From 1998c18ce7ab2590ee0e2d300e3f27feb1931da5 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 26 Oct 2023 23:11:37 +0000 Subject: [PATCH] Publish Advisories GHSA-29gq-h27w-54qf GHSA-w6rp-vxj2-fjhr GHSA-29gq-h27w-54qf --- .../GHSA-29gq-h27w-54qf.json | 65 +++++++++++++ .../GHSA-w6rp-vxj2-fjhr.json | 92 +++++++++++++++++++ .../GHSA-29gq-h27w-54qf.json | 46 ---------- 3 files changed, 157 insertions(+), 46 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json create mode 100644 advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json diff --git a/advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json b/advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json new file mode 100644 index 00000000000..02786a85536 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29gq-h27w-54qf", + "modified": "2023-10-26T23:11:14Z", + "published": "2022-05-13T01:17:42Z", + "aliases": [ + "CVE-2019-1003073" + ], + "summary": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials in plain text ", + "details": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:vsts-cd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003073" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200227082017/http://www.securityfocus.com/bid/107790" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-311" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-10-26T23:11:14Z", + "nvd_published_at": "2019-04-04T16:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json b/advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json new file mode 100644 index 00000000000..bb0c89b7339 --- /dev/null +++ b/advisories/github-reviewed/2023/10/GHSA-w6rp-vxj2-fjhr/GHSA-w6rp-vxj2-fjhr.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6rp-vxj2-fjhr", + "modified": "2023-10-26T23:10:19Z", + "published": "2023-10-26T23:10:19Z", + "aliases": [ + + ], + "summary": "Cosmos packet-forward-middleware vulnerable to chain-halt", + "details": "The Cosmos SDK is used for Inter-Blockchain Communication Protocol (IBC) applications and middleware. The [packet-forward-middleware](https://github.com/cosmos/ibc-apps/tree/main/middleware/packet-forward-middleware) module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destination chain. The `packet-forward-middleware` module is vulnerable to potential chain-halt due to error non-determinism.\n\n### Patches\nPlease patch at your earliest convenience by applying one of the following patch versions, respective to the chain's ibc-go major version:\nv4.1.1\nv5.2.1\nv6.1.1", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.1.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.2.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cosmos/ibc-apps/security/advisories/GHSA-w6rp-vxj2-fjhr" + }, + { + "type": "PACKAGE", + "url": "https://github.com/cosmos/ibc-apps" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-10-26T23:10:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json b/advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json deleted file mode 100644 index 0bba9d565d0..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-29gq-h27w-54qf/GHSA-29gq-h27w-54qf.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-29gq-h27w-54qf", - "modified": "2022-05-13T01:17:42Z", - "published": "2022-05-13T01:17:42Z", - "aliases": [ - "CVE-2019-1003073" - ], - "details": "Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003073" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-962" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/107790" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-311" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-04-04T16:29:00Z" - } -} \ No newline at end of file