From 6d52329e3f78f84e953180cfd593ee34a64178f9 Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Sat, 7 Nov 2026 03:44:20 +0000 Subject: [PATCH] security-watch: memory of 2026-11-07 (R-1303). Docs only. --- documentation/security-watch/state.json | 136 ++++++++++++++---------- 1 file changed, 80 insertions(+), 56 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index a21044f2..22f7bb3d 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -56,6 +56,12 @@ "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state" }, + "codewithcj/sparkyfitness_server|GHSA-q26v-g5pj-r882": { + "first": "2026-11-07", + "last_mailed": "2026-11-07", + "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", + "summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead " + }, "codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": { "first": "2026-10-28", "last_mailed": "2026-11-04", @@ -74,6 +80,12 @@ "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state" }, + "codewithcj/sparkyfitness|GHSA-q26v-g5pj-r882": { + "first": "2026-11-07", + "last_mailed": "2026-11-07", + "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", + "summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead " + }, "codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": { "first": "2026-10-28", "last_mailed": "2026-11-04", @@ -110,12 +122,24 @@ "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", "summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, + "dooplex:codewithcj/sparkyfitness_server|GHSA-q26v-g5pj-r882": { + "first": "2026-11-07", + "last_mailed": "2026-11-07", + "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", + "summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead " + }, "dooplex:codewithcj/sparkyfitness_server|release:CodeWithCJ/SparkyFitness@v1.10.0": { "first": "2026-10-29", "last_mailed": "2026-11-05", "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", "summary": "1 for CVE-2026-111497 by @nalvazhvu in #3111" }, + "dooplex:codewithcj/sparkyfitness|GHSA-q26v-g5pj-r882": { + "first": "2026-11-07", + "last_mailed": "2026-11-07", + "program": "codewithcj/sparkyfitness v1.9.0 (workout-system/sparkyfitness.yaml)", + "summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead " + }, "dooplex:codewithcj/sparkyfitness|release:CodeWithCJ/SparkyFitness@v1.10.0": { "first": "2026-10-29", "last_mailed": "2026-11-05", @@ -2352,19 +2376,6 @@ "python": null, "unchecked": [] }, - "sha256:1e7c2345c493f9228a5dc2102be06b5a33331100f303fe0078502f4ef1068724": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:20a187e25a0872c2b7147c729e949c1611bdd32273109e92bb14ad08211d1b36", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:1feaaf724694d08a1fb19370b6ff37e6669edb16cae69e02660177253f903dc1": { "apk": {}, "brotli": null, @@ -2590,19 +2601,6 @@ "python": null, "unchecked": [] }, - "sha256:386c962ee6e260e3a5656b25df2ed056bcc9b6410e197d075f9547fd14c23bca": { - "apk": { - "brotli-libs": "1.2.1-r0" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:ee40ad01f650ef45d07b07eb149258104fbd07c23f6300eb9ab07227e536704f", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:38dc2727bfcfd5ede290f8ada114fc90368146f265ae4701ddddbcbe2a44ee52": { "apk": { "brotli-libs": "1.1.0-r2" @@ -2616,6 +2614,19 @@ "python": null, "unchecked": [] }, + "sha256:3b8c947d7fa173f70e40047d2c8d02835fb8416aeb5ae36def57d9ad15e2f906": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:7c88dcb802a230f6f1f94dbb6a10a04d39a2db3971c798e1c5d165913374840b", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": { "apk": {}, "brotli": null, @@ -2935,6 +2946,23 @@ "python": null, "unchecked": [] }, + "sha256:6f060cab421d9509c6c6a6a7762c651baf03c3f1d0145befe16b688762b7fe81": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1c4b59c1b05a318de5b55c0f82a0fd346eae9363bc959c49ebb476b06b02f20e", + "dpkg": { + "libbrotli1": "1.0.9-2+deb12u1", + "python3": "3.11.2-1+b1", + "python3.11": "3.11.2-6+deb12u9" + }, + "env": { + "PYTHON_VERSION": "3.15.2" + }, + "node": null, + "python": "3.15.2", + "unchecked": [] + }, "sha256:6f8f1fc29d1ff67b4d8d503bb4e0a69b55c8d42600decafde951344218193a27": { "apk": { "brotli-libs": "1.1.0-r2" @@ -2962,6 +2990,19 @@ "python": null, "unchecked": [] }, + "sha256:713fc2ebfd92e8217db451477182ee91944b123d2b1ee9fd5a8c6e91ca6c3a11": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:697b0b156c70b91130853fd0675c6be36665939d5f93dce2686be04b4c3f98a8", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:71885d8cc6e42f2bc0aa2eb853bfc4be200b5108a46ac50e117ae1df0531fb80": { "apk": {}, "brotli": null, @@ -3407,23 +3448,6 @@ "python": null, "unchecked": [] }, - "sha256:a4f372966d9f3f0935c724d1353172d6cc51683f50aee5395675857326bd6a6b": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:1c4b59c1b05a318de5b55c0f82a0fd346eae9363bc959c49ebb476b06b02f20e", - "dpkg": { - "libbrotli1": "1.0.9-2+deb12u1", - "python3": "3.11.2-1+b1", - "python3.11": "3.11.2-6+deb12u9" - }, - "env": { - "PYTHON_VERSION": "3.15.2" - }, - "node": null, - "python": "3.15.2", - "unchecked": [] - }, "sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2": { "apk": {}, "brotli": null, @@ -3588,19 +3612,6 @@ "python": null, "unchecked": [] }, - "sha256:b2f80f8f88146b0772fdcc7d92cea621aa8c2889fa8d07ed61d4884fcea53e09": { - "apk": { - "brotli-libs": "1.2.1-r0" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:697b0b156c70b91130853fd0675c6be36665939d5f93dce2686be04b4c3f98a8", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:b3b00047ed20f6ce2b16780145cb6a0acb51c9e28ea6aa6f5dcd33c7034f1797": { "apk": { "brotli-libs": "1.2.0-r1" @@ -3929,6 +3940,19 @@ "python": null, "unchecked": [] }, + "sha256:e01e61ac6bfbf34a2003364e1499faf2da0fba0a485e0f4b31c49b6576b95e9d": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1471c7d8d54828af6ad2a5d1067527cd87a9cae48f3905751c57b2ebda627f21", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:e3da62a847b9a5d51a11f73cfea1d9c13c3be3809614490d4edddcf01dcf919b": { "apk": {}, "brotli": null,