From 04c04209aeead8ed26154f31e0d61d984c1e0b8b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 14 May 2024 21:17:55 +0000 Subject: [PATCH] Publish Advisories GHSA-77w8-qv8m-386h GHSA-gmvp-5rf9-mxcm GHSA-hj89-qmx9-8qmh GHSA-rxrm-xvp4-jqvh GHSA-v8fq-gq9j-3v7h --- .../GHSA-77w8-qv8m-386h.json | 47 +++++++++++++++++-- .../GHSA-gmvp-5rf9-mxcm.json | 39 +++++++++++++-- .../GHSA-hj89-qmx9-8qmh.json | 43 +++++++++++++++-- .../GHSA-rxrm-xvp4-jqvh.json | 35 ++++++++++++-- .../GHSA-v8fq-gq9j-3v7h.json | 43 +++++++++++++++-- 5 files changed, 187 insertions(+), 20 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json (50%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json (57%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json (63%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json (68%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json (54%) diff --git a/advisories/unreviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json b/advisories/github-reviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json rename to advisories/github-reviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json index 81b8118d261..6816a11e9a0 100644 --- a/advisories/unreviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json +++ b/advisories/github-reviewed/2022/05/GHSA-77w8-qv8m-386h/GHSA-77w8-qv8m-386h.json @@ -1,27 +1,66 @@ { "schema_version": "1.4.0", "id": "GHSA-77w8-qv8m-386h", - "modified": "2022-05-17T04:31:12Z", + "modified": "2024-05-14T21:16:52Z", "published": "2022-05-17T04:31:12Z", "aliases": [ "CVE-2014-5253" ], + "summary": "OpenStack Keystone Domain-scoped tokens don't get revoked", "details": "OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5253" }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/317f9d34b4da20c21edd5b851889298b67c843e1" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/3e035ebb726167aef43c4a865c7e7f7d3b0978fb" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/c4447f16da036fe878382ce4e1b05b84bdcc4d4e" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/cccc3f3239c68479de0f6a41bd64badf2a9ec9e7" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/keystone/+bug/1349597" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/keystone" + }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html" @@ -44,8 +83,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:16:52Z", "nvd_published_at": "2014-08-25T14:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json b/advisories/github-reviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json rename to advisories/github-reviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json index 06719b81cfc..c52397f187b 100644 --- a/advisories/unreviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json +++ b/advisories/github-reviewed/2022/05/GHSA-gmvp-5rf9-mxcm/GHSA-gmvp-5rf9-mxcm.json @@ -1,27 +1,58 @@ { "schema_version": "1.4.0", "id": "GHSA-gmvp-5rf9-mxcm", - "modified": "2022-05-17T04:31:12Z", + "modified": "2024-05-14T21:16:54Z", "published": "2022-05-17T04:31:12Z", "aliases": [ "CVE-2014-5251" ], + "summary": "OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events", "details": "The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5251" }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/6cbf835542d62e6e5db4b4aef7141b1731cad9dc" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/7aee6304f653475a4130dc3e5be602e91481f108" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/keystone/+bug/1347961" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/keystone" + }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html" @@ -44,8 +75,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:16:54Z", "nvd_published_at": "2014-08-25T14:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json b/advisories/github-reviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json similarity index 63% rename from advisories/unreviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json rename to advisories/github-reviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json index 7f42c8b0ed3..9c489227989 100644 --- a/advisories/unreviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json +++ b/advisories/github-reviewed/2022/05/GHSA-hj89-qmx9-8qmh/GHSA-hj89-qmx9-8qmh.json @@ -1,23 +1,54 @@ { "schema_version": "1.4.0", "id": "GHSA-hj89-qmx9-8qmh", - "modified": "2022-05-17T01:36:23Z", + "modified": "2024-05-14T21:16:50Z", "published": "2022-05-17T01:36:23Z", "aliases": [ "CVE-2013-2059" ], + "summary": "OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user ", "details": "OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2059" }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/33214f311aa36b17f8f5ff06bee2130bf061df8f" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/678b06a91f772d6be82eb54ed11f27e20f446b57" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/992466d1dbf80a940190703dedf800d6d12dede8" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/keystone/+bug/1166670" @@ -26,6 +57,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/84135" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/keystone" + }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html" @@ -68,8 +103,8 @@ "CWE-287" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:16:50Z", "nvd_published_at": "2013-05-21T18:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json b/advisories/github-reviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json similarity index 68% rename from advisories/unreviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json rename to advisories/github-reviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json index 873f5c10db1..af6e0a2fc09 100644 --- a/advisories/unreviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json +++ b/advisories/github-reviewed/2022/05/GHSA-rxrm-xvp4-jqvh/GHSA-rxrm-xvp4-jqvh.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-rxrm-xvp4-jqvh", - "modified": "2022-05-17T04:44:52Z", + "modified": "2024-05-14T21:17:02Z", "published": "2022-05-17T04:44:52Z", "aliases": [ "CVE-2013-2006" ], + "summary": "OpenStack Keystone Sensitive information disclosure via log files", "details": "OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd" }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/keystone/+bug/1172195" @@ -30,6 +53,10 @@ "type": "WEB", "url": "https://bugs.launchpad.net/ossn/+bug/1168252" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/keystone" + }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html" @@ -60,8 +87,8 @@ "CWE-200" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:17:01Z", "nvd_published_at": "2013-05-21T18:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json b/advisories/github-reviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json rename to advisories/github-reviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json index dede03d8f26..90ac6dd4607 100644 --- a/advisories/unreviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json +++ b/advisories/github-reviewed/2022/05/GHSA-v8fq-gq9j-3v7h/GHSA-v8fq-gq9j-3v7h.json @@ -1,27 +1,62 @@ { "schema_version": "1.4.0", "id": "GHSA-v8fq-gq9j-3v7h", - "modified": "2022-05-17T04:31:13Z", + "modified": "2024-05-14T21:16:58Z", "published": "2022-05-17T04:31:13Z", "aliases": [ "CVE-2014-5252" ], + "summary": "OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events", "details": "The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5252" }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/556fb860311675fc437585651e4602b2908451eb" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/a4c73e4382cb062aa9f30fe1960d5014d3c49cc2" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/keystone/commit/bdb88c662ac2035f9b0d8a229a5db5f60f5f16ae" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/keystone/+bug/1348820" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/keystone" + }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html" @@ -44,8 +79,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:16:58Z", "nvd_published_at": "2014-08-25T14:55:00Z" } } \ No newline at end of file