diff --git a/advisories/unreviewed/2024/06/GHSA-cg49-hrj4-3rpr/GHSA-cg49-hrj4-3rpr.json b/advisories/github-reviewed/2024/06/GHSA-cg49-hrj4-3rpr/GHSA-cg49-hrj4-3rpr.json similarity index 59% rename from advisories/unreviewed/2024/06/GHSA-cg49-hrj4-3rpr/GHSA-cg49-hrj4-3rpr.json rename to advisories/github-reviewed/2024/06/GHSA-cg49-hrj4-3rpr/GHSA-cg49-hrj4-3rpr.json index 549189ca9bb..373b92d5481 100644 --- a/advisories/unreviewed/2024/06/GHSA-cg49-hrj4-3rpr/GHSA-cg49-hrj4-3rpr.json +++ b/advisories/github-reviewed/2024/06/GHSA-cg49-hrj4-3rpr/GHSA-cg49-hrj4-3rpr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cg49-hrj4-3rpr", - "modified": "2024-06-04T12:31:05Z", + "modified": "2024-06-05T13:26:29Z", "published": "2024-06-04T12:31:05Z", "aliases": [ "CVE-2024-37064" ], + "summary": "ydata unsafe deserialization", "details": "Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ydata-profiling" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7.0" + }, + { + "last_affected": "4.8.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37064" }, + { + "type": "PACKAGE", + "url": "https://github.com/ydataai/ydata-profiling" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/ydata-june2024" @@ -31,8 +54,8 @@ "CWE-502" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-05T13:26:29Z", "nvd_published_at": "2024-06-04T12:15:13Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-fpvj-m2h6-6wc5/GHSA-fpvj-m2h6-6wc5.json b/advisories/github-reviewed/2024/06/GHSA-fpvj-m2h6-6wc5/GHSA-fpvj-m2h6-6wc5.json similarity index 59% rename from advisories/unreviewed/2024/06/GHSA-fpvj-m2h6-6wc5/GHSA-fpvj-m2h6-6wc5.json rename to advisories/github-reviewed/2024/06/GHSA-fpvj-m2h6-6wc5/GHSA-fpvj-m2h6-6wc5.json index 70bfdc6971c..c9feac5e4aa 100644 --- a/advisories/unreviewed/2024/06/GHSA-fpvj-m2h6-6wc5/GHSA-fpvj-m2h6-6wc5.json +++ b/advisories/github-reviewed/2024/06/GHSA-fpvj-m2h6-6wc5/GHSA-fpvj-m2h6-6wc5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fpvj-m2h6-6wc5", - "modified": "2024-06-04T12:31:05Z", + "modified": "2024-06-05T13:25:55Z", "published": "2024-06-04T12:31:05Z", "aliases": [ "CVE-2024-37062" ], + "summary": "ydata unsafe deserialization", "details": "Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ydata-profiling" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7.0" + }, + { + "last_affected": "4.8.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37062" }, + { + "type": "PACKAGE", + "url": "https://github.com/ydataai/ydata-profiling" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/ydata-june2024" @@ -31,8 +54,8 @@ "CWE-502" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-05T13:25:55Z", "nvd_published_at": "2024-06-04T12:15:12Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-pqcv-qw2r-r859/GHSA-pqcv-qw2r-r859.json b/advisories/github-reviewed/2024/06/GHSA-pqcv-qw2r-r859/GHSA-pqcv-qw2r-r859.json similarity index 56% rename from advisories/unreviewed/2024/06/GHSA-pqcv-qw2r-r859/GHSA-pqcv-qw2r-r859.json rename to advisories/github-reviewed/2024/06/GHSA-pqcv-qw2r-r859/GHSA-pqcv-qw2r-r859.json index 5f5c922509e..8139b06128d 100644 --- a/advisories/unreviewed/2024/06/GHSA-pqcv-qw2r-r859/GHSA-pqcv-qw2r-r859.json +++ b/advisories/github-reviewed/2024/06/GHSA-pqcv-qw2r-r859/GHSA-pqcv-qw2r-r859.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-pqcv-qw2r-r859", - "modified": "2024-06-04T12:31:05Z", + "modified": "2024-06-05T13:25:35Z", "published": "2024-06-04T12:31:05Z", "aliases": [ "CVE-2024-37061" ], - "details": "Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.", + "summary": "MLFlow improper input validation", + "details": "Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input.", "severity": [ { "type": "CVSS_V3", @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mlflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.11.0" + }, + { + "last_affected": "2.13.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37061" }, + { + "type": "PACKAGE", + "url": "https://github.com/mlflow/mlflow" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/mlflow-june2024" @@ -28,11 +51,12 @@ ], "database_specific": { "cwe_ids": [ + "CWE-20", "CWE-94" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-05T13:25:35Z", "nvd_published_at": "2024-06-04T12:15:12Z" } } \ No newline at end of file