netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4225-97pr-rr52
GHSA-r7j4-82xw-8m9p
GHSA-4225-97pr-rr52
This commit is contained in:
advisory-database[bot]
2024-05-14 17:23:38 +00:00
parent 4df5245c26
commit 4b6e34bee2
3 changed files with 176 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-4225-97pr-rr52/GHSA-4225-97pr-rr52.json
+142
View File
@@ -0,0 +1,142 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4225-97pr-rr52",
"modified": "2024-05-14T17:21:32Z",
"published": "2022-05-24T19:10:15Z",
"aliases": [
"CVE-2021-38155"
],
"summary": "OpenStack Keystone allows information disclosure during account locking",
"details": "OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0"
},
{
"fixed": "16.0.2"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "17.0"
},
{
"fixed": "17.0.1"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "18.0"
},
{
"fixed": "18.0.1"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "keystone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "19.0"
},
{
"fixed": "19.0.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38155"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/1b573ae7d1c20e0ebfbde79bbe7538a09589c75d"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/8ab4eb27be4c13c9bab2b3ea700f00a190521bf8"
},
{
"type": "WEB",
"url": "https://github.com/openstack/keystone/commit/ac2631ae33445877094cdae796fbcdce8833a626"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/keystone"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/1688137"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2021-003.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/08/10/5"
}
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T17:21:32Z",
"nvd_published_at": "2021-08-06T21:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json → advisories/github-reviewed/2022/05/GHSA-r7j4-82xw-8m9p/GHSA-r7j4-82xw-8m9p.json
+34 -4
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r7j4-82xw-8m9p",
"modified": "2022-05-01T07:16:48Z",
"modified": "2024-05-14T17:22:00Z",
"published": "2022-05-01T07:16:48Z",
"aliases": [
"CVE-2006-4249"
],
"summary": "Plone allows a user to masquerade as a group",
"details": "Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to \"masquerade as a group.\"",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5"
},
{
"fixed": "2.5.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.5.1"
}
}
],
"references": [
{
@@ -22,10 +44,18 @@
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30762"
},
{
"type": "PACKAGE",
"url": "https://github.com/plone/Plone"
},
{
"type": "WEB",
"url": "http://plone.org/about/security/advisories/cve-2006-4249"
},
{
"type": "WEB",
"url": "http://plone.org/products/plone-hotfix/releases/20061031"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/23240"
@@ -44,8 +74,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T17:22:00Z",
"nvd_published_at": "2006-12-07T23:28:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-4225-97pr-rr52/GHSA-4225-97pr-rr52.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4225-97pr-rr52",
"modified": "2022-05-24T19:10:15Z",
"published": "2022-05-24T19:10:15Z",
"aliases": [
"CVE-2021-38155"
],
"details": "OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38155"
},
{
"type": "WEB",
"url": "https://launchpad.net/bugs/1688137"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2021-003.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/08/10/5"
}
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T21:15:00Z"
}
}