Publish Advisories

GHSA-cgmm-c2m9-ff7r
GHSA-4fh7-m2wx-6wfm
GHSA-4grw-m28r-q285
GHSA-9rmp-2568-59rv
GHSA-gw5w-5j7f-jmjj
GHSA-vxcf-c7mx-pg53

advisories/github-reviewed/2023/06/GHSA-cgmm-c2m9-ff7r/GHSA-cgmm-c2m9-ff7r.json

@@ -50,7 +50,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-94"
+    ],
     "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2023-06-29T15:02:49Z",

advisories/github-reviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4fh7-m2wx-6wfm",
-  "modified": "2024-12-04T22:37:05Z",
+  "modified": "2024-12-05T19:06:20Z",
   "published": "2024-12-04T21:30:52Z",
   "aliases": [
     "CVE-2024-51210"
@@ -9,6 +9,10 @@
   "summary": "Firepad allows insecure document access",
   "details": "Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
   "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
     {
       "type": "CVSS_V4",
       "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
@@ -59,6 +63,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-125",
       "CWE-200"
     ],
     "severity": "LOW",

advisories/github-reviewed/2024/12/GHSA-4grw-m28r-q285/GHSA-4grw-m28r-q285.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4grw-m28r-q285",
-  "modified": "2024-12-05T17:31:35Z",
+  "modified": "2024-12-05T19:05:49Z",
   "published": "2024-12-05T17:31:35Z",
   "aliases": [
     "CVE-2024-53857"
@@ -44,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53857"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/rpgp/rpgp"
@@ -56,6 +60,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-12-05T17:31:35Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-12-05T16:15:26Z"
   }
 }

advisories/github-reviewed/2024/12/GHSA-9rmp-2568-59rv/GHSA-9rmp-2568-59rv.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9rmp-2568-59rv",
-  "modified": "2024-12-05T17:30:52Z",
+  "modified": "2024-12-05T19:05:47Z",
   "published": "2024-12-05T17:30:52Z",
   "aliases": [
     "CVE-2024-53856"
@@ -44,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53856"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/rpgp/rpgp"
@@ -58,6 +62,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-12-05T17:30:52Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-12-05T16:15:26Z"
   }
 }

advisories/github-reviewed/2024/12/GHSA-gw5w-5j7f-jmjj/GHSA-gw5w-5j7f-jmjj.json

@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gw5w-5j7f-jmjj",
+  "modified": "2024-12-05T19:05:57Z",
+  "published": "2024-12-05T19:05:57Z",
+  "aliases": [],
+  "summary": "Unsound usages of `std::slice::from_raw_parts` ",
+  "details": "The library breaks the safety assumptions when using unsafe API `std::slice::from_raw_parts`. First, when using the API in iterator implementation (`TempFdArrayIterator.next`), generic type could be any type, which would create and pass a misaligned pointer to the unsafe API. Second, when validating the address, the code passed the type `c_void`, which could also be any type, leading to potential uninitialized memory exposure.  \n\nTwo unsound usages here highlight the necessity for developers to perform type checks before doing type conversion with unsafe API.  \n\nThe panic caused by the misalignment causes several downstream applications (e.g., `greptimedb`) to crash when using `pprof::report::ReportBuilder::build`.  \n\nThis was patched in 0.14.0.  \n\nThe developer also suggested moving to [pprof2](https://crates.io/crates/pprof2).  \n",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "pprof"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.14.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/tikv/pprof-rs/issues/232"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/tikv/pprof-rs"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0408.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-05T19:05:57Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/12/GHSA-vxcf-c7mx-pg53/GHSA-vxcf-c7mx-pg53.json

@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vxcf-c7mx-pg53",
+  "modified": "2024-12-05T19:06:20Z",
+  "published": "2024-12-05T19:06:20Z",
+  "aliases": [],
+  "summary": "Build corruption when using `PYO3_CONFIG_FILE` environment variable",
+  "details": "In PyO3 0.23.0 the `PYO3_CONFIG_FILE` environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as `maturin` to build for multiple versions in a single build, this leads to Python wheels being compiled against the wrong Python API version.\n\nAll users who distribute artefacts for multiple Python versions are encouraged to update and rebuild with PyO3 0.23.3. Affected wheels produced from PyO3 0.23.0 through 0.23.2 are highly unstable and will crash the Python interpreter in unpredictable ways.\n",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "pyo3"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.23.0"
+            },
+            {
+              "fixed": "0.23.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/PyO3/pyo3/issues/4757"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/PyO3/pyo3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0409.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-05T19:06:20Z",
+    "nvd_published_at": null
+  }
+}