netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-496g-fr33-whrf
GHSA-4pwp-cx67-5cpx
GHSA-6m72-467w-94rh
GHSA-rpgp-9hmg-j25x
This commit is contained in:
advisory-database[bot]
2024-01-31 23:12:37 +00:00
parent 02a8b9a4f9
commit 0fcc6259f3
4 changed files with 360 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/01/GHSA-496g-fr33-whrf/GHSA-496g-fr33-whrf.json
+93
View File
@@ -0,0 +1,93 @@
{
"schema_version": "1.4.0",
"id": "GHSA-496g-fr33-whrf",
"modified": "2024-01-31T23:11:24Z",
"published": "2024-01-31T23:11:24Z",
"aliases": [
"CVE-2020-25201"
],
"summary": "Denial of service in HashiCorp Consul",
"details": "HashiCorp Consul Enterprise versions 1.7.0 up to 1.7.8 and 1.8.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.8.0"
},
{
"fixed": "1.8.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25201"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/pull/9024"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#185-october-23-2020"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/releases/tag/v1.8.5"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-09"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/consul"
}
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-834"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T23:11:24Z",
"nvd_published_at": "2020-11-04T23:15:11Z"
}
}
advisories/github-reviewed/2024/01/GHSA-4pwp-cx67-5cpx/GHSA-4pwp-cx67-5cpx.json
+71
View File
@@ -0,0 +1,71 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4pwp-cx67-5cpx",
"modified": "2024-01-31T23:11:17Z",
"published": "2024-01-31T23:11:17Z",
"aliases": [
"CVE-2019-19499"
],
"summary": "Grafana Arbitrary File Read",
"details": "Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/grafana/grafana/pkg/tsdb/mysql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19499"
},
{
"type": "WEB",
"url": "https://github.com/grafana/grafana/pull/20192"
},
{
"type": "WEB",
"url": "https://github.com/grafana/grafana/blob/master/CHANGELOG.md#644-2019-11-06"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200918-0003/"
},
{
"type": "WEB",
"url": "https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-22",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T23:11:17Z",
"nvd_published_at": "2020-08-28T15:15:00Z"
}
}
advisories/github-reviewed/2024/01/GHSA-6m72-467w-94rh/GHSA-6m72-467w-94rh.json
+112
View File
@@ -0,0 +1,112 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6m72-467w-94rh",
"modified": "2024-01-31T23:11:32Z",
"published": "2024-01-31T23:11:32Z",
"aliases": [
"CVE-2020-28053"
],
"summary": "Privilege Escalation in HashiCorp Consul",
"details": "HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.6.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.8.0"
},
{
"fixed": "1.8.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28053"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/pull/9240"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/commit/ff5215d882ac51b49c2647aac46b42aa9c890ce3"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-09"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/consul"
}
],
"database_specific": {
"cwe_ids": [
"CWE-732",
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T23:11:32Z",
"nvd_published_at": "2020-11-23T14:15:00Z"
}
}
advisories/github-reviewed/2024/01/GHSA-rpgp-9hmg-j25x/GHSA-rpgp-9hmg-j25x.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rpgp-9hmg-j25x",
"modified": "2024-01-31T23:11:40Z",
"published": "2024-01-31T23:11:40Z",
"aliases": [
"CVE-2020-35177"
],
"summary": "Enumeration of users in HashiCorp Vault",
"details": "HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.5.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.6.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35177"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/vault/pull/10537"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T23:11:40Z",
"nvd_published_at": "2020-12-17T05:15:00Z"
}
}