From 4542b49c5d3fee91bc5438bc0657bbff8a9bb18c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 22:36:56 +0000 Subject: [PATCH] Publish Advisories GHSA-477r-v22q-r42f GHSA-63cj-3r94-234v GHSA-687x-269m-7cv9 GHSA-9c2p-99pg-c4j9 GHSA-gwxm-wqpq-w539 GHSA-jfj9-7j5w-6xgx --- .../GHSA-477r-v22q-r42f.json | 30 ++++++++++++++++--- .../GHSA-63cj-3r94-234v.json | 30 ++++++++++++++++--- .../GHSA-687x-269m-7cv9.json | 30 ++++++++++++++++--- .../GHSA-9c2p-99pg-c4j9.json | 30 ++++++++++++++++--- .../GHSA-gwxm-wqpq-w539.json | 30 ++++++++++++++++--- .../GHSA-jfj9-7j5w-6xgx.json | 27 ++++++++++++++--- 6 files changed, 153 insertions(+), 24 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json (61%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json (61%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json (64%) diff --git a/advisories/unreviewed/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json b/advisories/github-reviewed/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json rename to advisories/github-reviewed/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json index 86928b37a63..aa4f8c11184 100644 --- a/advisories/unreviewed/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json +++ b/advisories/github-reviewed/2022/05/GHSA-477r-v22q-r42f/GHSA-477r-v22q-r42f.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-477r-v22q-r42f", - "modified": "2022-05-17T00:29:00Z", + "modified": "2024-01-30T22:36:17Z", "published": "2022-05-17T00:29:00Z", "aliases": [ "CVE-2017-1000088" ], + "summary": "Persisted XSS Vulnerability in Jenkins Sidebar Link Plugin", "details": "The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input validation, which meant users were able to use javascript: schemes for these links.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:sidebar-link" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.9" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.8" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:36:17Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json b/advisories/github-reviewed/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json rename to advisories/github-reviewed/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json index 8e73006e701..4664c21993c 100644 --- a/advisories/unreviewed/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json +++ b/advisories/github-reviewed/2022/05/GHSA-63cj-3r94-234v/GHSA-63cj-3r94-234v.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-63cj-3r94-234v", - "modified": "2022-05-17T00:29:01Z", + "modified": "2024-01-30T22:36:03Z", "published": "2022-05-17T00:29:01Z", "aliases": [ "CVE-2017-1000103" ], + "summary": "Persistent XSS vulnerability in Jenkins DRY Plugin", "details": "The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:dry" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.49" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.48" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:36:03Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json b/advisories/github-reviewed/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json rename to advisories/github-reviewed/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json index c867901448f..a86ce0ba5b5 100644 --- a/advisories/unreviewed/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json +++ b/advisories/github-reviewed/2022/05/GHSA-687x-269m-7cv9/GHSA-687x-269m-7cv9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-687x-269m-7cv9", - "modified": "2022-05-14T03:46:09Z", + "modified": "2024-01-30T22:36:26Z", "published": "2022-05-14T03:46:09Z", "aliases": [ "CVE-2018-1000008" ], + "summary": "XXE vulnerability in Jenkins PMD Plugin", "details": "Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:pmd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.50" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.49" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-611" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:36:26Z", "nvd_published_at": "2018-01-23T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json b/advisories/github-reviewed/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json rename to advisories/github-reviewed/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json index 481d84ddfd3..e85db698f82 100644 --- a/advisories/unreviewed/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json +++ b/advisories/github-reviewed/2022/05/GHSA-9c2p-99pg-c4j9/GHSA-9c2p-99pg-c4j9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9c2p-99pg-c4j9", - "modified": "2022-05-17T00:29:01Z", + "modified": "2024-01-30T22:35:50Z", "published": "2022-05-17T00:29:01Z", "aliases": [ "CVE-2017-1000102" ], + "summary": "Persistent XSS vulnerability in Static Analysis Utilities", "details": "The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:analysis-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.92" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.91" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:35:50Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json b/advisories/github-reviewed/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json rename to advisories/github-reviewed/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json index 2430300a024..5b116b69c1a 100644 --- a/advisories/unreviewed/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json +++ b/advisories/github-reviewed/2022/05/GHSA-gwxm-wqpq-w539/GHSA-gwxm-wqpq-w539.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gwxm-wqpq-w539", - "modified": "2022-05-14T03:18:40Z", + "modified": "2024-01-30T22:35:37Z", "published": "2022-05-14T03:18:39Z", "aliases": [ "CVE-2018-1000176" ], + "summary": "Jenkins Email Extension Plugin showed plain text SMTP password in configuration form field", "details": "An exposure of sensitive information vulnerability exists in Jenkins Email Extension Plugin 2.61 and older in src/main/resources/hudson/plugins/emailext/ExtendedEmailPublisher/global.groovy and ExtendedEmailPublisherDescriptor.java that allows attackers with control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured SMTP password.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:email-ext" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.62" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.61" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:35:37Z", "nvd_published_at": "2018-05-08T15:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json b/advisories/github-reviewed/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json rename to advisories/github-reviewed/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json index ae92a7bbbe3..15b43bb6b87 100644 --- a/advisories/unreviewed/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json +++ b/advisories/github-reviewed/2022/05/GHSA-jfj9-7j5w-6xgx/GHSA-jfj9-7j5w-6xgx.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-jfj9-7j5w-6xgx", - "modified": "2022-05-14T03:46:09Z", + "modified": "2024-01-30T22:36:33Z", "published": "2022-05-14T03:46:09Z", "aliases": [ "CVE-2018-1000009" ], + "summary": "XXE vulnerability in Jenkins Checkstyle Plugin", "details": "Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jvnet.hudson.plugins:checkstyle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.50" + } + ] + } + ] + } ], "references": [ { @@ -31,8 +50,8 @@ "CWE-611" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:36:33Z", "nvd_published_at": "2018-01-23T14:29:00Z" } } \ No newline at end of file