From 08d29e92bb173aeac76c293bf64580d7765dcfb3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 10 Jul 2024 21:29:48 +0000
Subject: [PATCH] Publish Advisories

GHSA-vjpv-x8p9-7p85
GHSA-wxr3-2hgv-qm8f
---
 .../GHSA-vjpv-x8p9-7p85.json                  | 35 ++++++++++++++++---
 .../GHSA-wxr3-2hgv-qm8f.json                  | 35 ++++++++++++++++---
 2 files changed, 62 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json (64%)
 rename advisories/{unreviewed => github-reviewed}/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json (59%)

diff --git a/advisories/unreviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json b/advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json
similarity index 64%
rename from advisories/unreviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json
rename to advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json
index 1bdee0b4d49..0e0a1fac463 100644
--- a/advisories/unreviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json
+++ b/advisories/github-reviewed/2024/07/GHSA-vjpv-x8p9-7p85/GHSA-vjpv-x8p9-7p85.json
@@ -1,20 +1,43 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vjpv-x8p9-7p85",
-  "modified": "2024-07-10T06:33:52Z",
+  "modified": "2024-07-10T21:28:42Z",
   "published": "2024-07-10T06:33:52Z",
   "aliases": [
     "CVE-2024-21523"
   ],
+  "summary": "images vulnerable to Denial of Service",
   "details": "All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash.\n\n**Note:**\nBy providing some specific integer values (like 0) to the size function, it is possible to obtain a Segmentation fault error, leading to the process crash.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "images"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "3.2.4"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +48,10 @@
       "type": "WEB",
       "url": "https://gist.github.com/dellalibera/8b4ea6b4db84cba212e6e6e39a6933d1"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/zhangyuanwei/node-images"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/zhangyuanwei/node-images/blob/691d49f4e620b4eec9f1c47b1735841d9d8b55f6/src/Image.cc"
@@ -39,8 +66,8 @@
       "CWE-400"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-10T21:28:42Z",
     "nvd_published_at": "2024-07-10T05:15:11Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json b/advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json
similarity index 59%
rename from advisories/unreviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json
rename to advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json
index c7cedaaedc5..0dd783c0056 100644
--- a/advisories/unreviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json
+++ b/advisories/github-reviewed/2024/07/GHSA-wxr3-2hgv-qm8f/GHSA-wxr3-2hgv-qm8f.json
@@ -1,20 +1,43 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wxr3-2hgv-qm8f",
-  "modified": "2024-07-10T06:33:52Z",
+  "modified": "2024-07-10T21:29:30Z",
   "published": "2024-07-10T06:33:52Z",
   "aliases": [
     "CVE-2024-21525"
   ],
+  "summary": "node-twain vulnerable to Improper Check or Handling of Exceptional Conditions",
   "details": "All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length >= 34 chars leads to a buffer overflow vulnerability.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "node-twain"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.0.16"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +48,10 @@
       "type": "WEB",
       "url": "https://gist.github.com/dellalibera/55b87634a6c360e5be22a715f0566c99"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Luomusha/node-twain"
+    },
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-JS-NODETWAIN-6421153"
@@ -35,8 +62,8 @@
       "CWE-703"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-10T21:29:30Z",
     "nvd_published_at": "2024-07-10T05:15:11Z"
   }
 }
\ No newline at end of file