diff --git a/advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json b/advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json new file mode 100644 index 00000000000..bdfd4dd6d22 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g23h-7vf9-xc25", + "modified": "2024-11-12T21:21:36Z", + "published": "2024-11-12T21:21:36Z", + "aliases": [ + + ], + "summary": "Mimalloc Can Allocate Memory with Bad Alignment", + "details": "This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons.\nSince then, the mimalloc allocator's logic changed, making it break this promise.\nThis caused this crate to return memory with an incorrect alignment for some allocations, particularly those with large alignments.\nThe flaw was fixed by always using the aligned allocation functions.\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "mimalloc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.39" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/purpleprotocol/mimalloc_rust/issues/87" + }, + { + "type": "PACKAGE", + "url": "https://github.com/purpleprotocol/mimalloc_rust" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2022-0094.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-12T21:21:36Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json b/advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json new file mode 100644 index 00000000000..e4da0eae57a --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vpq5-56jj-vf2m", + "modified": "2024-11-12T21:22:51Z", + "published": "2024-11-11T15:31:00Z", + "aliases": [ + "CVE-2024-43427" + ], + "summary": "Moodle admin presets export tool includes some secrets that should not be exported", + "details": "A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.12" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43427" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304255" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=461195" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79373" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-922" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-11-12T21:22:51Z", + "nvd_published_at": "2024-11-11T13:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json b/advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json deleted file mode 100644 index d15bd3f32b7..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vpq5-56jj-vf2m", - "modified": "2024-11-11T15:31:00Z", - "published": "2024-11-11T15:31:00Z", - "aliases": [ - "CVE-2024-43427" - ], - "details": "A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43427" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304255" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=461195" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-922" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-11T13:15:03Z" - } -} \ No newline at end of file