diff --git a/advisories/unreviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json b/advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json similarity index 64% rename from advisories/unreviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json rename to advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json index 1bdee0b4d49..0e0a1fac463 100644 --- a/advisories/unreviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json +++ b/advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-vjpv-x8p9-7p85", - "modified": "2024-07-10T06:33:52Z", + "modified": "2024-07-10T21:28:42Z", "published": "2024-07-10T06:33:52Z", "aliases": [ "CVE-2024-21523" ], + "summary": "images vulnerable to Denial of Service", "details": "All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash.\n\n**Note:**\nBy providing some specific integer values (like 0) to the size function, it is possible to obtain a Segmentation fault error, leading to the process crash.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "images" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.2.4" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +48,10 @@ "type": "WEB", "url": "https://gist.github.com/dellalibera/8b4ea6b4db84cba212e6e6e39a6933d1" }, + { + "type": "PACKAGE", + "url": "https://github.com/zhangyuanwei/node-images" + }, { "type": "WEB", "url": "https://github.com/zhangyuanwei/node-images/blob/691d49f4e620b4eec9f1c47b1735841d9d8b55f6/src/Image.cc" @@ -39,8 +66,8 @@ "CWE-400" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-10T21:28:42Z", "nvd_published_at": "2024-07-10T05:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json b/advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json similarity index 59% rename from advisories/unreviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json rename to advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json index c7cedaaedc5..0dd783c0056 100644 --- a/advisories/unreviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json +++ b/advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-wxr3-2hgv-qm8f", - "modified": "2024-07-10T06:33:52Z", + "modified": "2024-07-10T21:29:30Z", "published": "2024-07-10T06:33:52Z", "aliases": [ "CVE-2024-21525" ], + "summary": "node-twain vulnerable to Improper Check or Handling of Exceptional Conditions", "details": "All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length >= 34 chars leads to a buffer overflow vulnerability.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "node-twain" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.0.16" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +48,10 @@ "type": "WEB", "url": "https://gist.github.com/dellalibera/55b87634a6c360e5be22a715f0566c99" }, + { + "type": "PACKAGE", + "url": "https://github.com/Luomusha/node-twain" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-NODETWAIN-6421153" @@ -35,8 +62,8 @@ "CWE-703" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-07-10T21:29:30Z", "nvd_published_at": "2024-07-10T05:15:11Z" } } \ No newline at end of file