Skip to content
OpenAdvisories
High WID-SEC-2022-1935 3 CVEs

Microsoft GitHub Enterprise: Mehrere Schwachstellen

Published Nov 1, 2022 · Updated Apr 2, 2023 · Revision 5 · de-DE

Vendor: amazon Vendor: Fedora Vendor: Microsoft Vendor: SUSE Product: GitHub Enterprise Product: GitHub Enterprise < 3.2.20 Product: GitHub Enterprise < 3.3.15 Product: GitHub Enterprise < 3.4.10 Product: GitHub Enterprise < 3.5.7 Product: GitHub Enterprise < 3.6.3 Product: Linux Product: Linux Product: Linux 2 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft GitHub Enterprise ausnutzen, um Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Product

GitHub ist ein netzbasierter Dienst zur Versionsverwaltung für Software-Entwicklungsprojekte.

Vulnerabilities 3

  • High 8.2
    CVE-2022-29181

    Improper Handling of Unexpected Data Type in Nokogiri

    Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads…

    sparklemotion nokogiri nokogiri ruby-nokogiri Debian Ubuntu Alpine RubyGems
  • High 7.5
    CVE-2022-39209

    Uncontrolled Resource Consumption in cmark-gfm

    cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent d…

    GitHub cmark-gfm ruby-commonmarker python-cmarkgfm Debian Ubuntu
  • Medium 5.7
    CVE-2022-23738

    Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files

    An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enter…

    GitHub GitHub Enterprise Server

Revision history

  1. #5

    Neue Updates von Fedora aufgenommen

  2. #4

    Neue Updates von Amazon aufgenommen

  3. #3

    Neue Updates von SUSE aufgenommen

  4. #2

    Neue Updates von SUSE aufgenommen

  5. #1

    Initiale Fassung

References