netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-pwr2-4v36-6qpr
GHSA-qpxm-689r-3849
GHSA-2h6c-m9mj-xfcf
GHSA-2mff-f6qm-822q
GHSA-5px6-hg9v-r927
GHSA-69v8-v8v7-vv42
GHSA-q58q-2fxh-6w6r
GHSA-qpxm-689r-3849
GHSA-rmmh-p597-ppvv
This commit is contained in:
advisory-database[bot]
2024-02-26 21:32:17 +00:00
parent 537b1a512c
commit 2e8f56c42c
9 changed files with 244 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json → advisories/github-reviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json
+28 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pwr2-4v36-6qpr",
"modified": "2024-02-26T18:30:31Z",
"modified": "2024-02-26T21:31:06Z",
"published": "2024-02-26T18:30:31Z",
"aliases": [
"CVE-2024-27454"
],
"summary": "orjson does not limit recursion for deeply nested JSON documents",
"details": "orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "orjson"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.15"
}
]
}
]
}
],
"references": [
{
@@ -29,6 +48,10 @@
"type": "WEB",
"url": "https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e"
},
{
"type": "PACKAGE",
"url": "https://github.com/ijl/orjson"
},
{
"type": "WEB",
"url": "https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915"
@@ -40,11 +63,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-674"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-26T21:31:06Z",
"nvd_published_at": "2024-02-26T16:28:00Z"
}
}
advisories/github-reviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json
+125
View File
@@ -0,0 +1,125 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qpxm-689r-3849",
"modified": "2024-02-26T21:30:38Z",
"published": "2024-02-26T18:30:30Z",
"aliases": [
"CVE-2024-22371"
],
"summary": "Apache Camel data exposure vulnerability",
"details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.21.0"
},
{
"fixed": "3.21.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.22.0"
},
{
"fixed": "3.22.1"
}
]
}
],
"versions": [
"3.22.0"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.camel:camel-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.4.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371"
},
{
"type": "WEB",
"url": "https://camel.apache.org/security/CVE-2024-22371.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/camel"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/CAMEL-20305"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-02-26T21:30:37Z",
"nvd_published_at": "2024-02-26T16:27:56Z"
}
}
advisories/unreviewed/2024/02/GHSA-2h6c-m9mj-xfcf/GHSA-2h6c-m9mj-xfcf.json
+31
View File
@@ -0,0 +1,31 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2h6c-m9mj-xfcf",
"modified": "2024-02-26T21:31:36Z",
"published": "2024-02-26T21:31:36Z",
"aliases": [
"CVE-2024-24528"
],
"details": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24528"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T19:15:07Z"
}
}
advisories/unreviewed/2024/02/GHSA-2mff-f6qm-822q/GHSA-2mff-f6qm-822q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2mff-f6qm-822q",
"modified": "2024-02-12T03:30:24Z",
"modified": "2024-02-26T21:31:35Z",
"published": "2024-02-12T03:30:24Z",
"aliases": [
"CVE-2024-25740"
],
"details": "A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-12T03:15:32Z"
advisories/unreviewed/2024/02/GHSA-5px6-hg9v-r927/GHSA-5px6-hg9v-r927.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5px6-hg9v-r927",
"modified": "2024-02-22T06:30:32Z",
"modified": "2024-02-26T21:31:35Z",
"published": "2024-02-12T03:30:24Z",
"aliases": [
"CVE-2023-52429"
],
"details": "dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-12T03:15:32Z"
advisories/unreviewed/2024/02/GHSA-69v8-v8v7-vv42/GHSA-69v8-v8v7-vv42.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-69v8-v8v7-vv42",
"modified": "2024-02-12T03:30:24Z",
"modified": "2024-02-26T21:31:35Z",
"published": "2024-02-12T03:30:24Z",
"aliases": [
"CVE-2024-25739"
],
"details": "create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-754"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-12T03:15:32Z"
advisories/unreviewed/2024/02/GHSA-q58q-2fxh-6w6r/GHSA-q58q-2fxh-6w6r.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-319"
],
"severity": "LOW",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qpxm-689r-3849",
"modified": "2024-02-26T18:30:30Z",
"published": "2024-02-26T18:30:30Z",
"aliases": [
"CVE-2024-22371"
],
"details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371"
},
{
"type": "WEB",
"url": "https://camel.apache.org/security/CVE-2024-22371.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:27:56Z"
}
}
advisories/unreviewed/2024/02/GHSA-rmmh-p597-ppvv/GHSA-rmmh-p597-ppvv.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rmmh-p597-ppvv",
"modified": "2024-02-26T21:31:36Z",
"published": "2024-02-26T21:31:36Z",
"aliases": [
"CVE-2024-1899"
],
"details": "An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1899"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2024-05"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T19:15:07Z"
}
}