From 0239a6fcdbe307ba20b8eacdea2d11883bdb9f88 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 22 Nov 2024 22:51:37 +0000 Subject: [PATCH] Publish Advisories GHSA-27wf-5967-98gx GHSA-mr95-vfcf-fx9p GHSA-27wf-5967-98gx --- .../GHSA-27wf-5967-98gx.json | 111 ++++++++++++++++++ .../GHSA-mr95-vfcf-fx9p.json | 31 ++++- .../GHSA-27wf-5967-98gx.json | 46 -------- 3 files changed, 138 insertions(+), 50 deletions(-) create mode 100644 advisories/github-reviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json rename advisories/{unreviewed => github-reviewed}/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json (63%) delete mode 100644 advisories/unreviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json diff --git a/advisories/github-reviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json b/advisories/github-reviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json new file mode 100644 index 00000000000..ea8e983586a --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-27wf-5967-98gx", + "modified": "2024-11-22T22:50:21Z", + "published": "2024-11-22T21:32:15Z", + "aliases": [ + "CVE-2024-10220" + ], + "summary": " Kubernetes kubelet arbitrary command execution", + "details": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.28.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.29.0" + }, + { + "fixed": "1.29.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.30.0" + }, + { + "fixed": "1.30.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10220" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/128885" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/kubernetes" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/11/20/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T22:50:21Z", + "nvd_published_at": "2024-11-22T17:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json b/advisories/github-reviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json similarity index 63% rename from advisories/unreviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json rename to advisories/github-reviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json index 19c5896babc..852a6c2a597 100644 --- a/advisories/unreviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json +++ b/advisories/github-reviewed/2024/11/GHSA-mr95-vfcf-fx9p/GHSA-mr95-vfcf-fx9p.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mr95-vfcf-fx9p", - "modified": "2024-11-22T21:32:14Z", + "modified": "2024-11-22T22:50:08Z", "published": "2024-11-22T21:32:14Z", "aliases": [ "CVE-2024-45719" ], + "summary": "Apache Answer: Predictable Authorization Token Using UUIDv1", "details": "Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.4.0.\n\nThe ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable.\nUsers are recommended to upgrade to version 1.4.1, which fixes the issue.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/apache/incubator-answer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45719" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/incubator-answer" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491" @@ -35,8 +58,8 @@ "CWE-326" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T22:50:08Z", "nvd_published_at": "2024-11-22T15:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json b/advisories/unreviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json deleted file mode 100644 index b91991ecb07..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-27wf-5967-98gx/GHSA-27wf-5967-98gx.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-27wf-5967-98gx", - "modified": "2024-11-22T21:32:15Z", - "published": "2024-11-22T21:32:15Z", - "aliases": [ - "CVE-2024-10220" - ], - "details": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10220" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/128885" - }, - { - "type": "WEB", - "url": "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2024/11/20/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-22T17:15:06Z" - } -} \ No newline at end of file