From 1ef38b2b42e85a52587d7517fcd3bc09d1b21d49 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 1 Apr 2025 18:05:36 +0000 Subject: [PATCH] Publish Advisories GHSA-2c59-37c4-qrx5 GHSA-3w85-5p9g-h334 GHSA-wpp8-fjgf-pwc7 GHSA-wpp8-fjgf-pwc7 --- .../GHSA-2c59-37c4-qrx5.json | 45 ++++++- .../GHSA-3w85-5p9g-h334.json | 45 ++++++- .../GHSA-wpp8-fjgf-pwc7.json | 118 ++++++++++++++++++ .../GHSA-wpp8-fjgf-pwc7.json | 31 ----- 4 files changed, 200 insertions(+), 39 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json (51%) rename advisories/{unreviewed => github-reviewed}/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json (58%) create mode 100644 advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json delete mode 100644 advisories/unreviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json diff --git a/advisories/unreviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json b/advisories/github-reviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json similarity index 51% rename from advisories/unreviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json rename to advisories/github-reviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json index 3193c2d4689..8d2418ecb2e 100644 --- a/advisories/unreviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json +++ b/advisories/github-reviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2c59-37c4-qrx5", - "modified": "2025-04-01T09:30:20Z", + "modified": "2025-04-01T18:04:17Z", "published": "2025-04-01T09:30:20Z", "aliases": [ "CVE-2025-30065" ], + "summary": "Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution", "details": "Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code\n\n\nUsers are recommended to upgrade to version 1.15.1, which fixes the issue.", "severity": [ { @@ -13,12 +14,48 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.parquet:parquet-avro" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.15.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30065" }, + { + "type": "WEB", + "url": "https://github.com/apache/parquet-java/issues/3168" + }, + { + "type": "WEB", + "url": "https://github.com/apache/parquet-java/pull/3169" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/parquet-java" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/AVRO-3985" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5" @@ -29,8 +66,8 @@ "CWE-502" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-01T18:04:17Z", "nvd_published_at": "2025-04-01T08:15:15Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json b/advisories/github-reviewed/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json similarity index 58% rename from advisories/unreviewed/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json rename to advisories/github-reviewed/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json index 68cbeb53425..f4a0b4550c0 100644 --- a/advisories/unreviewed/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json +++ b/advisories/github-reviewed/2025/04/GHSA-3w85-5p9g-h334/GHSA-3w85-5p9g-h334.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3w85-5p9g-h334", - "modified": "2025-04-01T09:30:20Z", + "modified": "2025-04-01T18:04:06Z", "published": "2025-04-01T09:30:19Z", "aliases": [ "CVE-2025-27427" ], + "summary": "Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type", "details": "A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permission and automatic queue creation a user could successfully send a message with a routing-type not supported by the address when that message should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address.\n\nThis issue affects Apache ActiveMQ Artemis from 2.0.0 through 2.39.0.\n\nUsers are recommended to upgrade to version 2.40.0 which fixes the issue.", "severity": [ { @@ -13,12 +14,48 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.activemq:artemis-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.40.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27427" }, + { + "type": "WEB", + "url": "https://github.com/apache/activemq-artemis/commit/2216a75a57f098295abb283d556c8b8bda91324d" + }, + { + "type": "WEB", + "url": "https://github.com/apache/activemq-artemis/commit/6ab458015689303db8878941abe1bc973299fc2e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/activemq-artemis" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/ARTEMIS-5346" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/8dzlm2vkqphyrnkrby8r8kzndsm5o6x8" @@ -29,8 +66,8 @@ "CWE-863" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-01T18:04:06Z", "nvd_published_at": "2025-04-01T08:15:13Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json b/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json new file mode 100644 index 00000000000..0214e63e6f4 --- /dev/null +++ b/advisories/github-reviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wpp8-fjgf-pwc7", + "modified": "2025-04-01T18:03:50Z", + "published": "2025-04-01T00:30:33Z", + "aliases": [ + "CVE-2025-31673" + ], + "summary": "Drupal Core Vulnerable to Forceful Browsing", + "details": "Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "10.3.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.4.0" + }, + { + "fixed": "10.4.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.0.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.1.0" + }, + { + "fixed": "11.1.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31673" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2025-002" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-01T18:03:50Z", + "nvd_published_at": "2025-03-31T22:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json b/advisories/unreviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json deleted file mode 100644 index ee101e3be15..00000000000 --- a/advisories/unreviewed/2025/04/GHSA-wpp8-fjgf-pwc7/GHSA-wpp8-fjgf-pwc7.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wpp8-fjgf-pwc7", - "modified": "2025-04-01T00:30:33Z", - "published": "2025-04-01T00:30:33Z", - "aliases": [ - "CVE-2025-31673" - ], - "details": "Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31673" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2025-002" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-31T22:15:19Z" - } -} \ No newline at end of file