diff --git a/advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json b/advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json new file mode 100644 index 00000000000..02786a85536 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29gq-h27w-54qf", + "modified": "2023-10-26T23:11:14Z", + "published": "2022-05-13T01:17:42Z", + "aliases": [ + "CVE-2019-1003073" + ], + "summary": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials in plain text ", + "details": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:vsts-cd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003073" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200227082017/http://www.securityfocus.com/bid/107790" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-311" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-26T23:11:14Z", + "nvd_published_at": "2019-04-04T16:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json b/advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json new file mode 100644 index 00000000000..bb0c89b7339 --- /dev/null +++ b/advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6rp-vxj2-fjhr", + "modified": "2023-10-26T23:10:19Z", + "published": "2023-10-26T23:10:19Z", + "aliases": [ + + ], + "summary": "Cosmos packet-forward-middleware vulnerable to chain-halt", + "details": "The Cosmos SDK is used for Inter-Blockchain Communication Protocol (IBC) applications and middleware. The [packet-forward-middleware](https://github.com/cosmos/ibc-apps/tree/main/middleware/packet-forward-middleware) module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destination chain. The `packet-forward-middleware` module is vulnerable to potential chain-halt due to error non-determinism.\n\n### Patches\nPlease patch at your earliest convenience by applying one of the following patch versions, respective to the chain's ibc-go major version:\nv4.1.1\nv5.2.1\nv6.1.1", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.2.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/ibc-apps/security/advisories/GHSA-w6rp-vxj2-fjhr" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/ibc-apps" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-10-26T23:10:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json b/advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json deleted file mode 100644 index 0bba9d565d0..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-29gq-h27w-54qf", - "modified": "2022-05-13T01:17:42Z", - "published": "2022-05-13T01:17:42Z", - "aliases": [ - "CVE-2019-1003073" - ], - "details": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003073" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/107790" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-311" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-04-04T16:29:00Z" - } -} \ No newline at end of file