diff --git a/advisories/unreviewed/2024/08/GHSA-2p5q-hvc3-c85p/GHSA-2p5q-hvc3-c85p.json b/advisories/unreviewed/2024/08/GHSA-2p5q-hvc3-c85p/GHSA-2p5q-hvc3-c85p.json new file mode 100644 index 00000000000..90287fc47af --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-2p5q-hvc3-c85p/GHSA-2p5q-hvc3-c85p.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2p5q-hvc3-c85p", + "modified": "2024-08-07T09:31:08Z", + "published": "2024-08-07T09:31:08Z", + "aliases": [ + "CVE-2024-42222" + ], + "details": "In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data.\n\nAffected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42222" + }, + { + "type": "WEB", + "url": "https://github.com/apache/cloudstack/issues/9456" + }, + { + "type": "WEB", + "url": "https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj" + }, + { + "type": "WEB", + "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T08:16:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-c2m5-cmpw-rjcx/GHSA-c2m5-cmpw-rjcx.json b/advisories/unreviewed/2024/08/GHSA-c2m5-cmpw-rjcx/GHSA-c2m5-cmpw-rjcx.json new file mode 100644 index 00000000000..9ff5b13c0c9 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-c2m5-cmpw-rjcx/GHSA-c2m5-cmpw-rjcx.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c2m5-cmpw-rjcx", + "modified": "2024-08-07T09:31:08Z", + "published": "2024-08-07T09:31:08Z", + "aliases": [ + "CVE-2024-5290" + ], + "details": "An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).\n\n\n\n\nMembership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5290" + }, + { + "type": "WEB", + "url": "https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613" + }, + { + "type": "WEB", + "url": "https://ubuntu.com/security/notices/USN-6945-1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T09:16:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-wrfv-q4v6-cw3x/GHSA-wrfv-q4v6-cw3x.json b/advisories/unreviewed/2024/08/GHSA-wrfv-q4v6-cw3x/GHSA-wrfv-q4v6-cw3x.json new file mode 100644 index 00000000000..68babb819e7 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-wrfv-q4v6-cw3x/GHSA-wrfv-q4v6-cw3x.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wrfv-q4v6-cw3x", + "modified": "2024-08-07T09:31:08Z", + "published": "2024-08-07T09:31:08Z", + "aliases": [ + "CVE-2024-42062" + ], + "details": "CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure.\n\nUsers are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42062" + }, + { + "type": "WEB", + "url": "https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj" + }, + { + "type": "WEB", + "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T08:16:12Z" + } +} \ No newline at end of file