diff --git a/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json b/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json index 9c280675651..1ff3b905eab 100644 --- a/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json +++ b/advisories/github-reviewed/2024/07/GHSA-3wf2-2pq4-4rvc/GHSA-3wf2-2pq4-4rvc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3wf2-2pq4-4rvc", - "modified": "2024-07-22T13:17:47Z", + "modified": "2024-08-07T14:15:50Z", "published": "2024-07-19T19:59:06Z", "aliases": [ "CVE-2024-41122" @@ -90,6 +90,10 @@ { "type": "PACKAGE", "url": "https://github.com/woodpecker-ci/woodpecker" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2024-2998" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/07/GHSA-jmvp-698c-4x3w/GHSA-jmvp-698c-4x3w.json b/advisories/github-reviewed/2024/07/GHSA-jmvp-698c-4x3w/GHSA-jmvp-698c-4x3w.json index 7660c8a2afa..e5a7c845708 100644 --- a/advisories/github-reviewed/2024/07/GHSA-jmvp-698c-4x3w/GHSA-jmvp-698c-4x3w.json +++ b/advisories/github-reviewed/2024/07/GHSA-jmvp-698c-4x3w/GHSA-jmvp-698c-4x3w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jmvp-698c-4x3w", - "modified": "2024-07-22T19:58:29Z", + "modified": "2024-08-07T14:17:41Z", "published": "2024-07-22T17:20:02Z", "aliases": [ "CVE-2024-40634" @@ -120,6 +120,10 @@ { "type": "PACKAGE", "url": "https://github.com/argoproj/argo-cd" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2024-3002" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/07/GHSA-wm25-j4gw-6vr3/GHSA-wm25-j4gw-6vr3.json b/advisories/github-reviewed/2024/07/GHSA-wm25-j4gw-6vr3/GHSA-wm25-j4gw-6vr3.json index 64fae7210ea..2a16efb8490 100644 --- a/advisories/github-reviewed/2024/07/GHSA-wm25-j4gw-6vr3/GHSA-wm25-j4gw-6vr3.json +++ b/advisories/github-reviewed/2024/07/GHSA-wm25-j4gw-6vr3/GHSA-wm25-j4gw-6vr3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wm25-j4gw-6vr3", - "modified": "2024-07-30T15:04:26Z", + "modified": "2024-08-07T14:16:28Z", "published": "2024-07-30T15:04:26Z", "aliases": [ @@ -51,6 +51,10 @@ { "type": "PACKAGE", "url": "https://github.com/prest/prest" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2024-3011" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json b/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json new file mode 100644 index 00000000000..7c855395774 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9v35-4xcr-w9ph", + "modified": "2024-08-07T14:16:58Z", + "published": "2024-08-01T18:32:50Z", + "aliases": [ + "CVE-2024-41260" + ], + "summary": "NetBird uses a static initialization vector (IV)", + "details": "A static initialization vector (IV) in the encrypt function of netbird v0.28.4 allows attackers to obtain sensitive information.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/netbirdio/netbird" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.28.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41260" + }, + { + "type": "WEB", + "url": "https://github.com/netbirdio/netbird/issues/2246" + }, + { + "type": "WEB", + "url": "https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636" + }, + { + "type": "PACKAGE", + "url": "https://github.com/netbirdio/netbird" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-321" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-07T14:16:58Z", + "nvd_published_at": "2024-08-01T16:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json b/advisories/github-reviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json new file mode 100644 index 00000000000..69b4f70afc2 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p3pf-mff8-3h47", + "modified": "2024-08-07T14:17:11Z", + "published": "2024-08-06T21:30:47Z", + "aliases": [ + "CVE-2024-41270" + ], + "summary": "Gorush uses deprecated TLS versions", + "details": "An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/appleboy/gorush" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.18.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41270" + }, + { + "type": "WEB", + "url": "https://github.com/appleboy/gorush/issues/792" + }, + { + "type": "WEB", + "url": "https://github.com/appleboy/gorush/commit/067cb597e485e40b790a267187bf7f00730b1c4b" + }, + { + "type": "WEB", + "url": "https://gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/appleboy/gorush" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-327" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-07T14:17:11Z", + "nvd_published_at": "2024-08-06T21:16:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json b/advisories/unreviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json deleted file mode 100644 index 69f5978866a..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9v35-4xcr-w9ph", - "modified": "2024-08-06T21:30:47Z", - "published": "2024-08-01T18:32:50Z", - "aliases": [ - "CVE-2024-41260" - ], - "details": "A static initialization vector (IV) in the encrypt function of netbird v0.28.4 allows attackers to obtain sensitive information.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41260" - }, - { - "type": "WEB", - "url": "https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-321" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-01T16:15:06Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json b/advisories/unreviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json deleted file mode 100644 index 512e18b8d3c..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-p3pf-mff8-3h47", - "modified": "2024-08-06T21:30:47Z", - "published": "2024-08-06T21:30:47Z", - "aliases": [ - "CVE-2024-41270" - ], - "details": "An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41270" - }, - { - "type": "WEB", - "url": "https://gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-06T21:16:03Z" - } -} \ No newline at end of file