Publish Advisories

GHSA-39vm-p9mr-4r27
GHSA-5x6q-ffwj-8vcf

advisories/github-reviewed/2022/05/GHSA-39vm-p9mr-4r27/GHSA-39vm-p9mr-4r27.json

@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-39vm-p9mr-4r27",
-  "modified": "2022-05-17T05:22:19Z",
+  "modified": "2024-05-01T10:58:46Z",
   "published": "2022-05-17T05:22:19Z",
   "aliases": [
     "CVE-2012-3458"
   ],
+  "summary": "Beaker Sensitive Information Disclosure vulnerability",
   "details": "Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "beaker"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.6.4"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -27,12 +46,16 @@
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=809267"
     },
     {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/50226"
+      "type": "PACKAGE",
+      "url": "https://github.com/bbangert/beaker"
     },
     {
       "type": "WEB",
-      "url": "http://secunia.com/advisories/50520"
+      "url": "https://web.archive.org/web/20140724164516/http://secunia.com/advisories/50226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20140725025612/http://secunia.com/advisories/50520"
     },
     {
       "type": "WEB",
@@ -48,8 +71,8 @@
 
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-01T10:58:46Z",
     "nvd_published_at": "2012-09-15T17:55:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-5x6q-ffwj-8vcf/GHSA-5x6q-ffwj-8vcf.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5x6q-ffwj-8vcf",
-  "modified": "2022-05-17T01:57:32Z",
+  "modified": "2024-05-01T10:59:36Z",
   "published": "2022-05-17T01:57:32Z",
   "aliases": [
     "CVE-2015-4082"
   ],
+  "summary": "attic has improper verification of unencrypted backups",
   "details": "attic before 0.15 does not confirm unencrypted backups with the user, which allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by changing the manifest type byte of the repository to \"unencrypted / without key file\".",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "attic"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.15"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -30,12 +49,16 @@
       "url": "https://github.com/jborg/attic/commit/78f9ad1faba7193ca7f0acccbc13b1ff6ebf9072"
     },
     {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2015/05/31/3"
+      "type": "PACKAGE",
+      "url": "https://github.com/jborg/attic"
     },
     {
       "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/74821"
+      "url": "https://web.archive.org/web/20200517225455/http://www.securityfocus.com/bid/74821"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2015/05/31/3"
     }
   ],
   "database_specific": {
@@ -43,8 +66,8 @@
 
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-01T10:59:36Z",
     "nvd_published_at": "2017-08-18T16:29:00Z"
   }
 }