netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-hg6c-qqcm-r79r
GHSA-jh3w-4vvf-mjgr
GHSA-jh3w-4vvf-mjgr
This commit is contained in:
advisory-database[bot]
2023-07-05 22:46:21 +00:00
parent c686395bc8
commit 06e9e11383
3 changed files with 170 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json → advisories/github-reviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json
+32 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hg6c-qqcm-r79r",
"modified": "2023-07-03T12:30:34Z",
"modified": "2023-07-05T22:45:06Z",
"published": "2023-07-03T12:30:34Z",
"aliases": [
"CVE-2023-35797"
],
"summary": "Apache Airflow Hive Provider Beeline remote code execution with Principal",
"details": "Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.\nThis issue affects Apache Airflow Apache Hive Provider: before 6.1.1.\n\nBefore version 6.1.1 it was possible to bypass the security check to RCE via\nprincipal parameter. For this to be exploited it requires access to modifying the connection details.\n\nIt is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.\n\n",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow-providers-apache-hive"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.1"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,14 @@
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/31983"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/6724eeb6210d5965937eaf9dae3e476eb30f8268"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y"
@@ -31,9 +58,9 @@
"cwe_ids": [
"CWE-20"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-07-05T22:45:06Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json
+138
View File
@@ -0,0 +1,138 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jh3w-4vvf-mjgr",
"modified": "2023-07-05T22:45:55Z",
"published": "2023-07-03T15:30:45Z",
"aliases": [
"CVE-2023-36053"
],
"summary": "Django has regular expression denial of service vulnerability in EmailValidator/URLValidator",
"details": "In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, `EmailValidator` and `URLValidator` are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ecosystem_specific": {
"affected_functions": [
"django.core.validators.URLValidator",
"django.core.validators.EmailValidator"
]
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.20"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ecosystem_specific": {
"affected_functions": [
"django.core.validators.URLValidator",
"django.core.validators.EmailValidator"
]
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.10"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ecosystem_specific": {
"affected_functions": [
"django.core.validators.URLValidator",
"django.core.validators.EmailValidator"
]
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36053"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/4.2/releases/security/"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!forum/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2023/jul/03/security-releases/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-07-05T22:45:55Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jh3w-4vvf-mjgr",
"modified": "2023-07-03T15:30:45Z",
"published": "2023-07-03T15:30:45Z",
"aliases": [
"CVE-2023-36053"
],
"details": "In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36053"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/4.2/releases/security/"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!forum/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2023/jul/03/security-releases/"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}