From 18ca07a7e08b722fe47e24dc53f7c8a52a91d4cf Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 19 Nov 2024 20:49:58 +0000 Subject: [PATCH] Publish Advisories GHSA-27mf-ghqm-j3j8 GHSA-8495-4g3g-x7pr GHSA-vggm-3478-vm5m GHSA-wppr-j57c-8jpm GHSA-x3x9-349x-2485 --- .../2024/11/GHSA-27mf-ghqm-j3j8/GHSA-27mf-ghqm-j3j8.json | 6 +++++- .../2024/11/GHSA-8495-4g3g-x7pr/GHSA-8495-4g3g-x7pr.json | 6 +++++- .../2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json | 2 +- .../2024/11/GHSA-wppr-j57c-8jpm/GHSA-wppr-j57c-8jpm.json | 3 ++- .../2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json | 6 +++++- 5 files changed, 18 insertions(+), 5 deletions(-) diff --git a/advisories/github-reviewed/2024/11/GHSA-27mf-ghqm-j3j8/GHSA-27mf-ghqm-j3j8.json b/advisories/github-reviewed/2024/11/GHSA-27mf-ghqm-j3j8/GHSA-27mf-ghqm-j3j8.json index 007b4639fa8..feea6977823 100644 --- a/advisories/github-reviewed/2024/11/GHSA-27mf-ghqm-j3j8/GHSA-27mf-ghqm-j3j8.json +++ b/advisories/github-reviewed/2024/11/GHSA-27mf-ghqm-j3j8/GHSA-27mf-ghqm-j3j8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-27mf-ghqm-j3j8", - "modified": "2024-11-18T22:45:48Z", + "modified": "2024-11-19T20:48:51Z", "published": "2024-11-18T21:02:17Z", "aliases": [ "CVE-2024-52303" @@ -9,6 +9,10 @@ "summary": "aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method", "details": "### Summary\n\nA memory leak can occur when a request produces a `MatchInfoError`. This was caused by adding an entry to a cache on each request, due to the building of each `MatchInfoError` producing a unique cache entry.\n\n### Impact\n\nIf the user is making use of any middlewares with `aiohttp.web` then it is advisable to upgrade immediately.\n\nAn attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/bc15db61615079d1b6327ba42c682f758fa96936", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2024/11/GHSA-8495-4g3g-x7pr/GHSA-8495-4g3g-x7pr.json b/advisories/github-reviewed/2024/11/GHSA-8495-4g3g-x7pr/GHSA-8495-4g3g-x7pr.json index 0efe207b3d3..fc9800e5612 100644 --- a/advisories/github-reviewed/2024/11/GHSA-8495-4g3g-x7pr/GHSA-8495-4g3g-x7pr.json +++ b/advisories/github-reviewed/2024/11/GHSA-8495-4g3g-x7pr/GHSA-8495-4g3g-x7pr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8495-4g3g-x7pr", - "modified": "2024-11-18T22:46:42Z", + "modified": "2024-11-19T20:48:59Z", "published": "2024-11-18T21:02:32Z", "aliases": [ "CVE-2024-52304" @@ -9,6 +9,10 @@ "summary": "aiohttp allows request smuggling due to incorrect parsing of chunk extensions", "details": "### Summary\nThe Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.\n\n### Impact\nIf a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json b/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json index f9b8b7ee2cb..2ec3d18ce9f 100644 --- a/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json +++ b/advisories/github-reviewed/2024/11/GHSA-vggm-3478-vm5m/GHSA-vggm-3478-vm5m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vggm-3478-vm5m", - "modified": "2024-11-18T22:46:53Z", + "modified": "2024-11-19T20:49:21Z", "published": "2024-11-18T20:02:26Z", "aliases": [ "CVE-2024-52506" diff --git a/advisories/github-reviewed/2024/11/GHSA-wppr-j57c-8jpm/GHSA-wppr-j57c-8jpm.json b/advisories/github-reviewed/2024/11/GHSA-wppr-j57c-8jpm/GHSA-wppr-j57c-8jpm.json index 3696841eabe..ade2e09b48b 100644 --- a/advisories/github-reviewed/2024/11/GHSA-wppr-j57c-8jpm/GHSA-wppr-j57c-8jpm.json +++ b/advisories/github-reviewed/2024/11/GHSA-wppr-j57c-8jpm/GHSA-wppr-j57c-8jpm.json @@ -55,7 +55,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-285" + "CWE-285", + "CWE-639" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json b/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json index daf99fcf001..19b5aa4e2fb 100644 --- a/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json +++ b/advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x3x9-349x-2485", - "modified": "2024-11-18T23:46:24Z", + "modified": "2024-11-19T20:48:43Z", "published": "2024-11-18T12:30:43Z", "aliases": [ "CVE-2024-48897" @@ -9,6 +9,10 @@ "summary": "moodle: IDOR in edit/delete RSS feed", "details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"