From 2e172a188e0ce291661e4875fce881aaee3daf04 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 19 Mar 2025 15:20:34 +0000
Subject: [PATCH] Publish Advisories

GHSA-q9cm-88jx-3vfw
GHSA-qmg3-hpqr-gqvc
---
 .../GHSA-q9cm-88jx-3vfw.json                  |  4 +-
 .../GHSA-qmg3-hpqr-gqvc.json                  | 63 +++++++++++++++++++
 2 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 advisories/github-reviewed/2025/03/GHSA-qmg3-hpqr-gqvc/GHSA-qmg3-hpqr-gqvc.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-q9cm-88jx-3vfw/GHSA-q9cm-88jx-3vfw.json b/advisories/github-reviewed/2025/01/GHSA-q9cm-88jx-3vfw/GHSA-q9cm-88jx-3vfw.json
index b4f8698b1d3..9961f040f79 100644
--- a/advisories/github-reviewed/2025/01/GHSA-q9cm-88jx-3vfw/GHSA-q9cm-88jx-3vfw.json
+++ b/advisories/github-reviewed/2025/01/GHSA-q9cm-88jx-3vfw/GHSA-q9cm-88jx-3vfw.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q9cm-88jx-3vfw",
-  "modified": "2025-01-23T22:24:30Z",
+  "modified": "2025-03-19T15:19:39Z",
   "published": "2025-01-22T18:31:55Z",
   "aliases": [
     "CVE-2025-24399"
   ],
   "summary": "Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin ",
-  "details": "The Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier treats usernames as case-insensitive.\n\nOn a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.\n\nOpenId Connect Authentication Plugin 4.453.v4d7765c854f4 introduces an advanced configuration option to manage username case sensitivity, with default to case-sensitive.\n",
+  "details": "The Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier treats usernames as case-insensitive.\n\nOn a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.\n\nOpenId Connect Authentication Plugin 4.453.v4d7765c854f4 introduces an advanced configuration option to manage username case sensitivity, with default to case-sensitive.",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2025/03/GHSA-qmg3-hpqr-gqvc/GHSA-qmg3-hpqr-gqvc.json b/advisories/github-reviewed/2025/03/GHSA-qmg3-hpqr-gqvc/GHSA-qmg3-hpqr-gqvc.json
new file mode 100644
index 00000000000..2939992d3ca
--- /dev/null
+++ b/advisories/github-reviewed/2025/03/GHSA-qmg3-hpqr-gqvc/GHSA-qmg3-hpqr-gqvc.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qmg3-hpqr-gqvc",
+  "modified": "2025-03-19T15:19:12Z",
+  "published": "2025-03-19T15:19:12Z",
+  "aliases": [
+    "CVE-2025-30154"
+  ],
+  "summary": "Multiple Reviewdog actions were compromised during a specific time period",
+  "details": "### Summary\n\n`reviewdog/action-setup@v1` was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs.\n\nOther reviewdog actions that use `reviewdog/action-setup@v1` would also be compromised, regardless of version or pinning method:\n- reviewdog/action-shellcheck\n- reviewdog/action-composite-template\n- reviewdog/action-staticcheck\n- reviewdog/action-ast-grep\n- reviewdog/action-typos\n\n### Details\n\nMalicious commit: https://github.com/reviewdog/action-setup/commit/f0d342d\nfix/retag via version upgrade: https://github.com/reviewdog/action-setup/commit/3f401fe\n\nSee the detailed report from Wiz Research: [Wiz Blog Post](https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup) and reviewdog maintainer annoucement: [reviewdog #2079](https://github.com/reviewdog/reviewdog/issues/2079)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "GitHub Actions",
+        "name": "reviewdog/action-setup"
+      },
+      "versions": [
+        "1"
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/reviewdog/reviewdog/issues/2079"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/reviewdog/action-setup/commit/f0d342d24037bb11d26b9bd8496e0808ba32e9ec"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/reviewdog/reviewdog"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-506"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-19T15:19:12Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file