273 lines
17 KiB
JSON
273 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-92002",
|
|
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "CIRCL",
|
|
"dateReserved": "2026-09-15T11:24:19.778Z",
|
|
"datePublished": "2026-09-15T11:24:21.354Z",
|
|
"dateUpdated": "2026-09-15T12:09:48.540Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"affected": [
|
|
{
|
|
"modules": [
|
|
"app/Controller/AppController.php"
|
|
],
|
|
"product": "MISP",
|
|
"programFiles": [
|
|
"app/Controller/AppController.php"
|
|
],
|
|
"repo": "https://github.com/MISP/MISP",
|
|
"vendor": "MISP",
|
|
"versions": [
|
|
{
|
|
"lessThan": "2.5.46",
|
|
"status": "affected",
|
|
"version": "0",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "remediation developer",
|
|
"value": "iglocska"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"type": "remediation developer",
|
|
"value": "Claude Opus 5 (1M context)"
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p></p><p>Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.</p>\n<p>However, <code>User->setupRedis()</code> returns false when Redis cannot be reached. The vulnerable <code>_shouldLog()</code> logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.</p><p>Version affected: ≤2.5.45<br></p><p></p>"
|
|
}
|
|
],
|
|
"value": "Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs while still recording failed authentication activity.\n\n\nHowever, User->setupRedis() returns false when Redis cannot be reached. The vulnerable _shouldLog() logic only returned true when a Redis instance existed and no throttle key was present. Therefore, when Redis was unavailable, the function did not allow the log write at all, effectively silencing authentication-failure logging for the duration of the outage.\n\nVersion affected: ≤2.5.45"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV4_0": {
|
|
"Automatable": "NOT_DEFINED",
|
|
"Recovery": "NOT_DEFINED",
|
|
"Safety": "NOT_DEFINED",
|
|
"attackComplexity": "LOW",
|
|
"attackRequirements": "NONE",
|
|
"attackVector": "NETWORK",
|
|
"baseScore": 5.1,
|
|
"baseSeverity": "MEDIUM",
|
|
"privilegesRequired": "LOW",
|
|
"providerUrgency": "NOT_DEFINED",
|
|
"subAvailabilityImpact": "NONE",
|
|
"subConfidentialityImpact": "NONE",
|
|
"subIntegrityImpact": "NONE",
|
|
"userInteraction": "PASSIVE",
|
|
"valueDensity": "NOT_DEFINED",
|
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
|
|
"version": "4.0",
|
|
"vulnAvailabilityImpact": "NONE",
|
|
"vulnConfidentialityImpact": "NONE",
|
|
"vulnIntegrityImpact": "LOW",
|
|
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
|
},
|
|
"format": "CVSS",
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "GENERAL"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-778",
|
|
"description": "CWE-778 Insufficient Logging",
|
|
"lang": "en",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
|
|
"shortName": "CIRCL",
|
|
"dateUpdated": "2026-09-15T11:24:21.354Z"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "Security patch",
|
|
"tags": [
|
|
"patch"
|
|
],
|
|
"url": "https://github.com/MISP/MISP/commit/a39b25d2f"
|
|
}
|
|
],
|
|
"solutions": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p>The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.</p>"
|
|
}
|
|
],
|
|
"value": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts."
|
|
}
|
|
],
|
|
"title": "MISP: Authentication failure logging suppressed during Redis unavailability",
|
|
"x_gcve": [
|
|
{
|
|
"extensions": {
|
|
"bcp-05-x-01": {
|
|
"ai_annotations": [
|
|
{
|
|
"ai_level": "generated",
|
|
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
|
|
"gna_source": 1,
|
|
"models": [
|
|
{
|
|
"gna_source": 1,
|
|
"identifier": "qwen3.8:27b",
|
|
"name": "qwen3.8:27b",
|
|
"source": "ollama"
|
|
}
|
|
],
|
|
"review_status": "review",
|
|
"scope": "record",
|
|
"tags": [
|
|
"ai-computer-assisted:llm-generated",
|
|
"ai-computer-assisted:classification"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"bcp-05-x-02": {
|
|
"x_patch2vuln": {
|
|
"assumptions": [
|
|
"The affected version range is inferred from the tag_version_boundary metadata (v2.5.46 with 189 commits after the fix), suggesting the fix landed before the v2.5.46 release; exact affected version boundaries are not explicitly stated in the patch.",
|
|
"The CVSS availability impact (VA:L) reflects the loss of the security-logging function rather than a denial of service against the MISP application itself.",
|
|
"The patch does not indicate whether the Redis throttle was the sole mechanism for auth-failure logging or whether a fallback file-based logger existed; the analysis assumes the Redis-gated path was the primary logging path for auth failures.",
|
|
"The commit date (2 Sep 2026) is taken at face value from the patch metadata."
|
|
],
|
|
"commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
|
|
"confidence": "medium",
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "remediation developer",
|
|
"value": "iglocska"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"type": "remediation developer",
|
|
"value": "Claude Opus 5 (1M context)"
|
|
}
|
|
],
|
|
"cvssRationale": "The vulnerability is reachable over the network (AV:N) because MISP is a web application. Attack complexity is High (AC:H) because exploitation requires the Redis instance to be specifically unavailable at the time authentication failures occur; it is not a simple request. No attack target is required (AT:N). No privileges are needed (PR:N) because the suppressed logs pertain to unauthenticated authentication-failure events. No user interaction is required (UI:N). There is no direct confidentiality or integrity impact on the MISP data store (VC:N, VI:N). The availability impact is Low (VA:L) because the security-logging/audit function is unavailable during the Redis outage, impairing detection and forensic capabilities, but the core MISP service remains operational. No cross-scope impacts (SC:N, SI:N, SA:N).",
|
|
"draft": false,
|
|
"fixSummary": "The _shouldLog() method now explicitly checks whether the Redis connection is available before attempting to use it. If setupRedis() returns false, the method immediately returns true, causing every authentication-failure event to be logged. This converts the previous fail-closed behavior (silence on dependency failure) into a fail-open behavior for security logging (log everything when the throttle state is unavailable), ensuring that a Redis outage cannot be used to suppress the audit trail of failed authentication attempts.",
|
|
"generatedAt": "2026-09-15T09:34:28.852379Z",
|
|
"generator": "patch2vuln.py",
|
|
"model": "qwen3.8:27b",
|
|
"modelComparison": {
|
|
"rankings": [
|
|
{
|
|
"agreementScore": 9,
|
|
"assumptionCount": 4,
|
|
"confidence": "medium",
|
|
"model": "qwen3.8:27b",
|
|
"score": 6
|
|
}
|
|
],
|
|
"selectedModel": "qwen3.8:27b",
|
|
"selectionMethod": "deterministic-consensus-v1",
|
|
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
|
|
},
|
|
"patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
|
|
"patchSummary": "In app/Controller/AppController.php, the _shouldLog() method was restructured: a new early-return guard \"if (!$redis) { return true; }\" was inserted immediately after the setupRedis() call, so that an unavailable Redis connection causes all auth-failure events to be logged. The subsequent throttle check was simplified to \"if (!$redis->exists(...))\" since the null case is already handled. Additionally, a block of commented-out Redis throttle code in the afterFilter() method (lines referencing misp:auth_fail_throttling) was removed as dead code.",
|
|
"patchTruncated": false,
|
|
"patches": [
|
|
{
|
|
"commit": "a39b25d2f141dde954a2f00feed5c6eb9e3989b5",
|
|
"patchSha256": "ab1b5a5a68cf32cfb514f541d5db607932836ebf557634a44adfa822631afe9c",
|
|
"source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
|
|
"sourceUrl": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
|
|
"subject": "fix: [logging] Log auth failures when the throttle cannot"
|
|
}
|
|
],
|
|
"source": "https://github.com/MISP/MISP/commit/a39b25d2f.patch",
|
|
"subject": "fix: [logging] Log auth failures when the throttle cannot",
|
|
"tagVersionBoundary": {
|
|
"commits_after_fix": 189,
|
|
"repository": "https://github.com/MISP/MISP",
|
|
"tag": "v2.5.46",
|
|
"version": "2.5.46",
|
|
"version_type": "semver"
|
|
},
|
|
"weaknessRationale": [
|
|
{
|
|
"cweId": "CWE-778",
|
|
"rationale": "The system fails to record security-relevant events (authentication failures) when a supporting dependency (Redis) is unavailable. The logging path silently drops all audit entries under a specific operational condition, which is a textbook case of insufficient logging of security events."
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"recordType": "advisory",
|
|
"vulnId": "GCVE-1-2026-20172"
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-09-15T12:00:12.607042Z",
|
|
"id": "CVE-2026-92002",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-09-15T12:09:48.540Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |