netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-64cw-m57j-65xj
GHSA-wqq5-c89p-3wc3
GHSA-4jwq-572w-4388
GHSA-wqq5-c89p-3wc3
This commit is contained in:
advisory-database[bot]
2024-01-30 23:57:32 +00:00
parent e5e19db30f
commit 191a628494
4 changed files with 397 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json → advisories/github-reviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json
+29 -7
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64cw-m57j-65xj",
"modified": "2022-05-17T19:57:30Z",
"modified": "2024-01-30T23:55:58Z",
"published": "2022-05-17T19:57:30Z",
"aliases": [
"CVE-2014-4967"
],
"summary": "Ansible Arbitrary Code Execution",
"details": "Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing \" src=\" clause, (2) a trailing \" temp=\" clause, or (3) a trailing \" validate=\" clause accompanied by a shell command.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.7"
}
]
}
]
}
],
"references": [
{
@@ -29,11 +51,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:55:58Z",
"nvd_published_at": "2020-02-18T15:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wqq5-c89p-3wc3",
"modified": "2024-01-30T23:56:00Z",
"published": "2022-05-17T19:57:30Z",
"aliases": [
"CVE-2014-4966"
],
"summary": "Ansible Arbitrary Code Execution",
"details": "Ansible before 1.6.7 does not prevent inventory data with \"{{\" and \"lookup\" substrings, and does not prevent remote data with \"{{\" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4966"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527"
},
{
"type": "WEB",
"url": "http://www.ocert.org/advisories/ocert-2014-004.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:56:00Z",
"nvd_published_at": "2020-02-18T15:15:00Z"
}
}
advisories/github-reviewed/2024/01/GHSA-4jwq-572w-4388/GHSA-4jwq-572w-4388.json
+307
View File
@@ -0,0 +1,307 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jwq-572w-4388",
"modified": "2024-01-30T23:55:38Z",
"published": "2024-01-30T23:55:38Z",
"aliases": [
"CVE-2021-29511"
],
"summary": "Memory over-allocation in evm crate",
"details": "### Impact\nPrior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack.\n\n### Patches\nThe flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`.\n\n### Workarounds\nNone. Please upgrade your `evm` crate version\n\n### References\nFix commit: https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [evm repo](https://github.com/rust-blockchain/evm)\n* Email [Wei](mailto:wei@that.world)\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "evm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.21.0"
}
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.21.0"
}
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.22.0"
},
{
"fixed": "0.22.1"
}
]
}
],
"versions": [
"0.22.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "0.23.1"
}
]
}
],
"versions": [
"0.23.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.24.0"
},
{
"fixed": "0.24.1"
}
]
}
],
"versions": [
"0.24.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.25.0"
},
{
"fixed": "0.25.1"
}
]
}
],
"versions": [
"0.25.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.26.0"
},
{
"fixed": "0.26.1"
}
]
}
],
"versions": [
"0.26.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.22.0"
},
{
"fixed": "0.22.1"
}
]
}
],
"versions": [
"0.22.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "0.23.1"
}
]
}
],
"versions": [
"0.23.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.24.0"
},
{
"fixed": "0.24.1"
}
]
}
],
"versions": [
"0.24.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.25.0"
},
{
"fixed": "0.25.1"
}
]
}
],
"versions": [
"0.25.0"
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "evm-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.26.0"
},
{
"fixed": "0.26.1"
}
]
}
],
"versions": [
"0.26.0"
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/rust-blockchain/evm/security/advisories/GHSA-4jwq-572w-4388"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29511"
},
{
"type": "WEB",
"url": "https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd"
}
],
"database_specific": {
"cwe_ids": [
"CWE-770",
"CWE-787"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T23:55:38Z",
"nvd_published_at": "2021-05-12T18:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wqq5-c89p-3wc3",
"modified": "2022-05-17T19:57:30Z",
"published": "2022-05-17T19:57:30Z",
"aliases": [
"CVE-2014-4966"
],
"details": "Ansible before 1.6.7 does not prevent inventory data with &quot;{{&quot; and &quot;lookup&quot; substrings, and does not prevent remote data with &quot;{{&quot; substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup(&#39;pipe&#39;) calls or (2) crafted Jinja2 data.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4966"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527"
},
{
"type": "WEB",
"url": "http://www.ocert.org/advisories/ocert-2014-004.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-18T15:15:00Z"
}
}