netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7gf7-7wx4-mxmw
GHSA-r4v4-3jj7-jc29
GHSA-7gf7-7wx4-mxmw
GHSA-r4v4-3jj7-jc29
This commit is contained in:
advisory-database[bot]
2024-05-02 13:14:57 +00:00
parent 152c64beb4
commit 4bdb79b32f
4 changed files with 236 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json
+85
View File
@@ -0,0 +1,85 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7gf7-7wx4-mxmw",
"modified": "2024-05-02T13:14:02Z",
"published": "2022-04-21T01:57:44Z",
"aliases": [
"CVE-2010-4237"
],
"summary": "Mercurial Improper Certificate Validation vulnerability",
"details": "Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mercurial"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4237"
},
{
"type": "WEB",
"url": "https://github.com/dscho/hg/commit/4ea63fb25ceeeaaa4cd1026f733b7ea7672c30b3"
},
{
"type": "WEB",
"url": "https://github.com/dscho/hg/commit/89baabf4fb7abf30ef6fdcf3d455a7893e5cc145"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237"
},
{
"type": "WEB",
"url": "https://bz.mercurial-scm.org/show_bug.cgi?id=2407"
},
{
"type": "WEB",
"url": "https://repo.mercurial-scm.org/hg/rev/6ab4a7d3c179"
},
{
"type": "WEB",
"url": "https://repo.mercurial-scm.org/hg/rev/f2937d6492c5"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-4237"
}
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-05-02T13:14:02Z",
"nvd_published_at": "2019-10-29T19:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json
+151
View File
@@ -0,0 +1,151 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4v4-3jj7-jc29",
"modified": "2024-05-02T13:13:03Z",
"published": "2022-05-24T16:58:03Z",
"aliases": [
"CVE-2019-17134"
],
"summary": "OpenStack Octavia Amphora-Agent not requiring Client-Certificate",
"details": "Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the `cmd/agent.py` gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "octavia"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.10.0"
},
{
"fixed": "2.1.2"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "octavia"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.0"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "octavia"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17134"
},
{
"type": "WEB",
"url": "https://github.com/openstack/octavia/commit/1725517d1d209f26b2275306d83e49c099dcbe1a"
},
{
"type": "WEB",
"url": "https://github.com/openstack/octavia/commit/2976a7f0f109e17930db8a61136526ead44ea7e5"
},
{
"type": "WEB",
"url": "https://github.com/openstack/octavia/commit/624ff08f27bcb73788663cbe6d35cbe29c537844"
},
{
"type": "WEB",
"url": "https://github.com/openstack/octavia/commit/89a2f6e0136ad49d928eb65b4cf555af2a2b8ab1"
},
{
"type": "WEB",
"url": "https://github.com/openstack/octavia/commit/b0c2cd7b4c835c391cfedf12cf9f9ff8a0aabd17"
},
{
"type": "WEB",
"url": "https://github.com/openstack/octavia/commit/c2fdffc3b748f8007c72e52df257e38756923b40"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/octavia"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686541"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686543"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686544"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686545"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686546"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686547"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2019-005.html"
},
{
"type": "WEB",
"url": "https://storyboard.openstack.org/#!/story/2006660"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-05-02T13:13:02Z",
"nvd_published_at": "2019-10-08T18:15:00Z"
}
}
advisories/unreviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json
-47
View File
@@ -1,47 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7gf7-7wx4-mxmw",
"modified": "2022-04-21T01:57:44Z",
"published": "2022-04-21T01:57:44Z",
"aliases": [
"CVE-2010-4237"
],
"details": "Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4237"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237"
},
{
"type": "WEB",
"url": "https://bz.mercurial-scm.org/show_bug.cgi?id=2407"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-4237"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-29T19:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json
-63
View File
@@ -1,63 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4v4-3jj7-jc29",
"modified": "2022-05-24T16:58:03Z",
"published": "2022-05-24T16:58:03Z",
"aliases": [
"CVE-2019-17134"
],
"details": "Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17134"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686541"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686543"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686544"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686545"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686546"
},
{
"type": "WEB",
"url": "https://review.opendev.org/686547"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2019-005.html"
},
{
"type": "WEB",
"url": "https://storyboard.openstack.org/#!/story/2006660"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-08T18:15:00Z"
}
}