netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-77w8-qv8m-386h
GHSA-gmvp-5rf9-mxcm
GHSA-hj89-qmx9-8qmh
GHSA-rxrm-xvp4-jqvh
GHSA-v8fq-gq9j-3v7h
This commit is contained in:
advisory-database[bot]
2024-05-14 21:17:55 +00:00
parent 653e52a354
commit 04c04209ae
5 changed files with 187 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json → advisories/github-reviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json
+43 -4
View File
@@ -1,27 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-77w8-qv8m-386h",
"modified": "2022-05-17T04:31:12Z",
"modified": "2024-05-14T21:16:52Z",
"published": "2022-05-17T04:31:12Z",
"aliases": [
"CVE-2014-5253"
],
"summary": "OpenStack Keystone Domain-scoped tokens don't get revoked",
"details": "OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5253"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/317f9d34b4da20c21edd5b851889298b67c843e1"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/3e035ebb726167aef43c4a865c7e7f7d3b0978fb"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/c4447f16da036fe878382ce4e1b05b84bdcc4d4e"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/cccc3f3239c68479de0f6a41bd64badf2a9ec9e7"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1349597"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"
@@ -44,8 +83,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:16:52Z",
"nvd_published_at": "2014-08-25T14:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json → advisories/github-reviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json
+35 -4
View File
@@ -1,27 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gmvp-5rf9-mxcm",
"modified": "2022-05-17T04:31:12Z",
"modified": "2024-05-14T21:16:54Z",
"published": "2022-05-17T04:31:12Z",
"aliases": [
"CVE-2014-5251"
],
"summary": "OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events",
"details": "The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5251"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/6cbf835542d62e6e5db4b4aef7141b1731cad9dc"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/7aee6304f653475a4130dc3e5be602e91481f108"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1347961"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"
@@ -44,8 +75,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:16:54Z",
"nvd_published_at": "2014-08-25T14:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json → advisories/github-reviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json
+39 -4
View File
@@ -1,23 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hj89-qmx9-8qmh",
"modified": "2022-05-17T01:36:23Z",
"modified": "2024-05-14T21:16:50Z",
"published": "2022-05-17T01:36:23Z",
"aliases": [
"CVE-2013-2059"
],
"summary": "OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user ",
"details": "OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2059"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/33214f311aa36b17f8f5ff06bee2130bf061df8f"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/678b06a91f772d6be82eb54ed11f27e20f446b57"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/992466d1dbf80a940190703dedf800d6d12dede8"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1166670"
@@ -26,6 +57,10 @@
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/84135"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
@@ -68,8 +103,8 @@
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:16:50Z",
"nvd_published_at": "2013-05-21T18:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json → advisories/github-reviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json
+31 -4
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rxrm-xvp4-jqvh",
"modified": "2022-05-17T04:44:52Z",
"modified": "2024-05-14T21:17:02Z",
"published": "2022-05-17T04:44:52Z",
"aliases": [
"CVE-2013-2006"
],
"summary": "OpenStack Keystone Sensitive information disclosure via log files",
"details": "OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,10 @@
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1172195"
@@ -30,6 +53,10 @@
"type": "WEB",
"url": "https://bugs.launchpad.net/ossn/+bug/1168252"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
@@ -60,8 +87,8 @@
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:17:01Z",
"nvd_published_at": "2013-05-21T18:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json → advisories/github-reviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json
+39 -4
View File
@@ -1,27 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8fq-gq9j-3v7h",
"modified": "2022-05-17T04:31:13Z",
"modified": "2024-05-14T21:16:58Z",
"published": "2022-05-17T04:31:13Z",
"aliases": [
"CVE-2014-5252"
],
"summary": "OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events",
"details": "The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5252"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/556fb860311675fc437585651e4602b2908451eb"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/a4c73e4382cb062aa9f30fe1960d5014d3c49cc2"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/bdb88c662ac2035f9b0d8a229a5db5f60f5f16ae"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1348820"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"
@@ -44,8 +79,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:16:58Z",
"nvd_published_at": "2014-08-25T14:55:00Z"
}
}