From 1d72408c6f85d38d8dfbc18374f2b79645d892ab Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 1 Oct 2024 18:34:49 +0000
Subject: [PATCH] Publish GHSA-355v-2rjx-fpx7

---
 .../GHSA-355v-2rjx-fpx7.json                  | 37 ++++++++++++++++---
 1 file changed, 32 insertions(+), 5 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json (66%)

diff --git a/advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json b/advisories/github-reviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json
similarity index 66%
rename from advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json
rename to advisories/github-reviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json
index 81182d4fd79..cea7b872bb5 100644
--- a/advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json
+++ b/advisories/github-reviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-355v-2rjx-fpx7",
-  "modified": "2024-09-27T12:31:40Z",
+  "modified": "2024-10-01T18:32:40Z",
   "published": "2024-09-27T12:31:40Z",
   "aliases": [
     "CVE-2024-9277"
   ],
+  "summary": "Inefficient Regular Expression Complexity in langflow",
   "details": "A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \\src\\backend\\base\\langflow\\interface\\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
   "severity": [
     {
@@ -14,17 +15,43 @@
     },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "langflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.0.18"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9277"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/langflow-ai/langflow"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/langflow-ai/langflow/blob/main/src/backend/base/langflow/interface/utils.py#L65"
+    },
     {
       "type": "WEB",
       "url": "https://rumbling-slice-eb0.notion.site/Remote-Redos-in-https-github-com-langflow-ai-langflow-067159ced0d5494e91b06071384969c4?pvs=4"
@@ -47,8 +74,8 @@
       "CWE-1333"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-10-01T18:32:40Z",
     "nvd_published_at": "2024-09-27T11:15:14Z"
   }
 }
\ No newline at end of file