From 11cf70e75927321b57d525a6ef75d78f08729827 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 27 Feb 2025 17:17:18 +0000 Subject: [PATCH] Publish Advisories GHSA-43g5-2wr2-q7vj GHSA-973h-3x6p-qg37 GHSA-r95j-4jvf-mrrw --- .../GHSA-43g5-2wr2-q7vj.json | 35 ++++++++++++++++--- .../GHSA-973h-3x6p-qg37.json | 35 ++++++++++++++++--- .../GHSA-r95j-4jvf-mrrw.json | 35 ++++++++++++++++--- 3 files changed, 90 insertions(+), 15 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json (54%) rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json (58%) rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json (54%) diff --git a/advisories/unreviewed/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json b/advisories/github-reviewed/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json similarity index 54% rename from advisories/unreviewed/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json rename to advisories/github-reviewed/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json index 22152180f55..78205903e6f 100644 --- a/advisories/unreviewed/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json +++ b/advisories/github-reviewed/2025/02/GHSA-43g5-2wr2-q7vj/GHSA-43g5-2wr2-q7vj.json @@ -1,24 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-43g5-2wr2-q7vj", - "modified": "2025-02-27T15:31:51Z", + "modified": "2025-02-27T17:15:42Z", "published": "2025-02-27T15:31:51Z", "aliases": [ "CVE-2025-1691" ], - "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. \n\n\n\n\nThe vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.", + "summary": "MongoDB Shell may be susceptible to Control Character Injection via autocomplete", + "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. \n\nThe vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "mongosh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.9" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1691" }, + { + "type": "PACKAGE", + "url": "https://github.com/mongodb-js/mongosh" + }, { "type": "WEB", "url": "https://jira.mongodb.org/browse/MONGOSH-2024" @@ -29,8 +54,8 @@ "CWE-74" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-27T17:15:42Z", "nvd_published_at": "2025-02-27T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json b/advisories/github-reviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json similarity index 58% rename from advisories/unreviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json rename to advisories/github-reviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json index 9904dfde4c1..0a5bbb7852f 100644 --- a/advisories/unreviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json +++ b/advisories/github-reviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json @@ -1,24 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-973h-3x6p-qg37", - "modified": "2025-02-27T15:31:51Z", + "modified": "2025-02-27T17:15:53Z", "published": "2025-02-27T15:31:51Z", "aliases": [ "CVE-2025-1692" ], - "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9", + "summary": "MongoDB Shell may be susceptible to control character injection via pasting", + "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "mongosh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.9" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1692" }, + { + "type": "PACKAGE", + "url": "https://github.com/mongodb-js/mongosh" + }, { "type": "WEB", "url": "https://jira.mongodb.org/browse/MONGOSH-2025" @@ -29,8 +54,8 @@ "CWE-150" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-27T17:15:53Z", "nvd_published_at": "2025-02-27T13:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json b/advisories/github-reviewed/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json similarity index 54% rename from advisories/unreviewed/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json rename to advisories/github-reviewed/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json index 5e96bf56abd..083754fc666 100644 --- a/advisories/unreviewed/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json +++ b/advisories/github-reviewed/2025/02/GHSA-r95j-4jvf-mrrw/GHSA-r95j-4jvf-mrrw.json @@ -1,24 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-r95j-4jvf-mrrw", - "modified": "2025-02-27T15:31:51Z", + "modified": "2025-02-27T17:16:09Z", "published": "2025-02-27T15:31:51Z", "aliases": [ "CVE-2025-1693" ], - "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions.\n\n\nThe vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.\n\n\nThis issue affects mongosh versions prior to 2.3.9", + "summary": "MongoDB Shell may be susceptible to control character Injection via shell output", + "details": "The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions.\n\nThe vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.\n\nThis issue affects mongosh versions prior to 2.3.9.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "mongosh" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.9" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1693" }, + { + "type": "PACKAGE", + "url": "https://github.com/mongodb-js/mongosh" + }, { "type": "WEB", "url": "https://jira.mongodb.org/browse/MONGOSH-2026" @@ -29,8 +54,8 @@ "CWE-150" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-27T17:16:09Z", "nvd_published_at": "2025-02-27T13:15:11Z" } } \ No newline at end of file