diff --git a/advisories/github-reviewed/2025/05/GHSA-532x-j9r7-8f73/GHSA-532x-j9r7-8f73.json b/advisories/github-reviewed/2025/05/GHSA-532x-j9r7-8f73/GHSA-532x-j9r7-8f73.json new file mode 100644 index 00000000000..62df0a85bcc --- /dev/null +++ b/advisories/github-reviewed/2025/05/GHSA-532x-j9r7-8f73/GHSA-532x-j9r7-8f73.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-532x-j9r7-8f73", + "modified": "2025-05-28T16:04:14Z", + "published": "2025-05-28T09:31:27Z", + "aliases": [ + "CVE-2025-27526" + ], + "summary": "Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass", + "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncode and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/11747", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.inlong:manager-pojo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "2.2.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27526" + }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/pull/11747" + }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/commit/48c2f5cad4a92be2c3561174d70cdbc91a2d2626" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/inlong" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/4t4sqscm7xdqn883dyjy40qk6ncf26xf" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/05/28/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T16:04:13Z", + "nvd_published_at": "2025-05-28T08:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-98v7-xxxv-hcrh/GHSA-98v7-xxxv-hcrh.json b/advisories/github-reviewed/2025/05/GHSA-98v7-xxxv-hcrh/GHSA-98v7-xxxv-hcrh.json similarity index 56% rename from advisories/unreviewed/2025/05/GHSA-98v7-xxxv-hcrh/GHSA-98v7-xxxv-hcrh.json rename to advisories/github-reviewed/2025/05/GHSA-98v7-xxxv-hcrh/GHSA-98v7-xxxv-hcrh.json index 4f9ae96990e..df558213428 100644 --- a/advisories/unreviewed/2025/05/GHSA-98v7-xxxv-hcrh/GHSA-98v7-xxxv-hcrh.json +++ b/advisories/github-reviewed/2025/05/GHSA-98v7-xxxv-hcrh/GHSA-98v7-xxxv-hcrh.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-98v7-xxxv-hcrh", - "modified": "2025-05-28T09:31:27Z", + "modified": "2025-05-28T16:04:26Z", "published": "2025-05-28T09:31:27Z", "aliases": [ "CVE-2025-27528" ], + "summary": "Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read", "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0. \n\nThis\nvulnerability allows attackers to bypass the security mechanisms of InLong\nJDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/11747", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.inlong:manager-pojo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.13.0" + }, + { + "fixed": "2.2.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,6 +44,10 @@ "type": "WEB", "url": "https://github.com/apache/inlong/pull/11747" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/inlong" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj" @@ -31,9 +61,9 @@ "cwe_ids": [ "CWE-502" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-05-28T16:04:26Z", "nvd_published_at": "2025-05-28T08:15:21Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/05/GHSA-532x-j9r7-8f73/GHSA-532x-j9r7-8f73.json b/advisories/unreviewed/2025/05/GHSA-532x-j9r7-8f73/GHSA-532x-j9r7-8f73.json deleted file mode 100644 index 15d03e85dca..00000000000 --- a/advisories/unreviewed/2025/05/GHSA-532x-j9r7-8f73/GHSA-532x-j9r7-8f73.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-532x-j9r7-8f73", - "modified": "2025-05-28T09:31:27Z", - "published": "2025-05-28T09:31:27Z", - "aliases": [ - "CVE-2025-27526" - ], - "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/11747", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27526" - }, - { - "type": "WEB", - "url": "https://github.com/apache/inlong/pull/11747" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/4t4sqscm7xdqn883dyjy40qk6ncf26xf" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/05/28/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-05-28T08:15:21Z" - } -} \ No newline at end of file