From 18551c7be18dcbf1c04f7875c2e786e36090ec29 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 23 Feb 2024 21:40:25 +0000 Subject: [PATCH] Publish Advisories GHSA-cpx3-696p-3cw9 GHSA-fh73-gjvg-349c GHSA-cpx3-696p-3cw9 GHSA-fh73-gjvg-349c --- .../GHSA-cpx3-696p-3cw9.json | 111 ++++++++++++++++ .../GHSA-fh73-gjvg-349c.json | 123 ++++++++++++++++++ .../GHSA-cpx3-696p-3cw9.json | 43 ------ .../GHSA-fh73-gjvg-349c.json | 58 --------- 4 files changed, 234 insertions(+), 101 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json diff --git a/advisories/github-reviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json b/advisories/github-reviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json new file mode 100644 index 00000000000..1b99055fba3 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json @@ -0,0 +1,111 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpx3-696p-3cw9", + "modified": "2024-02-23T21:39:51Z", + "published": "2022-05-24T19:13:19Z", + "aliases": [ + "CVE-2021-40797" + ], + "summary": "OpenStack Neutron Denial of Service vulnerability", + "details": "An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "16.4.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "17.0.0" + }, + { + "fixed": "17.2.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "18.0.0" + }, + { + "fixed": "18.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40797" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/neutron/commit/e610a5eb9e71aa2549fb11e2139370d227787da2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/neutron" + }, + { + "type": "WEB", + "url": "https://launchpad.net/bugs/1942179" + }, + { + "type": "WEB", + "url": "https://security.openstack.org/ossa/OSSA-2021-006.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2021/09/09/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-772" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-23T21:39:51Z", + "nvd_published_at": "2021-09-08T20:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json b/advisories/github-reviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json new file mode 100644 index 00000000000..1ca5747826c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json @@ -0,0 +1,123 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fh73-gjvg-349c", + "modified": "2024-02-23T21:38:57Z", + "published": "2022-05-24T19:12:33Z", + "aliases": [ + "CVE-2021-40085" + ], + "summary": "OpenStack Neutron vulnerable to authenticated attackers reconfiguring dnsmasq via crafted extra_dhcp_opts value", + "details": "An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "16.4.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "17.0.0" + }, + { + "fixed": "17.2.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "18.0.0" + }, + { + "fixed": "18.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40085" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/neutron/commit/df891f0593d234e01f27d7c0376d9702e178ecfb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/neutron" + }, + { + "type": "WEB", + "url": "https://launchpad.net/bugs/1939733" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00038.html" + }, + { + "type": "WEB", + "url": "https://security.openstack.org/ossa/OSSA-2021-005.html" + }, + { + "type": "WEB", + "url": "https://www.debian.org/security/2021/dsa-4983" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2021/08/31/2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-23T21:38:57Z", + "nvd_published_at": "2021-08-31T18:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json b/advisories/unreviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json deleted file mode 100644 index 59e992b3936..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-cpx3-696p-3cw9/GHSA-cpx3-696p-3cw9.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-cpx3-696p-3cw9", - "modified": "2022-05-24T19:13:19Z", - "published": "2022-05-24T19:13:19Z", - "aliases": [ - "CVE-2021-40797" - ], - "details": "An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40797" - }, - { - "type": "WEB", - "url": "https://launchpad.net/bugs/1942179" - }, - { - "type": "WEB", - "url": "https://security.openstack.org/ossa/OSSA-2021-006.html" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2021/09/09/2" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-772" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-09-08T20:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json b/advisories/unreviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json deleted file mode 100644 index 99e97b4b06a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-fh73-gjvg-349c/GHSA-fh73-gjvg-349c.json +++ /dev/null @@ -1,58 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fh73-gjvg-349c", - "modified": "2022-05-27T00:00:49Z", - "published": "2022-05-24T19:12:33Z", - "aliases": [ - "CVE-2021-40085" - ], - "details": "An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40085" - }, - { - "type": "WEB", - "url": "https://launchpad.net/bugs/1939733" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html" - }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00038.html" - }, - { - "type": "WEB", - "url": "https://security.openstack.org/ossa/OSSA-2021-005.html" - }, - { - "type": "WEB", - "url": "https://www.debian.org/security/2021/dsa-4983" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2021/08/31/2" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-08-31T18:15:00Z" - } -} \ No newline at end of file