netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-22q6-wwq7-2jj9
GHSA-mf98-r2gf-2x3w
GHSA-vmhj-p9hw-vgrf
GHSA-r887-gfxh-m9rr
This commit is contained in:
advisory-database[bot]
2023-02-08 18:08:30 +00:00
parent 2396fd1ee6
commit 464bc343a0
4 changed files with 182 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json → advisories/github-reviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json
+39 -16
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.3.0",
"id": "GHSA-22q6-wwq7-2jj9",
"modified": "2022-05-17T04:56:52Z",
"modified": "2023-02-08T18:06:23Z",
"published": "2022-05-17T04:56:52Z",
"aliases": [
"CVE-2013-1865"
],
"summary": "OpenStack Keystone Improper Authentication vulnerability",
"details": "OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2012.2"
},
{
"fixed": "2012.2.4"
}
]
}
]
}
],
"references": [
{
@@ -34,10 +53,26 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=922230"
},
{
"type": "PACKAGE",
"url": "https://opendev.org/openstack/keystone"
},
{
"type": "WEB",
"url": "https://review.openstack.org/#/c/24906/"
},
{
"type": "WEB",
"url": "https://review.openstack.org/24906"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170715155558/http://www.securityfocus.com/bid/58616"
},
{
"type": "WEB",
"url": "http://github.com/openstack/keystone/commit/255b1d43500f5d98ec73a0056525b492b14fec05"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101719.html"
@@ -46,26 +81,14 @@
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00000.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/91532"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0708.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/52657"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/03/20/13"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/58616"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1772-1"
@@ -76,8 +99,8 @@
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:06:23Z",
"nvd_published_at": "2013-03-22T21:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json → advisories/github-reviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json
+28 -9
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.3.0",
"id": "GHSA-mf98-r2gf-2x3w",
"modified": "2022-05-14T01:58:49Z",
"modified": "2023-02-08T18:06:46Z",
"published": "2022-05-14T01:58:49Z",
"aliases": [
"CVE-2012-4456"
],
"summary": "OpenStack Keystone Improper Authentication vulnerability",
"details": "The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2012.1"
},
{
"fixed": "2012.1.2"
}
]
}
]
}
],
"references": [
{
@@ -58,21 +77,21 @@
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78944"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "https://lists.launchpad.net/openstack/msg17034.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/50665"
"url": "https://web.archive.org/web/20121114024512/http://www.securityfocus.com/bid/55716"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/09/28/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/55716"
}
],
"database_specific": {
@@ -80,8 +99,8 @@
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:06:46Z",
"nvd_published_at": "2012-10-09T15:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json → advisories/github-reviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json
+47 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.3.0",
"id": "GHSA-vmhj-p9hw-vgrf",
"modified": "2023-02-02T21:33:40Z",
"modified": "2023-02-08T18:07:43Z",
"published": "2022-05-24T17:08:34Z",
"aliases": [
"CVE-2020-1726"
],
"details": "A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.",
"summary": "Podman has Files or Directories Accessible to External Parties",
"details": "A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume. This issue was introduced in version 1.6.0.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,44 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "2.0.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v2"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.6"
}
]
}
]
}
],
"references": [
{
@@ -41,6 +79,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726"
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/podman"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html"
@@ -55,8 +97,8 @@
"CWE-552"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:07:43Z",
"nvd_published_at": "2020-02-11T20:15:00Z"
}
}
advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json
+68
View File
@@ -0,0 +1,68 @@
{
"schema_version": "1.3.0",
"id": "GHSA-r887-gfxh-m9rr",
"modified": "2023-02-08T18:07:16Z",
"published": "2023-02-08T18:07:16Z",
"aliases": [
],
"summary": "mrpack-install vulnerable to path traversal with dependency",
"details": "### Impact\nImporting a malicious `.mrpack` file can cause path traversal while downloading files.\nThis can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.\n\n### Patches\nNo patches yet.\n\n### Workarounds\nAvoid importing `.mrpack` files from untrusted sources.\n\n### References\nhttps://docs.modrinth.com/docs/modpacks/format_definition/#files\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/nothub/mrpack-install"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16.3"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.16.2"
}
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr"
},
{
"type": "WEB",
"url": "https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c"
},
{
"type": "PACKAGE",
"url": "https://github.com/nothub/mrpack-install"
},
{
"type": "WEB",
"url": "https://github.com/nothub/mrpack-install/releases/tag/v0.16.3"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:07:16Z",
"nvd_published_at": null
}
}