](https://github.com/sindresorhus/execa/tree/v8.0.1?tab=readme-ov-file#extendenv), rather than override them.\n\nThis was missed in code review, which meant that since this version, the full environment variables have been provided to any child processes spawned with `execa` by Renovate.\n\nThis was discovered as part of an unrelated change.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "renovate"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "42.68.1"
27+
},
28+
{
29+
"fixed": "42.96.3"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "npm",
38+
"name": "renovate"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "43.0.0"
46+
},
47+
{
48+
"fixed": "43.4.4"
49+
}
50+
]
51+
}
52+
]
53+
}
54+
],
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf"
59+
},
60+
{
61+
"type": "PACKAGE",
62+
"url": "https://github.com/renovatebot/renovate"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/renovatebot/renovate/releases/tag/42.96.3"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/renovatebot/renovate/releases/tag/43.4.4"
71+
}
72+
],
73+
"database_specific": {
74+
"cwe_ids": [
75+
"CWE-269"
76+
],
77+
"severity": "MODERATE",
78+
"github_reviewed": true,
79+
"github_reviewed_at": "2026-02-13T20:53:58Z",
80+
"nvd_published_at": null
81+
}
82+
}

‎advisories/github-reviewed/2026/02/GHSA-9pj7-jh2r-87g8/GHSA-9pj7-jh2r-87g8.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-9pj7-jh2r-87g8",
4+
"modified": "2026-02-13T20:56:15Z",
5+
"published": "2026-02-13T12:31:21Z",
6+
"aliases": [
7+
"CVE-2026-22892"
8+
],
9+
"summary": "Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts",
10+
"details": "Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attachments from channels they do not have access to via the /create-issue API endpoint by providing the post ID of an inaccessible post.. Mattermost Advisory ID: MMSA-2025-00550",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "11.2.0"
29+
},
30+
{
31+
"fixed": "11.2.2"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 11.2.1"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Go",
43+
"name": "github.com/mattermost/mattermost-server"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "11.1.0"
51+
},
52+
{
53+
"fixed": "11.1.3"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 11.1.2"
60+
}
61+
},
62+
{
63+
"package": {
64+
"ecosystem": "Go",
65+
"name": "github.com/mattermost/mattermost-server"
66+
},
67+
"ranges": [
68+
{
69+
"type": "ECOSYSTEM",
70+
"events": [
71+
{
72+
"introduced": "10.11.0"
73+
},
74+
{
75+
"fixed": "10.11.10"
76+
}
77+
]
78+
}
79+
],
80+
"database_specific": {
81+
"last_known_affected_version_range": "<= 10.11.9"
82+
}
83+
}
84+
],
85+
"references": [
86+
{
87+
"type": "ADVISORY",
88+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22892"
89+
},
90+
{
91+
"type": "PACKAGE",
92+
"url": "https://github.com/mattermost/mattermost"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://mattermost.com/security-updates"
97+
}
98+
],
99+
"database_specific": {
100+
"cwe_ids": [
101+
"CWE-863"
102+
],
103+
"severity": "MODERATE",
104+
"github_reviewed": true,
105+
"github_reviewed_at": "2026-02-13T20:56:15Z",
106+
"nvd_published_at": "2026-02-13T11:16:10Z"
107+
}
108+
}

0 commit comments

Comments
 (0)