kritik
CVE-2024-29027
Server crashes on invalid Cloud Function or Cloud Job name
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
GHSA9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Bitnami9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: GHSA, Bitnami.
Açıklama
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | parse | 6.5.5 |
| npm::GitHub Security Advisory npm | parse-server | 6.5.5, 7.0.0-alpha.29 |
Referanslar
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b
- https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e
- https://github.com/parse-community/parse-server/releases/tag/6.5.5
- https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29
- https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29
- https://nvd.nist.gov/vuln/detail/CVE-2024-29027