Publish Advisories

GHSA-3vvh-8c65-32j4
GHSA-c2f4-cvqm-65w2
GHSA-ghmw-rwh8-6qmr
GHSA-v2v2-hph8-q5xp

advisories/github-reviewed/2023/12/GHSA-3vvh-8c65-32j4/GHSA-3vvh-8c65-32j4.json

@@ -51,7 +51,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-89"
     ],
     "severity": "HIGH",
     "github_reviewed": true,

advisories/github-reviewed/2024/01/GHSA-c2f4-cvqm-65w2/GHSA-c2f4-cvqm-65w2.json

@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c2f4-cvqm-65w2",
+  "modified": "2024-01-08T15:56:48Z",
+  "published": "2024-01-08T15:56:48Z",
+  "aliases": [
+    "CVE-2024-21647"
+  ],
+  "summary": "Puma HTTP Request/Response Smuggling vulnerability",
+  "details": "### Impact\nPrior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling.\n\nFixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.\n\n### Patches\n\nThe vulnerability has been fixed in 6.4.2 and 5.6.8.\n\n### Workarounds\n\nNo known workarounds.\n\n### References\n\n* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)\n* Open an issue in [Puma](https://github.com/puma/puma)\n* See our [security policy](https://github.com/puma/puma/security/policy)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "puma"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.0.0"
+            },
+            {
+              "fixed": "6.4.2"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "puma"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.6.8"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21647"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/puma/puma"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-444"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-08T15:56:48Z",
+    "nvd_published_at": "2024-01-08T14:15:47Z"
+  }
+}

advisories/github-reviewed/2024/01/GHSA-ghmw-rwh8-6qmr/GHSA-ghmw-rwh8-6qmr.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ghmw-rwh8-6qmr",
-  "modified": "2024-01-08T15:29:55Z",
+  "modified": "2024-01-08T15:55:22Z",
   "published": "2024-01-08T15:29:55Z",
   "aliases": [
     "CVE-2024-21645"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/pyload/pyload/security/advisories/GHSA-ghmw-rwh8-6qmr"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21645"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/pyload/pyload/commit/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d"
@@ -56,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-01-08T15:29:55Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-01-08T14:15:47Z"
   }
 }

advisories/github-reviewed/2024/01/GHSA-v2v2-hph8-q5xp/GHSA-v2v2-hph8-q5xp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v2v2-hph8-q5xp",
-  "modified": "2024-01-08T15:22:40Z",
+  "modified": "2024-01-08T15:55:16Z",
   "published": "2024-01-08T15:22:40Z",
   "aliases": [
     "CVE-2023-51701"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51701"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/fastify/fastify-reply-from/commit/cbd7c17c09e6476268e34f5e499a6b923e8acc18"
@@ -60,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-01-08T15:22:40Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-01-08T14:15:46Z"
   }
 }