From 4bdb79b32f7a46db6767b0e6a87563bbd9ee1c2a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 2 May 2024 13:14:57 +0000 Subject: [PATCH] Publish Advisories GHSA-7gf7-7wx4-mxmw GHSA-r4v4-3jj7-jc29 GHSA-7gf7-7wx4-mxmw GHSA-r4v4-3jj7-jc29 --- .../GHSA-7gf7-7wx4-mxmw.json | 85 ++++++++++ .../GHSA-r4v4-3jj7-jc29.json | 151 ++++++++++++++++++ .../GHSA-7gf7-7wx4-mxmw.json | 47 ------ .../GHSA-r4v4-3jj7-jc29.json | 63 -------- 4 files changed, 236 insertions(+), 110 deletions(-) create mode 100644 advisories/github-reviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json delete mode 100644 advisories/unreviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json diff --git a/advisories/github-reviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json b/advisories/github-reviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json new file mode 100644 index 00000000000..c90a4bfe9b5 --- /dev/null +++ b/advisories/github-reviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7gf7-7wx4-mxmw", + "modified": "2024-05-02T13:14:02Z", + "published": "2022-04-21T01:57:44Z", + "aliases": [ + "CVE-2010-4237" + ], + "summary": "Mercurial Improper Certificate Validation vulnerability", + "details": "Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "mercurial" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4237" + }, + { + "type": "WEB", + "url": "https://github.com/dscho/hg/commit/4ea63fb25ceeeaaa4cd1026f733b7ea7672c30b3" + }, + { + "type": "WEB", + "url": "https://github.com/dscho/hg/commit/89baabf4fb7abf30ef6fdcf3d455a7893e5cc145" + }, + { + "type": "WEB", + "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237" + }, + { + "type": "WEB", + "url": "https://bz.mercurial-scm.org/show_bug.cgi?id=2407" + }, + { + "type": "WEB", + "url": "https://repo.mercurial-scm.org/hg/rev/6ab4a7d3c179" + }, + { + "type": "WEB", + "url": "https://repo.mercurial-scm.org/hg/rev/f2937d6492c5" + }, + { + "type": "WEB", + "url": "https://security-tracker.debian.org/tracker/CVE-2010-4237" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-295" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-05-02T13:14:02Z", + "nvd_published_at": "2019-10-29T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json b/advisories/github-reviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json new file mode 100644 index 00000000000..75097a6fcd4 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json @@ -0,0 +1,151 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4v4-3jj7-jc29", + "modified": "2024-05-02T13:13:03Z", + "published": "2022-05-24T16:58:03Z", + "aliases": [ + "CVE-2019-17134" + ], + "summary": "OpenStack Octavia Amphora-Agent not requiring Client-Certificate", + "details": "Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the `cmd/agent.py` gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "octavia" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.10.0" + }, + { + "fixed": "2.1.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "octavia" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.2.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "octavia" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17134" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/octavia/commit/1725517d1d209f26b2275306d83e49c099dcbe1a" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/octavia/commit/2976a7f0f109e17930db8a61136526ead44ea7e5" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/octavia/commit/624ff08f27bcb73788663cbe6d35cbe29c537844" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/octavia/commit/89a2f6e0136ad49d928eb65b4cf555af2a2b8ab1" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/octavia/commit/b0c2cd7b4c835c391cfedf12cf9f9ff8a0aabd17" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/octavia/commit/c2fdffc3b748f8007c72e52df257e38756923b40" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/octavia" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/686541" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/686543" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/686544" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/686545" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/686546" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/686547" + }, + { + "type": "WEB", + "url": "https://security.openstack.org/ossa/OSSA-2019-005.html" + }, + { + "type": "WEB", + "url": "https://storyboard.openstack.org/#!/story/2006660" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-05-02T13:13:02Z", + "nvd_published_at": "2019-10-08T18:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json b/advisories/unreviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json deleted file mode 100644 index f2e17c8b5ee..00000000000 --- a/advisories/unreviewed/2022/04/GHSA-7gf7-7wx4-mxmw/GHSA-7gf7-7wx4-mxmw.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7gf7-7wx4-mxmw", - "modified": "2022-04-21T01:57:44Z", - "published": "2022-04-21T01:57:44Z", - "aliases": [ - "CVE-2010-4237" - ], - "details": "Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4237" - }, - { - "type": "WEB", - "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237" - }, - { - "type": "WEB", - "url": "https://bz.mercurial-scm.org/show_bug.cgi?id=2407" - }, - { - "type": "WEB", - "url": "https://security-tracker.debian.org/tracker/CVE-2010-4237" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-10-29T19:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json b/advisories/unreviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json deleted file mode 100644 index 5d87eabcde0..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-r4v4-3jj7-jc29/GHSA-r4v4-3jj7-jc29.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-r4v4-3jj7-jc29", - "modified": "2022-05-24T16:58:03Z", - "published": "2022-05-24T16:58:03Z", - "aliases": [ - "CVE-2019-17134" - ], - "details": "Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17134" - }, - { - "type": "WEB", - "url": "https://review.opendev.org/686541" - }, - { - "type": "WEB", - "url": "https://review.opendev.org/686543" - }, - { - "type": "WEB", - "url": "https://review.opendev.org/686544" - }, - { - "type": "WEB", - "url": "https://review.opendev.org/686545" - }, - { - "type": "WEB", - "url": "https://review.opendev.org/686546" - }, - { - "type": "WEB", - "url": "https://review.opendev.org/686547" - }, - { - "type": "WEB", - "url": "https://security.openstack.org/ossa/OSSA-2019-005.html" - }, - { - "type": "WEB", - "url": "https://storyboard.openstack.org/#!/story/2006660" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-10-08T18:15:00Z" - } -} \ No newline at end of file