netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-79m9-55jc-p6mw
GHSA-qv97-5qr8-2266
GHSA-whxr-3p84-rf3c
GHSA-whxr-3p84-rf3c
This commit is contained in:
advisory-database[bot]
2025-05-07 15:27:27 +00:00
parent 2bf7a720bc
commit 2ca704ed0e
4 changed files with 320 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/05/GHSA-79m9-55jc-p6mw/GHSA-79m9-55jc-p6mw.json
+59
View File
@@ -0,0 +1,59 @@
{
"schema_version": "1.4.0",
"id": "GHSA-79m9-55jc-p6mw",
"modified": "2025-05-07T15:26:32Z",
"published": "2025-05-07T15:26:32Z",
"aliases": [],
"summary": "scanner has a Public API without sufficient bounds checking",
"details": "`Match::get()` and `Match::ptr()` lack sufficient bounds checks, leading to potential out of bounds reads.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "scanner"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/pombredanne/scanner-rs/pull/1"
},
{
"type": "PACKAGE",
"url": "https://github.com/pombredanne/scanner-rs"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0033.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2025-05-07T15:26:32Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2025/05/GHSA-qv97-5qr8-2266/GHSA-qv97-5qr8-2266.json
+55
View File
File diff suppressed because one or more lines are too long
advisories/github-reviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json
+206
View File
@@ -0,0 +1,206 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whxr-3p84-rf3c",
"modified": "2025-05-07T15:25:42Z",
"published": "2025-05-07T09:31:19Z",
"aliases": [
"CVE-2025-27533"
],
"summary": "Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation",
"details": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/V:D/RE:M/U:Red"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.16.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.16.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.17.0"
},
{
"fixed": "5.17.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.18.0"
},
{
"fixed": "5.18.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-openwire-legacy"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.17.0"
},
{
"fixed": "5.17.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.18.0"
},
{
"fixed": "5.18.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.activemq:activemq-client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27533"
},
{
"type": "WEB",
"url": "https://github.com/apache/activemq/commit/fc4372b9f0f72b8b5eed917f0019c5cea45c5d06"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/activemq"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/AMQ-6596"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/05/06/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-789"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-07T15:25:41Z",
"nvd_published_at": "2025-05-07T09:15:18Z"
}
}
advisories/unreviewed/2025/05/GHSA-whxr-3p84-rf3c/GHSA-whxr-3p84-rf3c.json
-40
View File
@@ -1,40 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whxr-3p84-rf3c",
"modified": "2025-05-07T09:31:19Z",
"published": "2025-05-07T09:31:19Z",
"aliases": [
"CVE-2025-27533"
],
"details": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Red"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27533"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/8hcm25vf7mchg4zbbhnlx2lc5bs705hg"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/05/06/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-789"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T09:15:18Z"
}
}