From 1b7d959885ee4675076b9dfaf2b636705eaab999 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 8 Nov 2023 14:54:14 +0000 Subject: [PATCH] Publish Advisories GHSA-5r5h-q934-cccp GHSA-xvq6-h898-wcj8 GHSA-xvq6-h898-wcj8 --- .../GHSA-5r5h-q934-cccp.json | 58 ++++++++- .../GHSA-xvq6-h898-wcj8.json | 121 ++++++++++++++++++ .../GHSA-xvq6-h898-wcj8.json | 38 ------ 3 files changed, 175 insertions(+), 42 deletions(-) rename advisories/{unreviewed => github-reviewed}/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json (51%) create mode 100644 advisories/github-reviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json delete mode 100644 advisories/unreviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json diff --git a/advisories/unreviewed/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json b/advisories/github-reviewed/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json similarity index 51% rename from advisories/unreviewed/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json rename to advisories/github-reviewed/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json index 98b1f03e281..6d4b527dac0 100644 --- a/advisories/unreviewed/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json +++ b/advisories/github-reviewed/2023/11/GHSA-5r5h-q934-cccp/GHSA-5r5h-q934-cccp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5r5h-q934-cccp", - "modified": "2023-11-06T18:30:19Z", + "modified": "2023-11-08T14:52:23Z", "published": "2023-11-06T18:30:19Z", "aliases": [ "CVE-2023-41378" ], + "summary": "Calico Typha denial of service vulnerability", "details": "In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.\n", "severity": [ { @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/projectcalico/calico" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.26.0" + }, + { + "fixed": "3.26.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/projectcalico/calico" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "3.25.1" + } + ] + } + ] + } ], "references": [ { @@ -29,6 +67,18 @@ "type": "WEB", "url": "https://github.com/projectcalico/calico/pull/7993" }, + { + "type": "WEB", + "url": "https://github.com/projectcalico/calico/commit/2ebc1f92ecc39332cf1d55ba676d9101af24982f" + }, + { + "type": "WEB", + "url": "https://github.com/projectcalico/calico/commit/ad8bd001e650ec7742ac30e58247e7eef5956125" + }, + { + "type": "PACKAGE", + "url": "https://github.com/projectcalico/calico" + }, { "type": "WEB", "url": "https://www.tigera.io/security-bulletins-tta-2023-001/" @@ -39,8 +89,8 @@ "CWE-400" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-08T14:52:23Z", "nvd_published_at": "2023-11-06T16:15:42Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json b/advisories/github-reviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json new file mode 100644 index 00000000000..88feac26f4b --- /dev/null +++ b/advisories/github-reviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json @@ -0,0 +1,121 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xvq6-h898-wcj8", + "modified": "2023-11-08T14:53:27Z", + "published": "2023-11-06T18:30:19Z", + "aliases": [ + "CVE-2023-5967" + ], + "summary": "Mattermost denial of service vulnerability", + "details": "Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.0.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.1.0" + }, + { + "fixed": "8.1.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.0.1" + } + ] + } + ], + "versions": [ + "9.0.0" + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5967" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-11-08T14:53:27Z", + "nvd_published_at": "2023-11-06T16:15:42Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json b/advisories/unreviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json deleted file mode 100644 index fd4225710ca..00000000000 --- a/advisories/unreviewed/2023/11/GHSA-xvq6-h898-wcj8/GHSA-xvq6-h898-wcj8.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xvq6-h898-wcj8", - "modified": "2023-11-06T18:30:19Z", - "published": "2023-11-06T18:30:19Z", - "aliases": [ - "CVE-2023-5967" - ], - "details": "Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5967" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-754" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-11-06T16:15:42Z" - } -} \ No newline at end of file