From 0c6c53a9b1e0140ce10030b543b0f48f9dacd24a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 8 Jan 2024 15:57:25 +0000 Subject: [PATCH] Publish Advisories GHSA-3vvh-8c65-32j4 GHSA-c2f4-cvqm-65w2 GHSA-ghmw-rwh8-6qmr GHSA-v2v2-hph8-q5xp --- .../GHSA-3vvh-8c65-32j4.json | 2 +- .../GHSA-c2f4-cvqm-65w2.json | 92 +++++++++++++++++++ .../GHSA-ghmw-rwh8-6qmr.json | 8 +- .../GHSA-v2v2-hph8-q5xp.json | 8 +- 4 files changed, 105 insertions(+), 5 deletions(-) create mode 100644 advisories/github-reviewed/2024/01/GHSA-c2f4-cvqm-65w2/GHSA-c2f4-cvqm-65w2.json diff --git a/advisories/github-reviewed/2023/12/GHSA-3vvh-8c65-32j4/GHSA-3vvh-8c65-32j4.json b/advisories/github-reviewed/2023/12/GHSA-3vvh-8c65-32j4/GHSA-3vvh-8c65-32j4.json index 9ac9b29c162..6bac95745c0 100644 --- a/advisories/github-reviewed/2023/12/GHSA-3vvh-8c65-32j4/GHSA-3vvh-8c65-32j4.json +++ b/advisories/github-reviewed/2023/12/GHSA-3vvh-8c65-32j4/GHSA-3vvh-8c65-32j4.json @@ -51,7 +51,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/01/GHSA-c2f4-cvqm-65w2/GHSA-c2f4-cvqm-65w2.json b/advisories/github-reviewed/2024/01/GHSA-c2f4-cvqm-65w2/GHSA-c2f4-cvqm-65w2.json new file mode 100644 index 00000000000..991aa4b0f78 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-c2f4-cvqm-65w2/GHSA-c2f4-cvqm-65w2.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c2f4-cvqm-65w2", + "modified": "2024-01-08T15:56:48Z", + "published": "2024-01-08T15:56:48Z", + "aliases": [ + "CVE-2024-21647" + ], + "summary": "Puma HTTP Request/Response Smuggling vulnerability", + "details": "### Impact\nPrior to versions 6.4.2 and 5.6.8, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling.\n\nFixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.\n\n### Patches\n\nThe vulnerability has been fixed in 6.4.2 and 5.6.8.\n\n### Workarounds\n\nNo known workarounds.\n\n### References\n\n* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)\n* Open an issue in [Puma](https://github.com/puma/puma)\n* See our [security policy](https://github.com/puma/puma/security/policy)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "puma" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.0.0" + }, + { + "fixed": "6.4.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "puma" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.6.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21647" + }, + { + "type": "WEB", + "url": "https://github.com/puma/puma/commit/5fc43d73b6ff193325e657a24ed76dec79133e93" + }, + { + "type": "WEB", + "url": "https://github.com/puma/puma/commit/60d5ee3734adc8cee85c3f0561af392448fe19b7" + }, + { + "type": "WEB", + "url": "https://github.com/puma/puma/commit/bbb880ffb6debbfdea535b4b3eb2204d49ae151d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/puma/puma" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-444" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-08T15:56:48Z", + "nvd_published_at": "2024-01-08T14:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-ghmw-rwh8-6qmr/GHSA-ghmw-rwh8-6qmr.json b/advisories/github-reviewed/2024/01/GHSA-ghmw-rwh8-6qmr/GHSA-ghmw-rwh8-6qmr.json index 0404df8bb44..dcdf3e44065 100644 --- a/advisories/github-reviewed/2024/01/GHSA-ghmw-rwh8-6qmr/GHSA-ghmw-rwh8-6qmr.json +++ b/advisories/github-reviewed/2024/01/GHSA-ghmw-rwh8-6qmr/GHSA-ghmw-rwh8-6qmr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ghmw-rwh8-6qmr", - "modified": "2024-01-08T15:29:55Z", + "modified": "2024-01-08T15:55:22Z", "published": "2024-01-08T15:29:55Z", "aliases": [ "CVE-2024-21645" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/pyload/pyload/security/advisories/GHSA-ghmw-rwh8-6qmr" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21645" + }, { "type": "WEB", "url": "https://github.com/pyload/pyload/commit/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d" @@ -56,6 +60,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-08T15:29:55Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-08T14:15:47Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-v2v2-hph8-q5xp/GHSA-v2v2-hph8-q5xp.json b/advisories/github-reviewed/2024/01/GHSA-v2v2-hph8-q5xp/GHSA-v2v2-hph8-q5xp.json index ecf87d22897..4f75aa93f00 100644 --- a/advisories/github-reviewed/2024/01/GHSA-v2v2-hph8-q5xp/GHSA-v2v2-hph8-q5xp.json +++ b/advisories/github-reviewed/2024/01/GHSA-v2v2-hph8-q5xp/GHSA-v2v2-hph8-q5xp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v2v2-hph8-q5xp", - "modified": "2024-01-08T15:22:40Z", + "modified": "2024-01-08T15:55:16Z", "published": "2024-01-08T15:22:40Z", "aliases": [ "CVE-2023-51701" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-v2v2-hph8-q5xp" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51701" + }, { "type": "WEB", "url": "https://github.com/fastify/fastify-reply-from/commit/cbd7c17c09e6476268e34f5e499a6b923e8acc18" @@ -60,6 +64,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-08T15:22:40Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-08T14:15:46Z" } } \ No newline at end of file