Publish Advisories

GHSA-3pqh-p72c-fj85
GHSA-qv35-3gw6-8q4j
GHSA-xr3m-6gq6-22cg

advisories/github-reviewed/2021/11/GHSA-3pqh-p72c-fj85/GHSA-3pqh-p72c-fj85.json

@@ -1,14 +1,19 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3pqh-p72c-fj85",
-  "modified": "2021-11-19T13:10:27Z",
+  "modified": "2025-01-29T16:56:35Z",
   "published": "2021-11-19T19:34:26Z",
   "aliases": [
     "CVE-2021-3978"
   ],
   "summary": "Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki",
   "details": "### Impact\n\nWhen copying files with rsync, octorpki uses the \"-a\" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.  \n\n## For more information\n\nIf you have any questions or comments about this advisory email us at security@cloudflare.com",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
+  ],
   "affected": [
     {
       "package": {
@@ -35,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3pqh-p72c-fj85"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3978"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/cloudflare/cfrpki"
@@ -42,11 +51,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-269",
       "CWE-281"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2021-11-19T13:10:27Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-01-29T10:15:07Z"
   }
 }

advisories/github-reviewed/2024/08/GHSA-qv35-3gw6-8q4j/GHSA-qv35-3gw6-8q4j.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qv35-3gw6-8q4j",
-  "modified": "2024-08-07T19:41:10Z",
+  "modified": "2025-01-29T16:57:28Z",
   "published": "2024-08-05T14:46:22Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-24882"
+  ],
   "summary": "In regclient, pinned manifest digests may be ignored",
   "details": "### Impact\nA malicious registry could return a different digest for a pinned manifest without detection.\n\n### Patches\nThis has been fixed in the v0.7.1 release.\n\n### Workarounds\nAfter running a `regclient.ManifestGet`, the returned digest can be compared to the requested digest.\n",
   "severity": [

advisories/github-reviewed/2025/01/GHSA-xr3m-6gq6-22cg/GHSA-xr3m-6gq6-22cg.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xr3m-6gq6-22cg",
-  "modified": "2025-01-28T19:12:44Z",
+  "modified": "2025-01-29T16:57:20Z",
   "published": "2025-01-28T19:12:44Z",
   "aliases": [],
   "summary": "Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document",
@@ -18,8 +18,18 @@
         "ecosystem": "Packagist",
         "name": "pimcore/pimcore"
       },
-      "versions": [
-        "11.4.2"
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "11.4.2"
+            },
+            {
+              "fixed": "11.5.3"
+            }
+          ]
+        }
       ]
     }
   ],