From 51a06eeaee1e01b3031e559009231952dac180e4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 5 Dec 2024 19:07:17 +0000 Subject: [PATCH] Publish Advisories GHSA-cgmm-c2m9-ff7r GHSA-4fh7-m2wx-6wfm GHSA-4grw-m28r-q285 GHSA-9rmp-2568-59rv GHSA-gw5w-5j7f-jmjj GHSA-vxcf-c7mx-pg53 --- .../GHSA-cgmm-c2m9-ff7r.json | 4 +- .../GHSA-4fh7-m2wx-6wfm.json | 7 ++- .../GHSA-4grw-m28r-q285.json | 8 ++- .../GHSA-9rmp-2568-59rv.json | 8 ++- .../GHSA-gw5w-5j7f-jmjj.json | 52 +++++++++++++++++++ .../GHSA-vxcf-c7mx-pg53.json | 52 +++++++++++++++++++ 6 files changed, 125 insertions(+), 6 deletions(-) create mode 100644 advisories/github-reviewed/2024/12/GHSA-gw5w-5j7f-jmjj/GHSA-gw5w-5j7f-jmjj.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-vxcf-c7mx-pg53/GHSA-vxcf-c7mx-pg53.json diff --git a/advisories/github-reviewed/2023/06/GHSA-cgmm-c2m9-ff7r/GHSA-cgmm-c2m9-ff7r.json b/advisories/github-reviewed/2023/06/GHSA-cgmm-c2m9-ff7r/GHSA-cgmm-c2m9-ff7r.json index 7c2f5e136f8..b166d99040b 100644 --- a/advisories/github-reviewed/2023/06/GHSA-cgmm-c2m9-ff7r/GHSA-cgmm-c2m9-ff7r.json +++ b/advisories/github-reviewed/2023/06/GHSA-cgmm-c2m9-ff7r/GHSA-cgmm-c2m9-ff7r.json @@ -50,7 +50,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-94" + ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2023-06-29T15:02:49Z", diff --git a/advisories/github-reviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json b/advisories/github-reviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json index 048b5a1a9aa..4d3c88aac1a 100644 --- a/advisories/github-reviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json +++ b/advisories/github-reviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4fh7-m2wx-6wfm", - "modified": "2024-12-04T22:37:05Z", + "modified": "2024-12-05T19:06:20Z", "published": "2024-12-04T21:30:52Z", "aliases": [ "CVE-2024-51210" @@ -9,6 +9,10 @@ "summary": "Firepad allows insecure document access", "details": "Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P" @@ -59,6 +63,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-125", "CWE-200" ], "severity": "LOW", diff --git a/advisories/github-reviewed/2024/12/GHSA-4grw-m28r-q285/GHSA-4grw-m28r-q285.json b/advisories/github-reviewed/2024/12/GHSA-4grw-m28r-q285/GHSA-4grw-m28r-q285.json index 8ca91e795f7..606f2f9da2d 100644 --- a/advisories/github-reviewed/2024/12/GHSA-4grw-m28r-q285/GHSA-4grw-m28r-q285.json +++ b/advisories/github-reviewed/2024/12/GHSA-4grw-m28r-q285/GHSA-4grw-m28r-q285.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4grw-m28r-q285", - "modified": "2024-12-05T17:31:35Z", + "modified": "2024-12-05T19:05:49Z", "published": "2024-12-05T17:31:35Z", "aliases": [ "CVE-2024-53857" @@ -44,6 +44,10 @@ "type": "WEB", "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53857" + }, { "type": "PACKAGE", "url": "https://github.com/rpgp/rpgp" @@ -56,6 +60,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-12-05T17:31:35Z", - "nvd_published_at": null + "nvd_published_at": "2024-12-05T16:15:26Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-9rmp-2568-59rv/GHSA-9rmp-2568-59rv.json b/advisories/github-reviewed/2024/12/GHSA-9rmp-2568-59rv/GHSA-9rmp-2568-59rv.json index 47729ad6f63..516ce1138f9 100644 --- a/advisories/github-reviewed/2024/12/GHSA-9rmp-2568-59rv/GHSA-9rmp-2568-59rv.json +++ b/advisories/github-reviewed/2024/12/GHSA-9rmp-2568-59rv/GHSA-9rmp-2568-59rv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9rmp-2568-59rv", - "modified": "2024-12-05T17:30:52Z", + "modified": "2024-12-05T19:05:47Z", "published": "2024-12-05T17:30:52Z", "aliases": [ "CVE-2024-53856" @@ -44,6 +44,10 @@ "type": "WEB", "url": "https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53856" + }, { "type": "PACKAGE", "url": "https://github.com/rpgp/rpgp" @@ -58,6 +62,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-12-05T17:30:52Z", - "nvd_published_at": null + "nvd_published_at": "2024-12-05T16:15:26Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-gw5w-5j7f-jmjj/GHSA-gw5w-5j7f-jmjj.json b/advisories/github-reviewed/2024/12/GHSA-gw5w-5j7f-jmjj/GHSA-gw5w-5j7f-jmjj.json new file mode 100644 index 00000000000..824244a4b65 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-gw5w-5j7f-jmjj/GHSA-gw5w-5j7f-jmjj.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gw5w-5j7f-jmjj", + "modified": "2024-12-05T19:05:57Z", + "published": "2024-12-05T19:05:57Z", + "aliases": [], + "summary": "Unsound usages of `std::slice::from_raw_parts` ", + "details": "The library breaks the safety assumptions when using unsafe API `std::slice::from_raw_parts`. First, when using the API in iterator implementation (`TempFdArrayIterator.next`), generic type could be any type, which would create and pass a misaligned pointer to the unsafe API. Second, when validating the address, the code passed the type `c_void`, which could also be any type, leading to potential uninitialized memory exposure. \n\nTwo unsound usages here highlight the necessity for developers to perform type checks before doing type conversion with unsafe API. \n\nThe panic caused by the misalignment causes several downstream applications (e.g., `greptimedb`) to crash when using `pprof::report::ReportBuilder::build`. \n\nThis was patched in 0.14.0. \n\nThe developer also suggested moving to [pprof2](https://crates.io/crates/pprof2). \n", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "pprof" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.14.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/tikv/pprof-rs/issues/232" + }, + { + "type": "PACKAGE", + "url": "https://github.com/tikv/pprof-rs" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0408.html" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-12-05T19:05:57Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-vxcf-c7mx-pg53/GHSA-vxcf-c7mx-pg53.json b/advisories/github-reviewed/2024/12/GHSA-vxcf-c7mx-pg53/GHSA-vxcf-c7mx-pg53.json new file mode 100644 index 00000000000..36065ead37e --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-vxcf-c7mx-pg53/GHSA-vxcf-c7mx-pg53.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxcf-c7mx-pg53", + "modified": "2024-12-05T19:06:20Z", + "published": "2024-12-05T19:06:20Z", + "aliases": [], + "summary": "Build corruption when using `PYO3_CONFIG_FILE` environment variable", + "details": "In PyO3 0.23.0 the `PYO3_CONFIG_FILE` environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as `maturin` to build for multiple versions in a single build, this leads to Python wheels being compiled against the wrong Python API version.\n\nAll users who distribute artefacts for multiple Python versions are encouraged to update and rebuild with PyO3 0.23.3. Affected wheels produced from PyO3 0.23.0 through 0.23.2 are highly unstable and will crash the Python interpreter in unpredictable ways.\n", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "pyo3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.23.0" + }, + { + "fixed": "0.23.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/PyO3/pyo3/issues/4757" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PyO3/pyo3" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0409.html" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-05T19:06:20Z", + "nvd_published_at": null + } +} \ No newline at end of file