diff --git a/advisories/unreviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json b/advisories/github-reviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json rename to advisories/github-reviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json index 318f82531ce..dd1a3cfd3a1 100644 --- a/advisories/unreviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json +++ b/advisories/github-reviewed/2022/05/GHSA-64cw-m57j-65xj/GHSA-64cw-m57j-65xj.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-64cw-m57j-65xj", - "modified": "2022-05-17T19:57:30Z", + "modified": "2024-01-30T23:55:58Z", "published": "2022-05-17T19:57:30Z", "aliases": [ "CVE-2014-4967" ], + "summary": "Ansible Arbitrary Code Execution", "details": "Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing \" src=\" clause, (2) a trailing \" temp=\" clause, or (3) a trailing \" validate=\" clause accompanied by a shell command.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ansible" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.7" + } + ] + } + ] + } ], "references": [ { @@ -29,11 +51,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-74" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:55:58Z", "nvd_published_at": "2020-02-18T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json b/advisories/github-reviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json new file mode 100644 index 00000000000..4ecaf173de8 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wqq5-c89p-3wc3", + "modified": "2024-01-30T23:56:00Z", + "published": "2022-05-17T19:57:30Z", + "aliases": [ + "CVE-2014-4966" + ], + "summary": "Ansible Arbitrary Code Execution", + "details": "Ansible before 1.6.7 does not prevent inventory data with \"{{\" and \"lookup\" substrings, and does not prevent remote data with \"{{\" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ansible" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4966" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527" + }, + { + "type": "WEB", + "url": "http://www.ocert.org/advisories/ocert-2014-004.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:56:00Z", + "nvd_published_at": "2020-02-18T15:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-4jwq-572w-4388/GHSA-4jwq-572w-4388.json b/advisories/github-reviewed/2024/01/GHSA-4jwq-572w-4388/GHSA-4jwq-572w-4388.json new file mode 100644 index 00000000000..91ed7b53d6b --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-4jwq-572w-4388/GHSA-4jwq-572w-4388.json @@ -0,0 +1,307 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jwq-572w-4388", + "modified": "2024-01-30T23:55:38Z", + "published": "2024-01-30T23:55:38Z", + "aliases": [ + "CVE-2021-29511" + ], + "summary": "Memory over-allocation in evm crate", + "details": "### Impact\nPrior to the patch, when executing specific EVM opcodes related to memory operations that use `evm_core::Memory::copy_large`, the crate can over-allocate memory when it is not needed, making it possible for an attacker to perform denial-of-service attack.\n\n### Patches\nThe flaw was corrected in commit `19ade85`. Users should upgrade to `==0.21.1, ==0.23.1, ==0.24.1, ==0.25.1, >=0.26.1`.\n\n### Workarounds\nNone. Please upgrade your `evm` crate version\n\n### References\nFix commit: https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [evm repo](https://github.com/rust-blockchain/evm)\n* Email [Wei](mailto:wei@that.world)\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "evm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.21.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.21.0" + } + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.21.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.21.0" + } + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.22.0" + }, + { + "fixed": "0.22.1" + } + ] + } + ], + "versions": [ + "0.22.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.23.0" + }, + { + "fixed": "0.23.1" + } + ] + } + ], + "versions": [ + "0.23.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.24.0" + }, + { + "fixed": "0.24.1" + } + ] + } + ], + "versions": [ + "0.24.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.25.0" + }, + { + "fixed": "0.25.1" + } + ] + } + ], + "versions": [ + "0.25.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.26.0" + }, + { + "fixed": "0.26.1" + } + ] + } + ], + "versions": [ + "0.26.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.22.0" + }, + { + "fixed": "0.22.1" + } + ] + } + ], + "versions": [ + "0.22.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.23.0" + }, + { + "fixed": "0.23.1" + } + ] + } + ], + "versions": [ + "0.23.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.24.0" + }, + { + "fixed": "0.24.1" + } + ] + } + ], + "versions": [ + "0.24.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.25.0" + }, + { + "fixed": "0.25.1" + } + ] + } + ], + "versions": [ + "0.25.0" + ] + }, + { + "package": { + "ecosystem": "crates.io", + "name": "evm-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.26.0" + }, + { + "fixed": "0.26.1" + } + ] + } + ], + "versions": [ + "0.26.0" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/rust-blockchain/evm/security/advisories/GHSA-4jwq-572w-4388" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29511" + }, + { + "type": "WEB", + "url": "https://github.com/rust-blockchain/evm/commit/19ade858c430ab13eb562764a870ac9f8506f8dd" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770", + "CWE-787" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T23:55:38Z", + "nvd_published_at": "2021-05-12T18:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json b/advisories/unreviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json deleted file mode 100644 index b9a90701572..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-wqq5-c89p-3wc3/GHSA-wqq5-c89p-3wc3.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wqq5-c89p-3wc3", - "modified": "2022-05-17T19:57:30Z", - "published": "2022-05-17T19:57:30Z", - "aliases": [ - "CVE-2014-4966" - ], - "details": "Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4966" - }, - { - "type": "WEB", - "url": "https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527" - }, - { - "type": "WEB", - "url": "http://www.ocert.org/advisories/ocert-2014-004.html" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-02-18T15:15:00Z" - } -} \ No newline at end of file