From 2e8f56c42ca62aee93f94fe22e0a4d159234a61d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 26 Feb 2024 21:32:17 +0000 Subject: [PATCH] Publish Advisories GHSA-pwr2-4v36-6qpr GHSA-qpxm-689r-3849 GHSA-2h6c-m9mj-xfcf GHSA-2mff-f6qm-822q GHSA-5px6-hg9v-r927 GHSA-69v8-v8v7-vv42 GHSA-q58q-2fxh-6w6r GHSA-qpxm-689r-3849 GHSA-rmmh-p597-ppvv --- .../GHSA-pwr2-4v36-6qpr.json | 33 ++++- .../GHSA-qpxm-689r-3849.json | 125 ++++++++++++++++++ .../GHSA-2h6c-m9mj-xfcf.json | 31 +++++ .../GHSA-2mff-f6qm-822q.json | 11 +- .../GHSA-5px6-hg9v-r927.json | 11 +- .../GHSA-69v8-v8v7-vv42.json | 11 +- .../GHSA-q58q-2fxh-6w6r.json | 2 +- .../GHSA-qpxm-689r-3849.json | 38 ------ .../GHSA-rmmh-p597-ppvv.json | 38 ++++++ 9 files changed, 244 insertions(+), 56 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json (62%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json create mode 100644 advisories/unreviewed/2024/02/GHSA-2h6c-m9mj-xfcf/GHSA-2h6c-m9mj-xfcf.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json create mode 100644 advisories/unreviewed/2024/02/GHSA-rmmh-p597-ppvv/GHSA-rmmh-p597-ppvv.json diff --git a/advisories/unreviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json b/advisories/github-reviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json similarity index 62% rename from advisories/unreviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json rename to advisories/github-reviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json index b53a0d04ee6..7ec181b57f7 100644 --- a/advisories/unreviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json +++ b/advisories/github-reviewed/2024/02/GHSA-pwr2-4v36-6qpr/GHSA-pwr2-4v36-6qpr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pwr2-4v36-6qpr", - "modified": "2024-02-26T18:30:31Z", + "modified": "2024-02-26T21:31:06Z", "published": "2024-02-26T18:30:31Z", "aliases": [ "CVE-2024-27454" ], + "summary": "orjson does not limit recursion for deeply nested JSON documents", "details": "orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "orjson" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.9.15" + } + ] + } + ] + } ], "references": [ { @@ -29,6 +48,10 @@ "type": "WEB", "url": "https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e" }, + { + "type": "PACKAGE", + "url": "https://github.com/ijl/orjson" + }, { "type": "WEB", "url": "https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915" @@ -40,11 +63,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-674" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-26T21:31:06Z", "nvd_published_at": "2024-02-26T16:28:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json b/advisories/github-reviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json new file mode 100644 index 00000000000..239b4b4c034 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json @@ -0,0 +1,125 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qpxm-689r-3849", + "modified": "2024-02-26T21:30:38Z", + "published": "2024-02-26T18:30:30Z", + "aliases": [ + "CVE-2024-22371" + ], + "summary": "Apache Camel data exposure vulnerability", + "details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel. This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.21.0" + }, + { + "fixed": "3.21.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.22.0" + }, + { + "fixed": "3.22.1" + } + ] + } + ], + "versions": [ + "3.22.0" + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "fixed": "4.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371" + }, + { + "type": "WEB", + "url": "https://camel.apache.org/security/CVE-2024-22371.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/camel" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/CAMEL-20305" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-02-26T21:30:37Z", + "nvd_published_at": "2024-02-26T16:27:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-2h6c-m9mj-xfcf/GHSA-2h6c-m9mj-xfcf.json b/advisories/unreviewed/2024/02/GHSA-2h6c-m9mj-xfcf/GHSA-2h6c-m9mj-xfcf.json new file mode 100644 index 00000000000..428241c5da5 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-2h6c-m9mj-xfcf/GHSA-2h6c-m9mj-xfcf.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2h6c-m9mj-xfcf", + "modified": "2024-02-26T21:31:36Z", + "published": "2024-02-26T21:31:36Z", + "aliases": [ + "CVE-2024-24528" + ], + "details": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24528" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-26T19:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-2mff-f6qm-822q/GHSA-2mff-f6qm-822q.json b/advisories/unreviewed/2024/02/GHSA-2mff-f6qm-822q/GHSA-2mff-f6qm-822q.json index 49081a90c8d..7075958adbf 100644 --- a/advisories/unreviewed/2024/02/GHSA-2mff-f6qm-822q/GHSA-2mff-f6qm-822q.json +++ b/advisories/unreviewed/2024/02/GHSA-2mff-f6qm-822q/GHSA-2mff-f6qm-822q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2mff-f6qm-822q", - "modified": "2024-02-12T03:30:24Z", + "modified": "2024-02-26T21:31:35Z", "published": "2024-02-12T03:30:24Z", "aliases": [ "CVE-2024-25740" ], "details": "A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-12T03:15:32Z" diff --git a/advisories/unreviewed/2024/02/GHSA-5px6-hg9v-r927/GHSA-5px6-hg9v-r927.json b/advisories/unreviewed/2024/02/GHSA-5px6-hg9v-r927/GHSA-5px6-hg9v-r927.json index 097631d62b4..e37a3d1e93f 100644 --- a/advisories/unreviewed/2024/02/GHSA-5px6-hg9v-r927/GHSA-5px6-hg9v-r927.json +++ b/advisories/unreviewed/2024/02/GHSA-5px6-hg9v-r927/GHSA-5px6-hg9v-r927.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5px6-hg9v-r927", - "modified": "2024-02-22T06:30:32Z", + "modified": "2024-02-26T21:31:35Z", "published": "2024-02-12T03:30:24Z", "aliases": [ "CVE-2023-52429" ], "details": "dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-754" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-12T03:15:32Z" diff --git a/advisories/unreviewed/2024/02/GHSA-69v8-v8v7-vv42/GHSA-69v8-v8v7-vv42.json b/advisories/unreviewed/2024/02/GHSA-69v8-v8v7-vv42/GHSA-69v8-v8v7-vv42.json index 9ad9b2b2abc..a36d651821d 100644 --- a/advisories/unreviewed/2024/02/GHSA-69v8-v8v7-vv42/GHSA-69v8-v8v7-vv42.json +++ b/advisories/unreviewed/2024/02/GHSA-69v8-v8v7-vv42/GHSA-69v8-v8v7-vv42.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-69v8-v8v7-vv42", - "modified": "2024-02-12T03:30:24Z", + "modified": "2024-02-26T21:31:35Z", "published": "2024-02-12T03:30:24Z", "aliases": [ "CVE-2024-25739" ], "details": "create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-754" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-12T03:15:32Z" diff --git a/advisories/unreviewed/2024/02/GHSA-q58q-2fxh-6w6r/GHSA-q58q-2fxh-6w6r.json b/advisories/unreviewed/2024/02/GHSA-q58q-2fxh-6w6r/GHSA-q58q-2fxh-6w6r.json index 1c337114303..8a7bb16e586 100644 --- a/advisories/unreviewed/2024/02/GHSA-q58q-2fxh-6w6r/GHSA-q58q-2fxh-6w6r.json +++ b/advisories/unreviewed/2024/02/GHSA-q58q-2fxh-6w6r/GHSA-q58q-2fxh-6w6r.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-319" ], "severity": "LOW", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json b/advisories/unreviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json deleted file mode 100644 index a4f134bbb06..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-qpxm-689r-3849/GHSA-qpxm-689r-3849.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qpxm-689r-3849", - "modified": "2024-02-26T18:30:30Z", - "published": "2024-02-26T18:30:30Z", - "aliases": [ - "CVE-2024-22371" - ], - "details": "Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. Vulnerability in Apache Camel.This issue affects Apache Camel: from 3.21.X through 3.21.3, from 3.22.X through 3.22.0, from 4.0.X through 4.0.3, from 4.X through 4.3.0.\n\nUsers are recommended to upgrade to version 3.21.4, 3.22.1, 4.0.4 or 4.4.0, which fixes the issue.\n\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22371" - }, - { - "type": "WEB", - "url": "https://camel.apache.org/security/CVE-2024-22371.html" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-26T16:27:56Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-rmmh-p597-ppvv/GHSA-rmmh-p597-ppvv.json b/advisories/unreviewed/2024/02/GHSA-rmmh-p597-ppvv/GHSA-rmmh-p597-ppvv.json new file mode 100644 index 00000000000..74a214acdc1 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-rmmh-p597-ppvv/GHSA-rmmh-p597-ppvv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rmmh-p597-ppvv", + "modified": "2024-02-26T21:31:36Z", + "published": "2024-02-26T21:31:36Z", + "aliases": [ + "CVE-2024-1899" + ], + "details": "An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1899" + }, + { + "type": "WEB", + "url": "https://www.tenable.com/security/research/tra-2024-05" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-26T19:15:07Z" + } +} \ No newline at end of file