netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-hxwh-jpp2-84pm
GHSA-rv9v-r4vm-gj8x
GHSA-rv9v-r4vm-gj8x
This commit is contained in:
advisory-database[bot]
2024-08-19 18:26:44 +00:00
parent d9b5f769ae
commit 1bebe30508
3 changed files with 108 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/08/GHSA-hxwh-jpp2-84pm/GHSA-hxwh-jpp2-84pm.json → advisories/github-reviewed/2024/08/GHSA-hxwh-jpp2-84pm/GHSA-hxwh-jpp2-84pm.json
+31 -4
View File
@@ -1,26 +1,53 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hxwh-jpp2-84pm",
"modified": "2024-08-18T21:31:07Z",
"modified": "2024-08-19T18:25:39Z",
"published": "2024-08-18T21:31:07Z",
"aliases": [
"CVE-2024-6221"
],
"summary": "Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default",
"details": "A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "flask-cors"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.0.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6221"
},
{
"type": "PACKAGE",
"url": "https://github.com/corydolphin/flask-cors"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d"
@@ -31,8 +58,8 @@
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-19T18:25:39Z",
"nvd_published_at": "2024-08-18T19:15:04Z"
}
}
advisories/github-reviewed/2024/08/GHSA-rv9v-r4vm-gj8x/GHSA-rv9v-r4vm-gj8x.json
+77
View File
@@ -0,0 +1,77 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rv9v-r4vm-gj8x",
"modified": "2024-08-19T18:25:09Z",
"published": "2024-08-19T03:30:48Z",
"aliases": [
"CVE-2024-44073"
],
"summary": "Miniscript allows stack consumption",
"details": "The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "miniscript"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.2.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44073"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/commit/5b0f5e3417f027a22b066debf825dbe6644b575b"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/commit/8f54b5e3fb7129ed9fbed53f1cb9e6e62ea4c151"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-19T18:25:09Z",
"nvd_published_at": "2024-08-19T03:15:03Z"
}
}
advisories/unreviewed/2024/08/GHSA-rv9v-r4vm-gj8x/GHSA-rv9v-r4vm-gj8x.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rv9v-r4vm-gj8x",
"modified": "2024-08-19T03:30:48Z",
"published": "2024-08-19T03:30:48Z",
"aliases": [
"CVE-2024-44073"
],
"details": "The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44073"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/704"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/pull/712"
},
{
"type": "WEB",
"url": "https://github.com/rust-bitcoin/rust-miniscript/compare/11.2.0...12.2.0"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-19T03:15:03Z"
}
}