From 21498ff447526631c774bc5f6a6700150888323b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 21:14:26 +0000 Subject: [PATCH] Publish Advisories GHSA-46rr-87h4-f5q6 GHSA-c3wf-rrhq-rfp2 GHSA-qh3m-c6hw-5hmv GHSA-rxph-cq38-gm3g --- .../GHSA-46rr-87h4-f5q6.json | 29 ++++++++++++++--- .../GHSA-c3wf-rrhq-rfp2.json | 29 ++++++++++++++--- .../GHSA-qh3m-c6hw-5hmv.json | 30 +++++++++++++++--- .../GHSA-rxph-cq38-gm3g.json | 31 ++++++++++++++++--- 4 files changed, 101 insertions(+), 18 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json (59%) diff --git a/advisories/unreviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json b/advisories/github-reviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json rename to advisories/github-reviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json index 84c80cfc7e1..d78cc48c24f 100644 --- a/advisories/unreviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json +++ b/advisories/github-reviewed/2022/05/GHSA-46rr-87h4-f5q6/GHSA-46rr-87h4-f5q6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-46rr-87h4-f5q6", - "modified": "2023-10-25T18:31:31Z", + "modified": "2024-01-30T21:13:29Z", "published": "2022-05-24T17:03:47Z", "aliases": [ "CVE-2019-16561" ], + "summary": "SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin ", "details": "Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:websphere-deployer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.6.1" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-295" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:13:29Z", "nvd_published_at": "2019-12-17T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json b/advisories/github-reviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json rename to advisories/github-reviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json index b11161ece43..0ec888e5ec9 100644 --- a/advisories/unreviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json +++ b/advisories/github-reviewed/2022/05/GHSA-c3wf-rrhq-rfp2/GHSA-c3wf-rrhq-rfp2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c3wf-rrhq-rfp2", - "modified": "2023-10-25T18:31:31Z", + "modified": "2024-01-30T21:13:36Z", "published": "2022-05-24T17:03:47Z", "aliases": [ "CVE-2019-16560" ], + "summary": "Cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin", "details": "A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:websphere-deployer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.6.1" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-352" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:13:36Z", "nvd_published_at": "2019-12-17T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json b/advisories/github-reviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json rename to advisories/github-reviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json index 03cc49a8946..49f37d1f81a 100644 --- a/advisories/unreviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json +++ b/advisories/github-reviewed/2022/05/GHSA-qh3m-c6hw-5hmv/GHSA-qh3m-c6hw-5hmv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qh3m-c6hw-5hmv", - "modified": "2023-10-25T18:31:31Z", + "modified": "2024-01-30T21:14:01Z", "published": "2022-05-24T17:03:47Z", "aliases": [ "CVE-2019-16556" ], + "summary": "Jenkins Rundeck Plugin stored credentials in plain text ", "details": "Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:rundeck" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.6.6" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.6.5" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-522" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:14:01Z", "nvd_published_at": "2019-12-17T15:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json b/advisories/github-reviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json rename to advisories/github-reviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json index 44b2c1c98f1..64d1d64e80d 100644 --- a/advisories/unreviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json +++ b/advisories/github-reviewed/2022/05/GHSA-rxph-cq38-gm3g/GHSA-rxph-cq38-gm3g.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-rxph-cq38-gm3g", - "modified": "2023-10-25T18:31:32Z", + "modified": "2024-01-30T21:13:03Z", "published": "2022-05-24T17:03:48Z", "aliases": [ "CVE-2019-16568" ], + "summary": "Jenkins SCTMExecutor Plugin stores credentials in plain text ", "details": "Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "hudson.plugins.sctmexecutor:SCTMExecutor" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16568" }, + { + "type": "WEB", + "url": "https://github.com/jenkins-infra/update-center2/pull/324" + }, { "type": "WEB", "url": "https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521" @@ -35,8 +58,8 @@ "CWE-319" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T21:13:03Z", "nvd_published_at": "2019-12-17T15:15:00Z" } } \ No newline at end of file