From 18916b6e56f366adc483e890141f5c0603708587 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 31 Dec 2024 03:31:57 +0000 Subject: [PATCH] Publish Advisories GHSA-9786-79mw-2pj9 GHSA-c45v-xc5j-qr2x GHSA-cxpg-8frp-cv2x GHSA-hcj7-gr87-5x37 --- .../GHSA-9786-79mw-2pj9.json | 40 +++++++++++++++++++ .../GHSA-c45v-xc5j-qr2x.json | 40 +++++++++++++++++++ .../GHSA-cxpg-8frp-cv2x.json | 40 +++++++++++++++++++ .../GHSA-hcj7-gr87-5x37.json | 40 +++++++++++++++++++ 4 files changed, 160 insertions(+) create mode 100644 advisories/unreviewed/2024/12/GHSA-9786-79mw-2pj9/GHSA-9786-79mw-2pj9.json create mode 100644 advisories/unreviewed/2024/12/GHSA-c45v-xc5j-qr2x/GHSA-c45v-xc5j-qr2x.json create mode 100644 advisories/unreviewed/2024/12/GHSA-cxpg-8frp-cv2x/GHSA-cxpg-8frp-cv2x.json create mode 100644 advisories/unreviewed/2024/12/GHSA-hcj7-gr87-5x37/GHSA-hcj7-gr87-5x37.json diff --git a/advisories/unreviewed/2024/12/GHSA-9786-79mw-2pj9/GHSA-9786-79mw-2pj9.json b/advisories/unreviewed/2024/12/GHSA-9786-79mw-2pj9/GHSA-9786-79mw-2pj9.json new file mode 100644 index 00000000000..d0b8ae3e1e0 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-9786-79mw-2pj9/GHSA-9786-79mw-2pj9.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9786-79mw-2pj9", + "modified": "2024-12-31T03:30:33Z", + "published": "2024-12-31T03:30:33Z", + "aliases": [ + "CVE-2024-45497" + ], + "details": "A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-only, which allows the attacker to overwrite it. By modifying the config.json file, the attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This flaw impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45497" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-45497" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308673" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-31T03:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-c45v-xc5j-qr2x/GHSA-c45v-xc5j-qr2x.json b/advisories/unreviewed/2024/12/GHSA-c45v-xc5j-qr2x/GHSA-c45v-xc5j-qr2x.json new file mode 100644 index 00000000000..55f85b7c0b3 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-c45v-xc5j-qr2x/GHSA-c45v-xc5j-qr2x.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c45v-xc5j-qr2x", + "modified": "2024-12-31T03:30:33Z", + "published": "2024-12-31T03:30:33Z", + "aliases": [ + "CVE-2024-12839" + ], + "details": "The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12839" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8335-e4a3f-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8334-8b836-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-294" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-31T02:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-cxpg-8frp-cv2x/GHSA-cxpg-8frp-cv2x.json b/advisories/unreviewed/2024/12/GHSA-cxpg-8frp-cv2x/GHSA-cxpg-8frp-cv2x.json new file mode 100644 index 00000000000..9d7be2f952c --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-cxpg-8frp-cv2x/GHSA-cxpg-8frp-cv2x.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cxpg-8frp-cv2x", + "modified": "2024-12-31T03:30:33Z", + "published": "2024-12-31T03:30:33Z", + "aliases": [ + "CVE-2024-13040" + ], + "details": "The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13040" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8337-7899f-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8336-aa03b-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-31T02:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-hcj7-gr87-5x37/GHSA-hcj7-gr87-5x37.json b/advisories/unreviewed/2024/12/GHSA-hcj7-gr87-5x37/GHSA-hcj7-gr87-5x37.json new file mode 100644 index 00000000000..3e9c7b27c74 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-hcj7-gr87-5x37/GHSA-hcj7-gr87-5x37.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hcj7-gr87-5x37", + "modified": "2024-12-31T03:30:33Z", + "published": "2024-12-31T03:30:33Z", + "aliases": [ + "CVE-2024-12838" + ], + "details": "The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12838" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8333-32cf8-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8332-2100f-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-302" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-31T02:15:05Z" + } +} \ No newline at end of file