From 2dd6d4c551a99df1cad22597a26476b049f970de Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 11 Sep 2023 18:06:27 +0000 Subject: [PATCH] Publish Advisories GHSA-38vf-35cg-m73w GHSA-rr66-qh5m-w6mx GHSA-38vf-35cg-m73w GHSA-rr66-qh5m-w6mx --- .../GHSA-38vf-35cg-m73w.json | 63 +++++++++++++ .../GHSA-rr66-qh5m-w6mx.json | 91 +++++++++++++++++++ .../GHSA-38vf-35cg-m73w.json | 35 ------- .../GHSA-rr66-qh5m-w6mx.json | 35 ------- 4 files changed, 154 insertions(+), 70 deletions(-) create mode 100644 advisories/github-reviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json create mode 100644 advisories/github-reviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json delete mode 100644 advisories/unreviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json delete mode 100644 advisories/unreviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json diff --git a/advisories/github-reviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json b/advisories/github-reviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json new file mode 100644 index 00000000000..3eca4259b3c --- /dev/null +++ b/advisories/github-reviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-38vf-35cg-m73w", + "modified": "2023-09-11T18:04:48Z", + "published": "2023-09-09T00:30:48Z", + "aliases": [ + "CVE-2023-41564" + ], + "summary": "Cockpit CMS arbitrary file upload vulnerability", + "details": "An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted `.shtml` file.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "cockpit-hq/cockpit" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.6.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41564" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Cockpit-HQ/Cockpit" + }, + { + "type": "WEB", + "url": "https://github.com/LongHair00/Mitre_opensource_report/blob/main/CockpitCMS-StoredXSS.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-09-11T18:04:48Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json b/advisories/github-reviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json new file mode 100644 index 00000000000..d3a7a1bd034 --- /dev/null +++ b/advisories/github-reviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json @@ -0,0 +1,91 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rr66-qh5m-w6mx", + "modified": "2023-09-11T18:04:22Z", + "published": "2023-09-09T00:30:48Z", + "aliases": [ + "CVE-2023-42278" + ], + "summary": "hutool Buffer Overflow vulnerability", + "details": "hutool v5.8.21 was discovered to contain a buffer overflow via the component `JSONUtil.parse()`.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "cn.hutool:hutool-core" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.8.21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "cn.hutool:hutool-json" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.8.21" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42278" + }, + { + "type": "WEB", + "url": "https://github.com/dromara/hutool/issues/3289" + }, + { + "type": "WEB", + "url": "https://github.com/dromara/hutool/commit/5c4486b9f58a83f283868135138f6ff3741b8c12" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dromara/hutool" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-09-11T18:04:22Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json b/advisories/unreviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json deleted file mode 100644 index a4145c760f8..00000000000 --- a/advisories/unreviewed/2023/09/GHSA-38vf-35cg-m73w/GHSA-38vf-35cg-m73w.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-38vf-35cg-m73w", - "modified": "2023-09-09T00:30:48Z", - "published": "2023-09-09T00:30:48Z", - "aliases": [ - "CVE-2023-41564" - ], - "details": "An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted .shtml file.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41564" - }, - { - "type": "WEB", - "url": "https://github.com/LongHair00/Mitre_opensource_report/blob/main/CockpitCMS-StoredXSS.md" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json b/advisories/unreviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json deleted file mode 100644 index e4486ba0fb7..00000000000 --- a/advisories/unreviewed/2023/09/GHSA-rr66-qh5m-w6mx/GHSA-rr66-qh5m-w6mx.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rr66-qh5m-w6mx", - "modified": "2023-09-09T00:30:48Z", - "published": "2023-09-09T00:30:48Z", - "aliases": [ - "CVE-2023-42278" - ], - "details": "hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42278" - }, - { - "type": "WEB", - "url": "https://github.com/dromara/hutool/issues/3289" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file