diff --git a/advisories/unreviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json b/advisories/github-reviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json rename to advisories/github-reviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json index d2f19baf564..eee2492c6b6 100644 --- a/advisories/unreviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json +++ b/advisories/github-reviewed/2022/05/GHSA-22q6-wwq7-2jj9/GHSA-22q6-wwq7-2jj9.json @@ -1,17 +1,36 @@ { "schema_version": "1.3.0", "id": "GHSA-22q6-wwq7-2jj9", - "modified": "2022-05-17T04:56:52Z", + "modified": "2023-02-08T18:06:23Z", "published": "2022-05-17T04:56:52Z", "aliases": [ "CVE-2013-1865" ], + "summary": "OpenStack Keystone Improper Authentication vulnerability", "details": "OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2012.2" + }, + { + "fixed": "2012.2.4" + } + ] + } + ] + } ], "references": [ { @@ -34,10 +53,26 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=922230" }, + { + "type": "PACKAGE", + "url": "https://opendev.org/openstack/keystone" + }, { "type": "WEB", "url": "https://review.openstack.org/#/c/24906/" }, + { + "type": "WEB", + "url": "https://review.openstack.org/24906" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20170715155558/http://www.securityfocus.com/bid/58616" + }, + { + "type": "WEB", + "url": "http://github.com/openstack/keystone/commit/255b1d43500f5d98ec73a0056525b492b14fec05" + }, { "type": "WEB", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101719.html" @@ -46,26 +81,14 @@ "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00000.html" }, - { - "type": "WEB", - "url": "http://osvdb.org/91532" - }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0708.html" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/52657" - }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2013/03/20/13" }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/58616" - }, { "type": "WEB", "url": "http://www.ubuntu.com/usn/USN-1772-1" @@ -76,8 +99,8 @@ "CWE-287" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:06:23Z", "nvd_published_at": "2013-03-22T21:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json b/advisories/github-reviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json similarity index 75% rename from advisories/unreviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json rename to advisories/github-reviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json index 16a680e2152..bde316b0a34 100644 --- a/advisories/unreviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json +++ b/advisories/github-reviewed/2022/05/GHSA-mf98-r2gf-2x3w/GHSA-mf98-r2gf-2x3w.json @@ -1,17 +1,36 @@ { "schema_version": "1.3.0", "id": "GHSA-mf98-r2gf-2x3w", - "modified": "2022-05-14T01:58:49Z", + "modified": "2023-02-08T18:06:46Z", "published": "2022-05-14T01:58:49Z", "aliases": [ "CVE-2012-4456" ], + "summary": "OpenStack Keystone Improper Authentication vulnerability", "details": "The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "keystone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2012.1" + }, + { + "fixed": "2012.1.2" + } + ] + } + ] + } ], "references": [ { @@ -58,21 +77,21 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78944" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/keystone" + }, { "type": "WEB", "url": "https://lists.launchpad.net/openstack/msg17034.html" }, { "type": "WEB", - "url": "http://secunia.com/advisories/50665" + "url": "https://web.archive.org/web/20121114024512/http://www.securityfocus.com/bid/55716" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2012/09/28/5" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/55716" } ], "database_specific": { @@ -80,8 +99,8 @@ "CWE-287" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:06:46Z", "nvd_published_at": "2012-10-09T15:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json b/advisories/github-reviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json rename to advisories/github-reviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json index 5fcb26e8b87..2b272622bf6 100644 --- a/advisories/unreviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json +++ b/advisories/github-reviewed/2022/05/GHSA-vmhj-p9hw-vgrf/GHSA-vmhj-p9hw-vgrf.json @@ -1,12 +1,13 @@ { "schema_version": "1.3.0", "id": "GHSA-vmhj-p9hw-vgrf", - "modified": "2023-02-02T21:33:40Z", + "modified": "2023-02-08T18:07:43Z", "published": "2022-05-24T17:08:34Z", "aliases": [ "CVE-2020-1726" ], - "details": "A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.", + "summary": "Podman has Files or Directories Accessible to External Parties", + "details": "A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume. This issue was introduced in version 1.6.0.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/containers/podman" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.6.0" + }, + { + "fixed": "2.0.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/containers/podman/v2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.6" + } + ] + } + ] + } ], "references": [ { @@ -41,6 +79,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726" }, + { + "type": "PACKAGE", + "url": "https://github.com/containers/podman" + }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html" @@ -55,8 +97,8 @@ "CWE-552" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:07:43Z", "nvd_published_at": "2020-02-11T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json b/advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json new file mode 100644 index 00000000000..ae99e929083 --- /dev/null +++ b/advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-r887-gfxh-m9rr", + "modified": "2023-02-08T18:07:16Z", + "published": "2023-02-08T18:07:16Z", + "aliases": [ + + ], + "summary": "mrpack-install vulnerable to path traversal with dependency", + "details": "### Impact\nImporting a malicious `.mrpack` file can cause path traversal while downloading files.\nThis can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.\n\n### Patches\nNo patches yet.\n\n### Workarounds\nAvoid importing `.mrpack` files from untrusted sources.\n\n### References\nhttps://docs.modrinth.com/docs/modpacks/format_definition/#files\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/nothub/mrpack-install" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.16.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 0.16.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr" + }, + { + "type": "WEB", + "url": "https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nothub/mrpack-install" + }, + { + "type": "WEB", + "url": "https://github.com/nothub/mrpack-install/releases/tag/v0.16.3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:07:16Z", + "nvd_published_at": null + } +} \ No newline at end of file