Publish Advisories

GHSA-3g8x-wqfp-q876
GHSA-c77m-wh63-vhch
GHSA-fprx-3cv4-96vc

advisories/unreviewed/2024/07/GHSA-3g8x-wqfp-q876/GHSA-3g8x-wqfp-q876.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3g8x-wqfp-q876",
-  "modified": "2024-07-10T00:30:41Z",
+  "modified": "2024-07-23T09:30:39Z",
   "published": "2024-07-09T12:30:58Z",
   "aliases": [
     "CVE-2024-3596"
@@ -30,6 +30,10 @@
       "type": "WEB",
       "url": "https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf"
     },
+    {
+      "type": "WEB",
+      "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014"
+    },
     {
       "type": "WEB",
       "url": "https://www.blastradius.fail"

advisories/unreviewed/2024/07/GHSA-c77m-wh63-vhch/GHSA-c77m-wh63-vhch.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c77m-wh63-vhch",
+  "modified": "2024-07-23T09:30:39Z",
+  "published": "2024-07-23T09:30:39Z",
+  "aliases": [
+    "CVE-2024-41012"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Remove locks reliably when fcntl/close race is detected\n\nWhen fcntl_setlk() races with close(), it removes the created lock with\ndo_lock_file_wait().\nHowever, LSMs can allow the first do_lock_file_wait() that created the lock\nwhile denying the second do_lock_file_wait() that tries to remove the lock.\nSeparately, posix_lock_file() could also fail to\nremove a lock due to GFP_KERNEL allocation failure (when splitting a range\nin the middle).\n\nAfter the bug has been triggered, use-after-free reads will occur in\nlock_get_status() when userspace reads /proc/locks. This can likely be used\nto read arbitrary kernel memory, but can't corrupt kernel memory.\n\nFix it by calling locks_remove_posix() instead, which is designed to\nreliably get rid of POSIX locks associated with the given file and\nfiles_struct and is also used by filp_flush().",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41012"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/3cad1bc010416c6dd780643476bc59ed742436b9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/b6d223942c34057fdfd8f149e763fa823731b224"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-23T08:15:01Z"
+  }
+}

advisories/unreviewed/2024/07/GHSA-fprx-3cv4-96vc/GHSA-fprx-3cv4-96vc.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fprx-3cv4-96vc",
+  "modified": "2024-07-23T09:30:39Z",
+  "published": "2024-07-23T09:30:39Z",
+  "aliases": [
+    "CVE-2024-29070"
+  ],
+  "details": "On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns \"Authorization\" as the front-end authentication credential. \"Authorization\" can still initiate requests and access data even after logout.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29070"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-613"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-23T09:15:02Z"
+  }
+}