diff --git a/advisories/unreviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json b/advisories/github-reviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json similarity index 60% rename from advisories/unreviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json rename to advisories/github-reviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json index 7623511dc98..743107b8402 100644 --- a/advisories/unreviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json +++ b/advisories/github-reviewed/2024/08/GHSA-4crf-28c7-v4gr/GHSA-4crf-28c7-v4gr.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-4crf-28c7-v4gr", - "modified": "2024-08-21T06:32:18Z", + "modified": "2024-08-21T20:09:39Z", "published": "2024-08-21T06:32:18Z", "aliases": [ "CVE-2024-6508" ], + "summary": "Openshift Console insufficient entropy vulnerability", "details": "An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/openshift/console" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "6.0.6" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +51,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295777" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openshift/console" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-331" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T20:09:39Z", "nvd_published_at": "2024-08-21T06:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json b/advisories/github-reviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json new file mode 100644 index 00000000000..4f4838c0d82 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6247-7862-q2pq", + "modified": "2024-08-21T20:10:17Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-22281" + ], + "summary": "Apache Helix Front (UI) component contained a hard-coded secret", + "details": "The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.\n\nThis issue affects Apache Helix Front (UI): all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.helix:helix" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22281" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/helix" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-668" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T20:10:17Z", + "nvd_published_at": "2024-08-20T23:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json b/advisories/github-reviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json similarity index 57% rename from advisories/unreviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json rename to advisories/github-reviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json index ba71010b368..c1b9fddd62f 100644 --- a/advisories/unreviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json +++ b/advisories/github-reviewed/2024/08/GHSA-8m84-h9hh-3cfh/GHSA-8m84-h9hh-3cfh.json @@ -1,26 +1,56 @@ { "schema_version": "1.4.0", "id": "GHSA-8m84-h9hh-3cfh", - "modified": "2024-08-21T15:30:53Z", + "modified": "2024-08-21T20:10:12Z", "published": "2024-08-21T12:30:25Z", "aliases": [ "CVE-2023-49198" ], + "summary": "Apache SeaTunnel SQL Injection vulnerability", "details": "Mysql security vulnerability in Apache SeaTunnel.\n\nAttackers can read files on the MySQL server by modifying the information in the MySQL URL\n\n allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/&maxAllowedPacket=655360\nThis issue affects Apache SeaTunnel: 1.0.0.\n\nUsers are recommended to upgrade to version [1.0.1], which fixes the issue.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.seatunnel:seatunnel" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.0.1" + } + ] + } + ], + "versions": [ + "1.0.0" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49198" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/seatunnel" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwglb1s08h" @@ -31,8 +61,8 @@ "CWE-552" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T20:10:12Z", "nvd_published_at": "2024-08-21T10:15:04Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json b/advisories/github-reviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json similarity index 51% rename from advisories/unreviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json rename to advisories/github-reviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json index 6595ce41b5e..22557af8eb4 100644 --- a/advisories/unreviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json +++ b/advisories/github-reviewed/2024/08/GHSA-w7cp-g8v7-r54m/GHSA-w7cp-g8v7-r54m.json @@ -1,17 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-w7cp-g8v7-r54m", - "modified": "2024-08-21T18:31:27Z", + "modified": "2024-08-21T20:10:02Z", "published": "2024-08-21T18:31:27Z", "aliases": [ "CVE-2024-41937" ], + "summary": "Apache Airflow Cross-site Scripting Vulnerability", "details": "Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the provider link.\nUsers should upgrade to 2.10.0 or later, which fixes this vulnerability.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +48,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/40933" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/f1852c2ab28b155e196569780013fbb61a4a1f98" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/lwlmgg6hqfmkpvw5py4w53hxyl37jl6d" @@ -31,9 +65,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-21T20:10:02Z", "nvd_published_at": "2024-08-21T16:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json b/advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json deleted file mode 100644 index e518793ef70..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-6247-7862-q2pq", - "modified": "2024-08-21T00:30:29Z", - "published": "2024-08-21T00:30:29Z", - "aliases": [ - "CVE-2024-22281" - ], - "details": "** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.\n\nThis issue affects Apache Helix Front (UI): all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22281" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-668" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-20T23:15:03Z" - } -} \ No newline at end of file