From 0a20bf443aa6986ee62b9e9404619f5862eb000c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 12 Nov 2024 21:23:21 +0000 Subject: [PATCH] Publish Advisories GHSA-g23h-7vf9-xc25 GHSA-vpq5-56jj-vf2m GHSA-vpq5-56jj-vf2m --- .../GHSA-g23h-7vf9-xc25.json | 61 ++++++++ .../GHSA-vpq5-56jj-vf2m.json | 130 ++++++++++++++++++ .../GHSA-vpq5-56jj-vf2m.json | 42 ------ 3 files changed, 191 insertions(+), 42 deletions(-) create mode 100644 advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json create mode 100644 advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json delete mode 100644 advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json diff --git a/advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json b/advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json new file mode 100644 index 00000000000..bdfd4dd6d22 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-g23h-7vf9-xc25/GHSA-g23h-7vf9-xc25.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g23h-7vf9-xc25", + "modified": "2024-11-12T21:21:36Z", + "published": "2024-11-12T21:21:36Z", + "aliases": [ + + ], + "summary": "Mimalloc Can Allocate Memory with Bad Alignment", + "details": "This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons.\nSince then, the mimalloc allocator's logic changed, making it break this promise.\nThis caused this crate to return memory with an incorrect alignment for some allocations, particularly those with large alignments.\nThe flaw was fixed by always using the aligned allocation functions.\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "mimalloc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.39" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/purpleprotocol/mimalloc_rust/issues/87" + }, + { + "type": "PACKAGE", + "url": "https://github.com/purpleprotocol/mimalloc_rust" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2022-0094.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-12T21:21:36Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json b/advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json new file mode 100644 index 00000000000..e4da0eae57a --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vpq5-56jj-vf2m", + "modified": "2024-11-12T21:22:51Z", + "published": "2024-11-11T15:31:00Z", + "aliases": [ + "CVE-2024-43427" + ], + "summary": "Moodle admin presets export tool includes some secrets that should not be exported", + "details": "A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.4.0" + }, + { + "fixed": "4.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3.0" + }, + { + "fixed": "4.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.2.0" + }, + { + "fixed": "4.2.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.12" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43427" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304255" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=461195" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79373" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-922" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-11-12T21:22:51Z", + "nvd_published_at": "2024-11-11T13:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json b/advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json deleted file mode 100644 index d15bd3f32b7..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-vpq5-56jj-vf2m/GHSA-vpq5-56jj-vf2m.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-vpq5-56jj-vf2m", - "modified": "2024-11-11T15:31:00Z", - "published": "2024-11-11T15:31:00Z", - "aliases": [ - "CVE-2024-43427" - ], - "details": "A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43427" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304255" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=461195" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-922" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-11T13:15:03Z" - } -} \ No newline at end of file