netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-q7rv-6hp3-vh96
GHSA-7c44-m589-36w7
This commit is contained in:
advisory-database[bot]
2023-04-10 16:33:07 +00:00
parent cb4f357fb7
commit 212ac7bbb1
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/03/GHSA-q7rv-6hp3-vh96/GHSA-q7rv-6hp3-vh96.json
+6 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7rv-6hp3-vh96",
"modified": "2022-06-14T20:02:29Z",
"modified": "2023-04-10T16:32:20Z",
"published": "2022-03-25T19:26:33Z",
"aliases": [
"CVE-2022-24775"
],
"summary": "Improper Input Validation in guzzlehttp/psr7",
"details": "### Impact\nIn proper header parsing. An attacker could sneak in a new line character and pass untrusted values. \n\n### Patches\nThe issue is patched in 1.8.4 and 2.1.1.\n\n### Workarounds\nThere are no known workarounds.\n",
"details": "### Impact\n\nIn proper header parsing. An attacker could sneak in a new line or carriage return characters and pass untrusted values in both the header names and values.\n\n### Patches\n\nThe issue is patched in 1.8.4 and 2.1.1.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4\n",
"severity": [
{
"type": "CVSS_V3",
@@ -78,6 +78,10 @@
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2022-006"
},
{
"type": "WEB",
"url": "https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4"
}
],
"database_specific": {
advisories/github-reviewed/2023/04/GHSA-7c44-m589-36w7/GHSA-7c44-m589-36w7.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7c44-m589-36w7",
"modified": "2023-04-04T17:11:17Z",
"modified": "2023-04-10T16:31:08Z",
"published": "2023-04-02T21:30:17Z",
"aliases": [
"CVE-2023-28677"
],
"summary": "Jenkins Convert To Pipeline Plugin vulnerable to command injection",
"details": "Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations.\n\nThis allows attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a conversion by Convert To Pipeline Plugin. If an administrator converts the Freestyle project to a Pipeline, the script will be pre-approved.",
"details": "Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations.\n\nThis allows attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a conversion by Convert To Pipeline Plugin. If an administrator converts the Freestyle project to a Pipeline, the script will be pre-approved.",
"severity": [
{
"type": "CVSS_V3",