netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-qv6q-x9vr-w7j3
GHSA-7g24-qg88-p43q
GHSA-7g24-qg88-p43q
This commit is contained in:
advisory-database[bot]
2023-10-27 19:15:07 +00:00
parent feb2d021a8
commit 0052aed493
3 changed files with 70 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/02/GHSA-qv6q-x9vr-w7j3/GHSA-qv6q-x9vr-w7j3.json
+4 -4
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qv6q-x9vr-w7j3",
"modified": "2022-06-20T22:47:17Z",
"modified": "2023-10-27T19:14:18Z",
"published": "2022-02-16T00:01:32Z",
"aliases": [
"CVE-2022-25180"
],
"summary": "Insufficiently Protected Credentials in Jenkins Pipeline: Groovy Plugin",
"details": "Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.",
"summary": "Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials",
"details": "Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds.\n\nThis allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.\n\nPipeline: Groovy Plugin 2656.vf7a_e7b_75a_457 does not allow builds containing password parameters to be replayed.",
"severity": [
{
"type": "CVSS_V3",
@@ -28,7 +28,7 @@
"introduced": "0"
},
{
"fixed": "2648.2651.v230593e03e9f"
"fixed": "2656.vf7a_e7b_75a_457"
}
]
}
advisories/github-reviewed/2023/10/GHSA-7g24-qg88-p43q/GHSA-7g24-qg88-p43q.json
+66
View File
@@ -0,0 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7g24-qg88-p43q",
"modified": "2023-10-27T19:13:19Z",
"published": "2023-10-25T18:32:21Z",
"aliases": [
"CVE-2023-31582"
],
"summary": "jose4j uses weak cryptographic algorithm",
"details": "jose4j before v0.9.3 allows attackers to set a low PBES2 iteration count of 1000 or less.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.bitbucket.b_c:jose4j"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31582"
},
{
"type": "PACKAGE",
"url": "https://bitbucket.org/b_c/jose4j"
},
{
"type": "WEB",
"url": "https://bitbucket.org/b_c/jose4j/commits/1929fe3"
},
{
"type": "WEB",
"url": "https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then"
},
{
"type": "WEB",
"url": "https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-327"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-10-27T19:13:19Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2023/10/GHSA-7g24-qg88-p43q/GHSA-7g24-qg88-p43q.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7g24-qg88-p43q",
"modified": "2023-10-25T18:32:21Z",
"published": "2023-10-25T18:32:21Z",
"aliases": [
"CVE-2023-31582"
],
"details": "jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31582"
},
{
"type": "WEB",
"url": "https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then"
},
{
"type": "WEB",
"url": "https://github.com/KANIXB/JWTIssues/blob/main/jose4j%20issue.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}