Publish Advisories

GHSA-27wf-5967-98gx
GHSA-mr95-vfcf-fx9p
GHSA-27wf-5967-98gx

advisories/github-reviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json

@@ -0,0 +1,111 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-27wf-5967-98gx",
+  "modified": "2024-11-22T22:50:21Z",
+  "published": "2024-11-22T21:32:15Z",
+  "aliases": [
+    "CVE-2024-10220"
+  ],
+  "summary": " Kubernetes kubelet arbitrary command execution",
+  "details": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "k8s.io/kubernetes"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.28.12"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "k8s.io/kubernetes"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.29.0"
+            },
+            {
+              "fixed": "1.29.7"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "k8s.io/kubernetes"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.30.0"
+            },
+            {
+              "fixed": "1.30.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10220"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kubernetes/kubernetes/issues/128885"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kubernetes/kubernetes"
+    },
+    {
+      "type": "WEB",
+      "url": "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/11/20/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-22T22:50:21Z",
+    "nvd_published_at": "2024-11-22T17:15:06Z"
+  }
+}

advisories/github-reviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mr95-vfcf-fx9p",
-  "modified": "2024-11-22T21:32:14Z",
+  "modified": "2024-11-22T22:50:08Z",
   "published": "2024-11-22T21:32:14Z",
   "aliases": [
     "CVE-2024-45719"
   ],
+  "summary": "Apache Answer: Predictable Authorization Token Using UUIDv1",
   "details": "Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.",
   "severity": [
     {
@@ -14,13 +15,35 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/apache/incubator-answer"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.4.1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45719"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/incubator-answer"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491"
@@ -35,8 +58,8 @@
       "CWE-326"
     ],
     "severity": "LOW",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-22T22:50:08Z",
     "nvd_published_at": "2024-11-22T15:15:10Z"
   }
 }

advisories/unreviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json

@@ -1,46 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-27wf-5967-98gx",
-  "modified": "2024-11-22T21:32:15Z",
-  "published": "2024-11-22T21:32:15Z",
-  "aliases": [
-    "CVE-2024-10220"
-  ],
-  "details": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10220"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/kubernetes/kubernetes/issues/128885"
-    },
-    {
-      "type": "WEB",
-      "url": "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2024/11/20/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-22"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-11-22T17:15:06Z"
-  }
-}