https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 07 Aug 2026 01:41:18 +0000 https://vulnerability.circl.lu/sighting/48dcb33f-d25a-4e99-a5fe-e6c7b8c363cc/export {"uuid": "48dcb33f-d25a-4e99-a5fe-e6c7b8c363cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FP43-VJ7G-PG92", "type": "seen", "source": "https://gist.github.com/alon710/98c2aa788fd9c777f6b5611c16810427", "content": "# GHSA-FP43-VJ7G-PG92: GHSA-FP43-VJ7G-PG92: Multi-Vector Security Vulnerabilities in OmniFaces JSF Utility Library\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-FP43-VJ7G-PG92\n\n## Summary\nA multi-vector vulnerability advisory in the OmniFaces JavaServer Faces (JSF) utility library covers flaws leading to unauthenticated arbitrary file access, memory exhaustion (DoS), cross-site scripting (XSS), and WebSocket push channel hijacking.\n\n## TL;DR\nOmniFaces versions prior to 2.7.33 contained flaws allowing arbitrary resource access, memory exhaustion, XSS via o:hashParam, and WebSocket hijacking, all mitigated in 2.7.33.\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-79, CWE-285, CWE-400, CWE-409\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept\n\n## Affected Systems\n\n- OmniFaces\n- **OmniFaces**: < 2.7.33 (Fixed in: `2.7.33`)\n\n## Mitigation\n\n- Upgrade the OmniFaces dependency to version 2.7.33 or later.\n- Deploy WAF rules to inspect and block anomalous Base64 payloads targeting the combined resource handler.\n- Ensure load balancers propagate the JSESSIONID cookie during WebSocket handshakes.\n\n**Remediation Steps:**\n1. Open the build configuration file (e.g., pom.xml) and locate the org.omnifaces:omnifaces dependency block.\n2. Update the version attribute to 2.7.33.\n3. Build and redeploy the application to the environment.\n4. Monitor application logs for IllegalArgumentException related to unserialized data lengths.\n\n## References\n\n- [GitHub Security Advisory GHSA-FP43-VJ7G-PG92](https://github.com/advisories/GHSA-FP43-VJ7G-PG92)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FP43-VJ7G-PG92) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T09:31:15.115642Z"} {"uuid": "48dcb33f-d25a-4e99-a5fe-e6c7b8c363cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FP43-VJ7G-PG92", "type": "seen", "source": "https://gist.github.com/alon710/98c2aa788fd9c777f6b5611c16810427", "content": "# GHSA-FP43-VJ7G-PG92: GHSA-FP43-VJ7G-PG92: Multi-Vector Security Vulnerabilities in OmniFaces JSF Utility Library\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-FP43-VJ7G-PG92\n\n## Summary\nA multi-vector vulnerability advisory in the OmniFaces JavaServer Faces (JSF) utility library covers flaws leading to unauthenticated arbitrary file access, memory exhaustion (DoS), cross-site scripting (XSS), and WebSocket push channel hijacking.\n\n## TL;DR\nOmniFaces versions prior to 2.7.33 contained flaws allowing arbitrary resource access, memory exhaustion, XSS via o:hashParam, and WebSocket hijacking, all mitigated in 2.7.33.\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-79, CWE-285, CWE-400, CWE-409\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept\n\n## Affected Systems\n\n- OmniFaces\n- **OmniFaces**: < 2.7.33 (Fixed in: `2.7.33`)\n\n## Mitigation\n\n- Upgrade the OmniFaces dependency to version 2.7.33 or later.\n- Deploy WAF rules to inspect and block anomalous Base64 payloads targeting the combined resource handler.\n- Ensure load balancers propagate the JSESSIONID cookie during WebSocket handshakes.\n\n**Remediation Steps:**\n1. Open the build configuration file (e.g., pom.xml) and locate the org.omnifaces:omnifaces dependency block.\n2. Update the version attribute to 2.7.33.\n3. Build and redeploy the application to the environment.\n4. Monitor application logs for IllegalArgumentException related to unserialized data lengths.\n\n## References\n\n- [GitHub Security Advisory GHSA-FP43-VJ7G-PG92](https://github.com/advisories/GHSA-FP43-VJ7G-PG92)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FP43-VJ7G-PG92) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T09:31:15.115642Z"} https://vulnerability.circl.lu/sighting/48dcb33f-d25a-4e99-a5fe-e6c7b8c363cc/export Sat, 25 Jul 2026 09:31:15 +0000