Publish Advisories

GHSA-434g-2637-qmqr
GHSA-632q-77qj-c89q
GHSA-f8x4-f32r-w556

advisories/github-reviewed/2024/10/GHSA-434g-2637-qmqr/GHSA-434g-2637-qmqr.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-434g-2637-qmqr",
-  "modified": "2024-10-10T21:00:04Z",
+  "modified": "2024-10-15T17:14:02Z",
   "published": "2024-10-10T03:30:44Z",
   "aliases": [
     "CVE-2024-48949"
   ],
-  "summary": "Elliptic's verify function omits validation",
+  "summary": "Elliptic's verify function omits uniqueness validation",
   "details": "The Elliptic package 6.5.5 for Node.js for EDDSA implementation does not perform the required check if the signature proof(s) is within the bounds of the order n of the base point of the elliptic curve, leading to signature malleability. Namely, the `verify` function in `lib/elliptic/eddsa/index.js` omits `sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()` validation.\n\nThis vulnerability could have a security-relevant impact if an application relies on the uniqueness of a signature.",
   "severity": [
     {

advisories/github-reviewed/2024/10/GHSA-632q-77qj-c89q/GHSA-632q-77qj-c89q.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-632q-77qj-c89q",
-  "modified": "2024-10-07T19:01:59Z",
+  "modified": "2024-10-15T17:13:22Z",
   "published": "2024-10-07T18:31:07Z",
   "aliases": [
     "CVE-2024-28710"
@@ -9,6 +9,10 @@
   "summary": "LimeSurvey Cross Site Scripting vulnerability",
   "details": "Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
@@ -51,6 +55,10 @@
     {
       "type": "WEB",
       "url": "https://www.limesurvey.org"
+    },
+    {
+      "type": "WEB",
+      "url": "http://limesurvey.com"
     }
   ],
   "database_specific": {

advisories/github-reviewed/2024/10/GHSA-f8x4-f32r-w556/GHSA-f8x4-f32r-w556.json

@@ -1,17 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f8x4-f32r-w556",
-  "modified": "2024-10-15T14:08:25Z",
+  "modified": "2024-10-15T17:13:46Z",
   "published": "2024-10-15T14:08:25Z",
+  "withdrawn": "2024-10-15T17:13:46Z",
   "aliases": [
 
   ],
-  "summary": "PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references",
-  "details": "The family of functions to read \"borrowed\" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling.\n\nIn PyO3 0.22.4 these functions have all been deprecated and patched to leak a strong reference as a mitigation. PyO3 0.23 will remove these functions entirely.\n\n",
+  "summary": "Duplicate Advisory: PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references",
+  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-6jgw-rgmm-7cv6. This link is maintained to preserve external references.\n\n## Original Advisory\n\nThe family of functions to read \"borrowed\" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling.\n\nIn PyO3 0.22.4 these functions have all been deprecated and patched to leak a strong reference as a mitigation. PyO3 0.23 will remove these functions entirely.\n\n",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [