Publish Advisories

GHSA-29gq-h27w-54qf
GHSA-w6rp-vxj2-fjhr
GHSA-29gq-h27w-54qf

advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json

@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-29gq-h27w-54qf",
+  "modified": "2023-10-26T23:11:14Z",
+  "published": "2022-05-13T01:17:42Z",
+  "aliases": [
+    "CVE-2019-1003073"
+  ],
+  "summary": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials in plain text ",
+  "details": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:vsts-cd"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003073"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20200227082017/http://www.securityfocus.com/bid/107790"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-311"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-10-26T23:11:14Z",
+    "nvd_published_at": "2019-04-04T16:29:00Z"
+  }
+}

advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json

@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w6rp-vxj2-fjhr",
+  "modified": "2023-10-26T23:10:19Z",
+  "published": "2023-10-26T23:10:19Z",
+  "aliases": [
+
+  ],
+  "summary": "Cosmos packet-forward-middleware vulnerable to chain-halt",
+  "details": "The Cosmos SDK is used for Inter-Blockchain Communication Protocol (IBC) applications and middleware. The [packet-forward-middleware](https://github.com/cosmos/ibc-apps/tree/main/middleware/packet-forward-middleware) module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destination chain. The `packet-forward-middleware` module is vulnerable to potential chain-halt due to error non-determinism.\n\n### Patches\nPlease patch at your earliest convenience by applying one of the following patch versions, respective to the chain's ibc-go major version:\nv4.1.1\nv5.2.1\nv6.1.1",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "4.1.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "5.2.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "6.1.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/cosmos/ibc-apps/security/advisories/GHSA-w6rp-vxj2-fjhr"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/cosmos/ibc-apps"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-10-26T23:10:19Z",
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json

@@ -1,46 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-29gq-h27w-54qf",
-  "modified": "2022-05-13T01:17:42Z",
-  "published": "2022-05-13T01:17:42Z",
-  "aliases": [
-    "CVE-2019-1003073"
-  ],
-  "details": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003073"
-    },
-    {
-      "type": "WEB",
-      "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/107790"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-311"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2019-04-04T16:29:00Z"
-  }
-}