diff --git a/advisories/github-reviewed/2024/01/GHSA-496g-fr33-whrf/GHSA-496g-fr33-whrf.json b/advisories/github-reviewed/2024/01/GHSA-496g-fr33-whrf/GHSA-496g-fr33-whrf.json new file mode 100644 index 00000000000..7dfed4fcffd --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-496g-fr33-whrf/GHSA-496g-fr33-whrf.json @@ -0,0 +1,93 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-496g-fr33-whrf", + "modified": "2024-01-31T23:11:24Z", + "published": "2024-01-31T23:11:24Z", + "aliases": [ + "CVE-2020-25201" + ], + "summary": "Denial of service in HashiCorp Consul", + "details": "HashiCorp Consul Enterprise versions 1.7.0 up to 1.7.8 and 1.8.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7.0" + }, + { + "fixed": "1.7.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.5" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25201" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/consul/pull/9024" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#185-october-23-2020" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/consul/releases/tag/v1.8.5" + }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202208-09" + }, + { + "type": "WEB", + "url": "https://www.hashicorp.com/blog/category/consul" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400", + "CWE-834" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-31T23:11:24Z", + "nvd_published_at": "2020-11-04T23:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-4pwp-cx67-5cpx/GHSA-4pwp-cx67-5cpx.json b/advisories/github-reviewed/2024/01/GHSA-4pwp-cx67-5cpx/GHSA-4pwp-cx67-5cpx.json new file mode 100644 index 00000000000..59afafb3e15 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-4pwp-cx67-5cpx/GHSA-4pwp-cx67-5cpx.json @@ -0,0 +1,71 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4pwp-cx67-5cpx", + "modified": "2024-01-31T23:11:17Z", + "published": "2024-01-31T23:11:17Z", + "aliases": [ + "CVE-2019-19499" + ], + "summary": "Grafana Arbitrary File Read", + "details": "Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana/pkg/tsdb/mysql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19499" + }, + { + "type": "WEB", + "url": "https://github.com/grafana/grafana/pull/20192" + }, + { + "type": "WEB", + "url": "https://github.com/grafana/grafana/blob/master/CHANGELOG.md#644-2019-11-06" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20200918-0003/" + }, + { + "type": "WEB", + "url": "https://swarm.ptsecurity.com/grafana-6-4-3-arbitrary-file-read/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-22", + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-31T23:11:17Z", + "nvd_published_at": "2020-08-28T15:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-6m72-467w-94rh/GHSA-6m72-467w-94rh.json b/advisories/github-reviewed/2024/01/GHSA-6m72-467w-94rh/GHSA-6m72-467w-94rh.json new file mode 100644 index 00000000000..afdb7960c63 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-6m72-467w-94rh/GHSA-6m72-467w-94rh.json @@ -0,0 +1,112 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6m72-467w-94rh", + "modified": "2024-01-31T23:11:32Z", + "published": "2024-01-31T23:11:32Z", + "aliases": [ + "CVE-2020-28053" + ], + "summary": "Privilege Escalation in HashiCorp Consul", + "details": "HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.2.0" + }, + { + "fixed": "1.6.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7.0" + }, + { + "fixed": "1.7.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/consul" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28053" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/consul/pull/9240" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/consul/commit/ff5215d882ac51b49c2647aac46b42aa9c890ce3" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020" + }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202208-09" + }, + { + "type": "WEB", + "url": "https://www.hashicorp.com/blog/category/consul" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732", + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-31T23:11:32Z", + "nvd_published_at": "2020-11-23T14:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-rpgp-9hmg-j25x/GHSA-rpgp-9hmg-j25x.json b/advisories/github-reviewed/2024/01/GHSA-rpgp-9hmg-j25x/GHSA-rpgp-9hmg-j25x.json new file mode 100644 index 00000000000..bb28b862a4c --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-rpgp-9hmg-j25x/GHSA-rpgp-9hmg-j25x.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpgp-9hmg-j25x", + "modified": "2024-01-31T23:11:40Z", + "published": "2024-01-31T23:11:40Z", + "aliases": [ + "CVE-2020-35177" + ], + "summary": "Enumeration of users in HashiCorp Vault", + "details": "HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.5.0" + }, + { + "fixed": "1.5.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.6.0" + }, + { + "fixed": "1.6.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35177" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/vault/pull/10537" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2020-25-vault-s-ldap-auth-method-allows-user-enumeration/18984" + }, + { + "type": "WEB", + "url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#161" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-31T23:11:40Z", + "nvd_published_at": "2020-12-17T05:15:00Z" + } +} \ No newline at end of file