diff --git a/advisories/unreviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json b/advisories/github-reviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json similarity index 57% rename from advisories/unreviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json rename to advisories/github-reviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json index d2ff829db2f..46dedfa7734 100644 --- a/advisories/unreviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json +++ b/advisories/github-reviewed/2023/07/GHSA-hg6c-qqcm-r79r/GHSA-hg6c-qqcm-r79r.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-hg6c-qqcm-r79r", - "modified": "2023-07-03T12:30:34Z", + "modified": "2023-07-05T22:45:06Z", "published": "2023-07-03T12:30:34Z", "aliases": [ "CVE-2023-35797" ], + "summary": "Apache Airflow Hive Provider Beeline remote code execution with Principal", "details": "Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.\nThis issue affects Apache Airflow Apache Hive Provider: before 6.1.1.\n\nBefore version 6.1.1 it was possible to bypass the security check to RCE via\nprincipal parameter. For this to be exploited it requires access to modifying the connection details.\n\nIt is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.\n\n", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow-providers-apache-hive" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.1.1" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/31983" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/6724eeb6210d5965937eaf9dae3e476eb30f8268" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y" @@ -31,9 +58,9 @@ "cwe_ids": [ "CWE-20" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-07-05T22:45:06Z", "nvd_published_at": null } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json b/advisories/github-reviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json new file mode 100644 index 00000000000..75379b7db47 --- /dev/null +++ b/advisories/github-reviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json @@ -0,0 +1,138 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jh3w-4vvf-mjgr", + "modified": "2023-07-05T22:45:55Z", + "published": "2023-07-03T15:30:45Z", + "aliases": [ + "CVE-2023-36053" + ], + "summary": "Django has regular expression denial of service vulnerability in EmailValidator/URLValidator", + "details": "In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, `EmailValidator` and `URLValidator` are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "Django" + }, + "ecosystem_specific": { + "affected_functions": [ + "django.core.validators.URLValidator", + "django.core.validators.EmailValidator" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.0" + }, + { + "fixed": "3.2.20" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "Django" + }, + "ecosystem_specific": { + "affected_functions": [ + "django.core.validators.URLValidator", + "django.core.validators.EmailValidator" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.1.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "Django" + }, + "ecosystem_specific": { + "affected_functions": [ + "django.core.validators.URLValidator", + "django.core.validators.EmailValidator" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36053" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/454f2fb93437f98917283336201b4048293f7582" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/ad0410ec4f458aa39803e5f6b9a3736527062dcd" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/b7c5feb35a31799de6e582ad6a5a91a9de74e0f9" + }, + { + "type": "WEB", + "url": "https://github.com/django/django/commit/beb3f3d55940d9aa7198bf9d424ab74e873aec3d" + }, + { + "type": "WEB", + "url": "https://docs.djangoproject.com/en/4.2/releases/security/" + }, + { + "type": "PACKAGE", + "url": "https://github.com/django/django" + }, + { + "type": "WEB", + "url": "https://groups.google.com/forum/#!forum/django-announce" + }, + { + "type": "WEB", + "url": "https://www.djangoproject.com/weblog/2023/jul/03/security-releases/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-07-05T22:45:55Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json b/advisories/unreviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json deleted file mode 100644 index 25614fd2ac0..00000000000 --- a/advisories/unreviewed/2023/07/GHSA-jh3w-4vvf-mjgr/GHSA-jh3w-4vvf-mjgr.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jh3w-4vvf-mjgr", - "modified": "2023-07-03T15:30:45Z", - "published": "2023-07-03T15:30:45Z", - "aliases": [ - "CVE-2023-36053" - ], - "details": "In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36053" - }, - { - "type": "WEB", - "url": "https://docs.djangoproject.com/en/4.2/releases/security/" - }, - { - "type": "WEB", - "url": "https://groups.google.com/forum/#!forum/django-announce" - }, - { - "type": "WEB", - "url": "https://www.djangoproject.com/weblog/2023/jul/03/security-releases/" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file