diff --git a/advisories/github-reviewed/2024/07/GHSA-wm9w-rjj3-j356/GHSA-wm9w-rjj3-j356.json b/advisories/github-reviewed/2024/07/GHSA-wm9w-rjj3-j356/GHSA-wm9w-rjj3-j356.json index 8c25cc9705e..010f21f25c0 100644 --- a/advisories/github-reviewed/2024/07/GHSA-wm9w-rjj3-j356/GHSA-wm9w-rjj3-j356.json +++ b/advisories/github-reviewed/2024/07/GHSA-wm9w-rjj3-j356/GHSA-wm9w-rjj3-j356.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-wm9w-rjj3-j356", - "modified": "2024-07-05T20:39:42Z", + "modified": "2025-06-04T21:21:58Z", "published": "2024-07-03T21:39:44Z", "aliases": [ "CVE-2024-34750" ], "summary": "Apache Tomcat - Denial of Service", - "details": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\n\n", + "details": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.", "severity": [ { "type": "CVSS_V3", @@ -159,6 +159,10 @@ "type": "WEB", "url": "https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l" }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20240816-0004" + }, { "type": "WEB", "url": "https://tomcat.apache.org/security-10.html" diff --git a/advisories/github-reviewed/2025/06/GHSA-8vxj-4cph-c596/GHSA-8vxj-4cph-c596.json b/advisories/github-reviewed/2025/06/GHSA-8vxj-4cph-c596/GHSA-8vxj-4cph-c596.json new file mode 100644 index 00000000000..875fa80a58c --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-8vxj-4cph-c596/GHSA-8vxj-4cph-c596.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8vxj-4cph-c596", + "modified": "2025-06-04T21:22:27Z", + "published": "2025-06-04T21:22:27Z", + "aliases": [ + "CVE-2025-48935" + ], + "summary": "Deno has --allow-read / --allow-write permission bypass in `node:sqlite`", + "details": "## Summary\n\nIt is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement.\n\n## PoC\n\n```js\n// poc.js\nimport { DatabaseSync } from \"node:sqlite\"\n\nconst db = new DatabaseSync(\":memory:\");\ndb.exec(\"ATTACH DATABASE 'test.db' as test;\");\n\ndb.exec(\"CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);\");\n```\n\n```\n$ deno poc.js\n```", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "deno" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "deno_node" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.129.0" + }, + { + "fixed": "0.134.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860" + }, + { + "type": "PACKAGE", + "url": "https://github.com/denoland/deno" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-06-04T21:22:27Z", + "nvd_published_at": null + } +} \ No newline at end of file