Publish Advisories

GHSA-vjpv-x8p9-7p85
GHSA-wxr3-2hgv-qm8f

advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json

@@ -1,20 +1,43 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vjpv-x8p9-7p85",
-  "modified": "2024-07-10T06:33:52Z",
+  "modified": "2024-07-10T21:28:42Z",
   "published": "2024-07-10T06:33:52Z",
   "aliases": [
     "CVE-2024-21523"
   ],
+  "summary": "images vulnerable to Denial of Service",
   "details": "All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash.\n\n**Note:**\nBy providing some specific integer values (like 0) to the size function, it is possible to obtain a Segmentation fault error, leading to the process crash.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "images"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "3.2.4"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +48,10 @@
       "type": "WEB",
       "url": "https://gist.github.com/dellalibera/8b4ea6b4db84cba212e6e6e39a6933d1"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/zhangyuanwei/node-images"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/zhangyuanwei/node-images/blob/691d49f4e620b4eec9f1c47b1735841d9d8b55f6/src/Image.cc"
@@ -39,8 +66,8 @@
       "CWE-400"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-10T21:28:42Z",
     "nvd_published_at": "2024-07-10T05:15:11Z"
   }
 }

advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json

@@ -1,20 +1,43 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wxr3-2hgv-qm8f",
-  "modified": "2024-07-10T06:33:52Z",
+  "modified": "2024-07-10T21:29:30Z",
   "published": "2024-07-10T06:33:52Z",
   "aliases": [
     "CVE-2024-21525"
   ],
+  "summary": "node-twain vulnerable to Improper Check or Handling of Exceptional Conditions",
   "details": "All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length >= 34 chars leads to a buffer overflow vulnerability.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "node-twain"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.0.16"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +48,10 @@
       "type": "WEB",
       "url": "https://gist.github.com/dellalibera/55b87634a6c360e5be22a715f0566c99"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Luomusha/node-twain"
+    },
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-JS-NODETWAIN-6421153"
@@ -35,8 +62,8 @@
       "CWE-703"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-10T21:29:30Z",
     "nvd_published_at": "2024-07-10T05:15:11Z"
   }
 }