From 3e8b5b0cfb98a7e27e4b811969251c0312d7d4a4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 16 Sep 2024 22:36:12 +0000 Subject: [PATCH] Publish Advisories GHSA-3jqw-crqj-w8qw GHSA-rm2j-x595-q9cj GHSA-7vhj-pfwv-hx3w GHSA-q9r8-89xr-4xv4 --- .../GHSA-3jqw-crqj-w8qw.json | 29 ++++++++++++------- .../GHSA-rm2j-x595-q9cj.json | 23 +++++++++++---- .../GHSA-7vhj-pfwv-hx3w.json | 6 +++- .../GHSA-q9r8-89xr-4xv4.json | 6 +++- 4 files changed, 45 insertions(+), 19 deletions(-) diff --git a/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json b/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json index 0e1f472ae61..f009b010e92 100644 --- a/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json +++ b/advisories/github-reviewed/2018/07/GHSA-3jqw-crqj-w8qw/GHSA-3jqw-crqj-w8qw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3jqw-crqj-w8qw", - "modified": "2024-05-16T18:38:37Z", + "modified": "2024-09-16T22:34:20Z", "published": "2018-07-23T19:51:35Z", "aliases": [ "CVE-2011-4137" @@ -9,20 +9,27 @@ "summary": "Denial of service in django", "details": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.2.0" + "introduced": "0" }, { "fixed": "1.2.7" @@ -34,14 +41,14 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.3.0" + "introduced": "1.3" }, { "fixed": "1.3.1" @@ -76,6 +83,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-2.yaml" + }, { "type": "WEB", "url": "https://hermes.opensuse.org/messages/14700881" @@ -100,10 +111,6 @@ "type": "WEB", "url": "http://openwall.com/lists/oss-security/2011/09/15/5" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/46614" - }, { "type": "WEB", "url": "http://www.debian.org/security/2011/dsa-2332" @@ -113,7 +120,7 @@ "cwe_ids": [ "CWE-1088" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:55:25Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json b/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json index b422d3623f7..ffe8dded1c7 100644 --- a/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json +++ b/advisories/github-reviewed/2022/05/GHSA-rm2j-x595-q9cj/GHSA-rm2j-x595-q9cj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rm2j-x595-q9cj", - "modified": "2024-01-16T22:47:59Z", + "modified": "2024-09-16T22:35:46Z", "published": "2022-05-14T03:49:36Z", "aliases": [ "CVE-2011-4139" @@ -9,13 +9,20 @@ "summary": "Django Vulnerable to Cache Poisoning", "details": "Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -34,14 +41,14 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { - "introduced": "1.3.0" + "introduced": "1.3" }, { "fixed": "1.3.1" @@ -72,6 +79,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-4.yaml" + }, { "type": "WEB", "url": "https://hermes.opensuse.org/messages/14700881" @@ -102,7 +113,7 @@ "CWE-20", "CWE-349" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-16T22:47:59Z", "nvd_published_at": "2011-10-19T10:55:00Z" diff --git a/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json b/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json index 2aca24e628d..18d6ebe3ea1 100644 --- a/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json +++ b/advisories/github-reviewed/2024/09/GHSA-7vhj-pfwv-hx3w/GHSA-7vhj-pfwv-hx3w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7vhj-pfwv-hx3w", - "modified": "2024-09-12T17:38:48Z", + "modified": "2024-09-16T22:34:06Z", "published": "2024-09-12T15:33:01Z", "aliases": [ "CVE-2024-45852" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/proc_wrapper.py#L54-L55" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-82.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" diff --git a/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json b/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json index 065691ac773..179b734e78d 100644 --- a/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json +++ b/advisories/github-reviewed/2024/09/GHSA-q9r8-89xr-4xv4/GHSA-q9r8-89xr-4xv4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q9r8-89xr-4xv4", - "modified": "2024-09-12T17:38:46Z", + "modified": "2024-09-16T22:34:35Z", "published": "2024-09-12T15:33:01Z", "aliases": [ "CVE-2024-45853" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/byom_handler.py#L424-L431" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-83.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"