Summary
The CSAF full validator implementations csaf-validator-lib and csaf-validator-service provided by the Secvisogram project are missing the validation of the provided test names. Updates are available.
Product
csaf-validator-lib is a CSAF full validator written as a JavaScript library. It implements the business level tests that can be shared across application working with CSAF.
csaf-validator-service is a REST-based service used to validate documents against the CSAF standard. It uses the csaf-validator-lib under the hood which is included as a git subtree module.
Vulnerabilities 2
-
High 7.5
Insufficient Input Validation in the Endpoint of the csaf-validator-service
The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an unauthenticated remote user might lead to a partial DoS of the service. Only t…
-
Medium 6.5
Arbitrary Code Execution using the validate function of csaf-validator-lib
An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation.
Revision history
-
#4
Update CVSS vectors and CWEs
-
#3
Improve vulnerability notes
-
#2
Add CVEs
-
#1
Initial version.
References
-
Secvisogram - csaf-validator-lib repository
https://github.com/secvisogram/csaf-validator-lib
-
Secvisogram - csaf-validator-service repository
https://github.com/secvisogram/csaf-validator-service