Hex Advisories.

HTTP/2 frame size limit checked after body is buffered in bandit

• Denial of service

>=0.3.6, <1.11.0 · fixed in 1.11.0

Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy

• Denial of service

>=2.0.0, <2.8.1 · fixed in 2.8.1

Multipart form body parser bypasses body size limits in wisp

• Denial of service

>=0.2.0, <2.2.2 · fixed in 2.2.2

ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)

• Other injection

<3.0.6 · fixed in 3.0.6

Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

• Denial of service

<3.22.0 · fixed in 3.22.0

elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Condition

• Race condition

<3.1.4 · fixed in 3.1.4

XXE in esaml SAML library allows local file read and potential SSRF

• XML external entities (XXE)

* · no fixed version yet

Loop with Unreachable Exit Condition ('Infinite Loop') in ewe

• Memory corruption
• Denial of service

>=0.8.0, <3.0.5 · fixed in 3.0.5

Permissive List of Allowed Inputs in ewe

• CWE-183

>=0.6.0, <3.0.5 · fixed in 3.0.5

Path Traversal in wisp.serve_static allows arbitrary file read

• Path traversal

>=2.1.1, <2.2.1 · fixed in 2.2.1

Unsafe Deserialization of Erlang Terms in hex_core

• Denial of service
• Insecure deserialization

>=0.1.0, <0.12.1 · fixed in 0.12.1

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

• Weak cryptography or TLS
• CWE-115

<1.0.0 · fixed in 1.0.0

Authorization bypass when bypass policy condition evaluates to true

• Broken access control

>=3.6.3, <3.7.1 · fixed in 3.7.1

Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization

• Broken access control

>=0.1.1, <3.6.2 · fixed in 3.6.2

Before action hooks may execute in certain scenarios despite a request being forbidden

• Broken access control

>=0.1.1, <3.5.39 · fixed in 3.5.39

Missing Session Revocation on Logout in ash_authentication_phoenix

• Authentication bypass

>=0.1.0, <2.10.0 · fixed in 2.10.0

Hackney fails to properly release HTTP connections to the pool

• Denial of service

<1.24.0 · fixed in 1.24.0

ash_authentication has email link auto-click account confirmation vulnerability

• Authentication bypass

<4.7.0 · fixed in 4.7.0

Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install`

• Privilege escalation

>=4.1.0, <4.4.9 · fixed in 4.4.9

Server-side Request Forgery (SSRF) in hackney

• Server-side request forgery (SSRF)

<1.21.0 · fixed in 1.21.0

RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission

• Broken access control

>=3.12.7, <3.12.11 · fixed in 3.12.11

In AshPostgres, empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.

• Information disclosure

>=2.0.0, <2.4.10 · fixed in 2.4.10

OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

• Denial of service

>=3.0.0, <3.0.2 || >=3.1.0, <3.1.2 || >=3.2.0-beta.1, <3.2.0-beta.3 · fixed in 3.0.2, 3.1.2, 3.2.0-beta.3

erlang-jose vulnerable to denial of service via large p2c value

• Denial of service

<1.11.7 · fixed in 1.11.7

Samly access control vulnerability

• Denial of service
• Authentication bypass

<1.4.0 · fixed in 1.4.0

Pleroma Path Traversal vulnerability

• Path traversal

<2.5.3 · fixed in 2.5.3

MTProto proxy remote code execution vulnerability

• Code injection
• CWE-1188

<=0.7.2 · no fixed version yet

Pow Mnesia cache doesn't invalidate all expired keys on startup

• CWE-298
• CWE-672

>=1.0.14, <1.0.34 · fixed in 1.0.34

Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

• Command injection

>=0.8.0, <0.8.2 || >=0.9.0, <0.9.3 · fixed in 0.8.2, 0.9.3

phoenix_html allows Cross-site Scripting in HEEx class attributes

• Cross-site scripting (XSS)

<3.0.4 · fixed in 3.0.4

Duplicate Advisory: Ecto lacks a protection mechanism

>=2.2.0, <2.2.1 · fixed in 2.2.1

Phoenix before 1.6.14 mishandles check_origin wildcarding

• Broken access control
• CWE-346

<1.6.14 · fixed in 1.6.14

ecdsa-elixir fails to check signatures, vulnerable to message forging

• Weak cryptography or TLS

>=1.0.0, <1.0.1 · fixed in 1.0.1

Pivotal RabbitMQ is vulnerable to a denial of service attack

• Memory corruption
• Denial of service

<1.16.7 || >=1.17.0, <1.17.4 || >=3.7.0, <3.7.21 || >=3.8.0, <3.8.1 · fixed in 1.16.7, 1.17.4, 3.7.21, 3.8.1

Cross-site Scripting in RabbitMQ

• Cross-site scripting (XSS)

>=3.7.0, <3.7.20 || >=3.8.0, <3.8.1 · fixed in 3.7.20, 3.8.1

Ejabberd DoS via malformed stanza

• Denial of service

<2.1.9 || >=3.0.0-alpha-1, <3.0.0-alpha-4 · fixed in 2.1.9, 3.0.0-alpha-4

Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream

• Denial of service

<1.3.2 · fixed in 1.3.2

puppetlabs-rabbitmq allows local users to obtain sensitive information

• Information disclosure

>=3.0, <5.0 · fixed in 5.0

alchemist.vim vulnerable to remote code execution

<1.3.2 · fixed in 1.3.2

Hex authenticity of signed packages not validated

• CWE-345

<0.4.0 · fixed in 0.4.0

Inline DTD allows XML bomb attack

• XML external entities (XXE)
• Denial of service

<0.7.0 · fixed in 0.7.0

Denial of service

• Denial of service

<0.4.4 · fixed in 0.4.4

Session fixation

• Authentication bypass

<1.0.16 · fixed in 1.0.16

Header Injection

• CWE-20

<1.0.6 || >=1.1.0, <1.1.9 || >=1.2.0, <1.2.5 || >=1.3.0, <1.3.5 · fixed in 1.0.6, 1.1.9, 1.2.5, 1.3.5

Arbitrary Code Execution in Cookie Serialization

• Insecure deserialization

<1.0.4 || >=1.1.0, <1.1.7 || >=1.2.0, <1.2.3 || >=1.3.0, <1.3.2 · fixed in 1.0.4, 1.1.7, 1.2.3, 1.3.2

Null Byte Injection in Plug.Static

• Other injection

<1.0.4 || >=1.1.0, <1.1.7 || >=1.2.0, <1.2.3 || >=1.3.0, <1.3.2 · fixed in 1.0.4, 1.1.7, 1.2.3, 1.3.2

Cross-site Scripting in xain

• Cross-site scripting (XSS)

<0.6.2 · fixed in 0.6.2

Phoenix Arbitrary URL Redirect

• Open redirect

<1.0.6 || >=1.1.0, <1.1.8 || >=1.2.0, <1.2.3 · fixed in 1.0.6, 1.1.8, 1.2.3

Ecto missing `is_nil` requirement

• CWE-754

>=2.2.0, <2.2.1 · fixed in 2.2.1

Remote Code Execution in paginator

• Code injection

<1.0.0 · fixed in 1.0.0

Permissive parameters and privilege escalation

• CWE-20

<0.5.2 · fixed in 0.5.2