diff --git a/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json b/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json index 0e1f472ae61..f009b010e92 100644 --- a/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json +++ b/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3jqw-crqj-w8qw", - "modified": "2024-05-16T18:38:37Z", + "modified": "2024-09-16T22:34:20Z", "published": "2018-07-23T19:51:35Z", "aliases": [ "CVE-2011-4137" @@ -9,20 +9,27 @@ "summary": "Denial of service in django", "details": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.2.0" + "introduced": "0" }, { "fixed": "1.2.7" @@ -34,14 +41,14 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.3.0" + "introduced": "1.3" }, { "fixed": "1.3.1" @@ -76,6 +83,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-2.yaml" + }, { "type": "WEB", "url": "https://hermes.opensuse.org/messages/14700881" @@ -100,10 +111,6 @@ "type": "WEB", "url": "http://openwall.com/lists/oss-security/2011/09/15/5" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/46614" - }, { "type": "WEB", "url": "http://www.debian.org/security/2011/dsa-2332" @@ -113,7 +120,7 @@ "cwe_ids": [ "CWE-1088" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:55:25Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json b/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json index b422d3623f7..ffe8dded1c7 100644 --- a/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json +++ b/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rm2j-x595-q9cj", - "modified": "2024-01-16T22:47:59Z", + "modified": "2024-09-16T22:35:46Z", "published": "2022-05-14T03:49:36Z", "aliases": [ "CVE-2011-4139" @@ -9,13 +9,20 @@ "summary": "Django Vulnerable to Cache Poisoning", "details": "Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -34,14 +41,14 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.3.0" + "introduced": "1.3" }, { "fixed": "1.3.1" @@ -72,6 +79,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-4.yaml" + }, { "type": "WEB", "url": "https://hermes.opensuse.org/messages/14700881" @@ -102,7 +113,7 @@ "CWE-20", "CWE-349" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-16T22:47:59Z", "nvd_published_at": "2011-10-19T10:55:00Z" diff --git a/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json b/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json index 2aca24e628d..18d6ebe3ea1 100644 --- a/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json +++ b/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7vhj-pfwv-hx3w", - "modified": "2024-09-12T17:38:48Z", + "modified": "2024-09-16T22:34:06Z", "published": "2024-09-12T15:33:01Z", "aliases": [ "CVE-2024-45852" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/proc_wrapper.py#L54-L55" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-82.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" diff --git a/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json b/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json index 065691ac773..179b734e78d 100644 --- a/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json +++ b/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q9r8-89xr-4xv4", - "modified": "2024-09-12T17:38:46Z", + "modified": "2024-09-16T22:34:35Z", "published": "2024-09-12T15:33:01Z", "aliases": [ "CVE-2024-45853" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/byom_handler.py#L424-L431" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-83.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"