diff --git a/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json b/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json new file mode 100644 index 00000000000..137edfe9231 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json @@ -0,0 +1,115 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-83q5-whqp-r8jr", + "modified": "2023-12-20T20:32:13Z", + "published": "2023-12-20T09:30:26Z", + "aliases": [ + "CVE-2023-37544" + ], + "summary": "Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability", + "details": "Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.\n\nThis issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.\n\nThe known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.\n\n2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.\n2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.\n3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.\n3.1 Pulsar WebSocket Proxy users are unaffected.\nAny users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.pulsar:pulsar-websocket" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.10.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.pulsar:pulsar-websocket" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.11.0" + }, + { + "fixed": "2.11.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.pulsar:pulsar-websocket" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37544" + }, + { + "type": "WEB", + "url": "https://github.com/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358" + }, + { + "type": "WEB", + "url": "https://github.com/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a" + }, + { + "type": "WEB", + "url": "https://github.com/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/pulsar" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/12/20/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:32:13Z", + "nvd_published_at": "2023-12-20T09:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json b/advisories/github-reviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json similarity index 61% rename from advisories/unreviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json rename to advisories/github-reviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json index 05f74f4eb12..a80f8357c1c 100644 --- a/advisories/unreviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json +++ b/advisories/github-reviewed/2023/12/GHSA-hh8p-p8mp-gqhm/GHSA-hh8p-p8mp-gqhm.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hh8p-p8mp-gqhm", - "modified": "2023-12-20T06:30:25Z", + "modified": "2023-12-20T20:32:39Z", "published": "2023-12-20T06:30:25Z", "aliases": [ "CVE-2023-6975" ], + "summary": "MLFlow Path Traversal Vulnerability", "details": "A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mlflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/mlflow/mlflow/commit/b9ab9ed77e1deda9697fe472fb1079fd428149ee" }, + { + "type": "PACKAGE", + "url": "https://github.com/mlflow/mlflow" + }, { "type": "WEB", "url": "https://huntr.com/bounties/029a3824-cee3-4cf1-b260-7138aa539b85" @@ -35,8 +58,8 @@ "CWE-29" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:32:39Z", "nvd_published_at": "2023-12-20T06:15:45Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json b/advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json new file mode 100644 index 00000000000..5b868eb730d --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-mhpq-9638-x6pw/GHSA-mhpq-9638-x6pw.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mhpq-9638-x6pw", + "modified": "2023-12-20T20:31:57Z", + "published": "2023-12-20T20:31:57Z", + "aliases": [ + + ], + "summary": "Denial of service when decrypting attack controlled input in github.com/dvsekhvalnov/jose2go", + "details": "An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/dvsekhvalnov/jose2go" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.1-0.20231206184617-48ba0b76bc88" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dvsekhvalnov/jose2go/issues/31" + }, + { + "type": "WEB", + "url": "https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dvsekhvalnov/jose2go" + }, + { + "type": "WEB", + "url": "https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:31:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json b/advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json deleted file mode 100644 index 6807defa0c1..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-83q5-whqp-r8jr/GHSA-83q5-whqp-r8jr.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-83q5-whqp-r8jr", - "modified": "2023-12-20T09:30:26Z", - "published": "2023-12-20T09:30:26Z", - "aliases": [ - "CVE-2023-37544" - ], - "details": "Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.\n\nThis issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.\n\nThe known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.\n\n2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.\n2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.\n3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.\n3.1 Pulsar WebSocket Proxy users are unaffected.\nAny users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37544" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2023/12/20/2" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-287" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-20T09:15:07Z" - } -} \ No newline at end of file