From 2d3922ef346de43bf375bdfe47f68b1b3ae8debc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 22:04:48 +0000 Subject: [PATCH] Publish Advisories GHSA-492x-gfqx-wpf3 GHSA-56ff-m6pv-8594 GHSA-cvh8-9j4x-5v4j GHSA-vhh3-mvc4-hhq6 --- .../GHSA-492x-gfqx-wpf3.json | 27 ++++++++++++++--- .../GHSA-56ff-m6pv-8594.json | 27 ++++++++++++++--- .../GHSA-cvh8-9j4x-5v4j.json | 27 ++++++++++++++--- .../GHSA-vhh3-mvc4-hhq6.json | 30 ++++++++++++++++--- 4 files changed, 95 insertions(+), 16 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json (67%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json (66%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json (65%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json (57%) diff --git a/advisories/unreviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json b/advisories/github-reviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json rename to advisories/github-reviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json index 9070443a021..c91476e6c8c 100644 --- a/advisories/unreviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json +++ b/advisories/github-reviewed/2022/05/GHSA-492x-gfqx-wpf3/GHSA-492x-gfqx-wpf3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-492x-gfqx-wpf3", - "modified": "2022-05-13T01:17:42Z", + "modified": "2024-01-30T22:03:31Z", "published": "2022-05-13T01:17:42Z", "aliases": [ "CVE-2019-1003077" ], + "summary": "Missing permission check in Jenkins Audit to Database Plugin", "details": "A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:audit2db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.5" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:03:31Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json b/advisories/github-reviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json similarity index 66% rename from advisories/unreviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json rename to advisories/github-reviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json index c1929eb70d2..97a0227f1a8 100644 --- a/advisories/unreviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json +++ b/advisories/github-reviewed/2022/05/GHSA-56ff-m6pv-8594/GHSA-56ff-m6pv-8594.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-56ff-m6pv-8594", - "modified": "2022-05-13T01:25:16Z", + "modified": "2024-01-30T22:03:52Z", "published": "2022-05-13T01:25:16Z", "aliases": [ "CVE-2019-1003079" ], + "summary": "Missing permission check in Jenkins VMware Lab Manager Slaves Plugin", "details": "A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:labmanager" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.2.8" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:03:52Z", "nvd_published_at": "2019-04-04T16:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json b/advisories/github-reviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json rename to advisories/github-reviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json index f078c7cd8c2..0ef01cd509a 100644 --- a/advisories/unreviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json +++ b/advisories/github-reviewed/2022/05/GHSA-cvh8-9j4x-5v4j/GHSA-cvh8-9j4x-5v4j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cvh8-9j4x-5v4j", - "modified": "2022-05-13T01:18:46Z", + "modified": "2024-01-30T22:04:02Z", "published": "2022-05-13T01:18:46Z", "aliases": [ "CVE-2018-1000424" ], + "summary": "Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk ", "details": "An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:artifactory" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.16.2" + } + ] + } + ] + } ], "references": [ { @@ -35,8 +54,8 @@ "CWE-522" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:04:02Z", "nvd_published_at": "2019-01-09T23:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json b/advisories/github-reviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json rename to advisories/github-reviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json index 5346d799e86..60a47ba037c 100644 --- a/advisories/unreviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json +++ b/advisories/github-reviewed/2022/05/GHSA-vhh3-mvc4-hhq6/GHSA-vhh3-mvc4-hhq6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vhh3-mvc4-hhq6", - "modified": "2022-05-13T01:18:20Z", + "modified": "2024-01-30T22:03:41Z", "published": "2022-05-13T01:18:20Z", "aliases": [ "CVE-2017-1000388" ], + "summary": "Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks", "details": "Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:depgraph-view" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.13" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.12" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-862" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:03:41Z", "nvd_published_at": "2018-01-26T02:29:00Z" } } \ No newline at end of file