diff --git a/advisories/unreviewed/2024/08/GHSA-f6cj-4h3g-hwq4/GHSA-f6cj-4h3g-hwq4.json b/advisories/github-reviewed/2024/08/GHSA-f6cj-4h3g-hwq4/GHSA-f6cj-4h3g-hwq4.json similarity index 56% rename from advisories/unreviewed/2024/08/GHSA-f6cj-4h3g-hwq4/GHSA-f6cj-4h3g-hwq4.json rename to advisories/github-reviewed/2024/08/GHSA-f6cj-4h3g-hwq4/GHSA-f6cj-4h3g-hwq4.json index a895a0828ed..e4cd45efcb6 100644 --- a/advisories/unreviewed/2024/08/GHSA-f6cj-4h3g-hwq4/GHSA-f6cj-4h3g-hwq4.json +++ b/advisories/github-reviewed/2024/08/GHSA-f6cj-4h3g-hwq4/GHSA-f6cj-4h3g-hwq4.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-f6cj-4h3g-hwq4", - "modified": "2024-08-03T18:30:33Z", + "modified": "2024-08-05T14:40:19Z", "published": "2024-08-03T18:30:33Z", "aliases": [ "CVE-2024-37286" ], + "summary": "APM Server vulnerable to Insertion of Sensitive Information into Log File", "details": "APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/elastic/apm-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.14.0" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +47,10 @@ { "type": "WEB", "url": "https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-19/364289" + }, + { + "type": "PACKAGE", + "url": "https://github.com/elastic/apm-server" } ], "database_specific": { @@ -31,8 +58,8 @@ "CWE-532" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T14:40:19Z", "nvd_published_at": "2024-08-03T16:15:49Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-w9pg-7c3h-fc8j/GHSA-w9pg-7c3h-fc8j.json b/advisories/github-reviewed/2024/08/GHSA-w9pg-7c3h-fc8j/GHSA-w9pg-7c3h-fc8j.json new file mode 100644 index 00000000000..5abeee1cc1a --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-w9pg-7c3h-fc8j/GHSA-w9pg-7c3h-fc8j.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9pg-7c3h-fc8j", + "modified": "2024-08-05T14:39:09Z", + "published": "2024-08-05T14:39:09Z", + "aliases": [ + "CVE-2024-41811" + ], + "summary": "ipl/web's `ipl\\Web\\Common\\CsrfCounterMeasure` is susceptible to CSRF", + "details": "### Impact\nSome of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. (CSRF)\n\nAffected products:\n\n* Icinga Web (>=2.12.0)\n* Icinga DB Web (>=1.0.0)\n* Icinga Notifications Web (>=0.1.0)\n* Icinga Web JIRA Integration (>=1.3.0)\n\nAll affected products, in any version, will be unaffected by this once `icinga-php-library` is upgraded.\n\n### Patches\nVersion 0.10.1 will include a fix for this. It will be published as part of the `icinga-php-library` v0.14.1 release.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "ipl/web" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.10.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Icinga/ipl-web/security/advisories/GHSA-w9pg-7c3h-fc8j" + }, + { + "type": "WEB", + "url": "https://github.com/Icinga/ipl-web/commit/492336fdb57a5bb0881ed642ab36f5841337571e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Icinga/ipl-web" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T14:39:09Z", + "nvd_published_at": null + } +} \ No newline at end of file