From 330c12fa381da743b8d8637ba8c1a0c90f49b69f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 1 May 2024 11:21:22 +0000 Subject: [PATCH] Publish Advisories GHSA-f22j-37jj-cxw9 GHSA-jf99-2rj4-jxrm GHSA-v89f-4mc4-h6w9 --- .../GHSA-f22j-37jj-cxw9.json | 34 +++++++++++++++-- .../GHSA-jf99-2rj4-jxrm.json | 35 +++++++++++++++-- .../GHSA-v89f-4mc4-h6w9.json | 38 +++++++++++++++++-- 3 files changed, 95 insertions(+), 12 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json (51%) diff --git a/advisories/unreviewed/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json b/advisories/github-reviewed/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json rename to advisories/github-reviewed/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json index c649111be6a..9784d509d11 100644 --- a/advisories/unreviewed/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json +++ b/advisories/github-reviewed/2022/05/GHSA-f22j-37jj-cxw9/GHSA-f22j-37jj-cxw9.json @@ -1,23 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-f22j-37jj-cxw9", - "modified": "2022-05-17T04:58:29Z", + "modified": "2024-05-01T11:18:38Z", "published": "2022-05-17T04:58:29Z", "aliases": [ "CVE-2013-4436" ], + "summary": "SaltStack MITM SSH attack in salt-ssh", "details": "The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.17.0" + }, + { + "fixed": "0.17.1" + } + ] + } + ], + "versions": [ + "0.17.0" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4436" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "http://docs.saltstack.com/topics/releases/0.17.1.html" @@ -32,8 +58,8 @@ "CWE-20" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-01T11:18:38Z", "nvd_published_at": "2013-11-05T18:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json b/advisories/github-reviewed/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json rename to advisories/github-reviewed/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json index b249616fae9..58741f988c6 100644 --- a/advisories/unreviewed/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json +++ b/advisories/github-reviewed/2022/05/GHSA-jf99-2rj4-jxrm/GHSA-jf99-2rj4-jxrm.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-jf99-2rj4-jxrm", - "modified": "2022-05-17T04:45:17Z", + "modified": "2024-05-01T11:20:16Z", "published": "2022-05-17T04:45:17Z", "aliases": [ "CVE-2013-7110" ], + "summary": "Transifex command-line client has improper certificate validation", "details": "Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "transifex-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,14 @@ "type": "WEB", "url": "https://github.com/transifex/transifex-client/issues/42" }, + { + "type": "WEB", + "url": "https://github.com/transifex/transifex-client/commit/e0d1f8b38ec1a24e2999d63420554d8393206f58" + }, + { + "type": "PACKAGE", + "url": "https://github.com/transifex/transifex-client" + }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2013/12/13/5" @@ -36,8 +63,8 @@ "CWE-20" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-01T11:20:16Z", "nvd_published_at": "2014-05-02T01:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json b/advisories/github-reviewed/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json rename to advisories/github-reviewed/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json index 7bf3e772f28..7fa0c552a10 100644 --- a/advisories/unreviewed/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json +++ b/advisories/github-reviewed/2022/05/GHSA-v89f-4mc4-h6w9/GHSA-v89f-4mc4-h6w9.json @@ -1,23 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-v89f-4mc4-h6w9", - "modified": "2022-05-17T04:58:26Z", + "modified": "2024-05-01T11:19:14Z", "published": "2022-05-17T04:58:26Z", "aliases": [ "CVE-2013-4435" ], + "summary": "Salt has insufficient argument validation in several modules", "details": "Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.15.0" + }, + { + "fixed": "0.17.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.17.0" + } + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4435" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, + { + "type": "WEB", + "url": "https://github.com/saltstack/salt/blob/master/doc/topics/releases/0.17.1.rst" + }, { "type": "WEB", "url": "http://docs.saltstack.com/topics/releases/0.17.1.html" @@ -32,8 +62,8 @@ "CWE-287" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-01T11:19:14Z", "nvd_published_at": "2013-11-05T18:55:00Z" } } \ No newline at end of file