From 21fcf5e33dedc74fb6d5c0b4631f1073f09c4efb Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 15 Mar 2024 14:20:51 +0000
Subject: [PATCH] Publish GHSA-h574-6646-vfxx

---
 .../GHSA-h574-6646-vfxx.json                  | 41 ++++++++++++++++---
 1 file changed, 36 insertions(+), 5 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json (53%)

diff --git a/advisories/unreviewed/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json b/advisories/github-reviewed/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json
similarity index 53%
rename from advisories/unreviewed/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json
rename to advisories/github-reviewed/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json
index dd7ce5e2c1e..b6697d296d6 100644
--- a/advisories/unreviewed/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json
+++ b/advisories/github-reviewed/2024/03/GHSA-h574-6646-vfxx/GHSA-h574-6646-vfxx.json
@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h574-6646-vfxx",
-  "modified": "2024-03-14T09:31:05Z",
+  "modified": "2024-03-15T14:19:23Z",
   "published": "2024-03-14T09:31:05Z",
   "aliases": [
     "CVE-2024-28746"
   ],
+  "summary": "Apache Airflow: Ignored Airflow Permission",
   "details": "Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. \n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability\n",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.8.0"
+            },
+            {
+              "fixed": "2.8.3rc1"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -22,6 +41,18 @@
       "type": "WEB",
       "url": "https://github.com/apache/airflow/pull/37881"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/airflow/commit/89e7f3e7bdf2126bbbcd959dc10d65ef92773cca"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-46.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7"
@@ -31,9 +62,9 @@
     "cwe_ids": [
       "CWE-281"
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-15T14:19:23Z",
     "nvd_published_at": "2024-03-14T09:15:47Z"
   }
 }
\ No newline at end of file