netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2fm6-mv57-p2qh
GHSA-9cmq-m9j5-mvww
GHSA-hmqf-wpq9-jq83
GHSA-9cmq-m9j5-mvww
This commit is contained in:
advisory-database[bot]
2024-08-20 20:04:48 +00:00
parent c3ef25eb4a
commit 51e3dbac5b
4 changed files with 144 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json → advisories/github-reviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json
+40 -6
View File
@@ -1,17 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2fm6-mv57-p2qh",
"modified": "2024-08-20T09:30:28Z",
"modified": "2024-08-20T20:04:18Z",
"published": "2024-08-20T09:30:28Z",
"aliases": [
"CVE-2024-43202"
],
"summary": "Apache Dolphinscheduler Code Injection vulnerability",
"details": "Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.2. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dolphinscheduler:dolphinscheduler-task-api"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +48,14 @@
"type": "WEB",
"url": "https://github.com/apache/dolphinscheduler/pull/15758"
},
{
"type": "WEB",
"url": "https://github.com/apache/dolphinscheduler/commit/dc306bfa1d3ed72eb7b72b177e33a46042d2a9c3"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/dolphinscheduler"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5"
@@ -39,9 +73,9 @@
"cwe_ids": [
"CWE-94"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-08-20T20:04:18Z",
"nvd_published_at": "2024-08-20T08:15:05Z"
}
}
advisories/github-reviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9cmq-m9j5-mvww",
"modified": "2024-08-20T20:03:25Z",
"published": "2024-08-20T09:30:28Z",
"aliases": [
"CVE-2024-38808"
],
"summary": "Spring Framework vulnerable to Denial of Service",
"details": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-expression"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.39"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-framework"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2024-38808"
}
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-20T20:03:25Z",
"nvd_published_at": "2024-08-20T08:15:05Z"
}
}
advisories/unreviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json → advisories/github-reviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json
+31 -4
View File
@@ -1,26 +1,53 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hmqf-wpq9-jq83",
"modified": "2024-08-20T06:31:36Z",
"modified": "2024-08-20T20:03:33Z",
"published": "2024-08-20T06:31:36Z",
"aliases": [
"CVE-2024-38810"
],
"summary": "Spring Security Missing Authorization vulnerability",
"details": "Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework.security:spring-security-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.3.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38810"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-security"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2024-38810"
@@ -31,8 +58,8 @@
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-08-20T20:03:33Z",
"nvd_published_at": "2024-08-20T04:15:07Z"
}
}
advisories/unreviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9cmq-m9j5-mvww",
"modified": "2024-08-20T09:30:28Z",
"published": "2024-08-20T09:30:28Z",
"aliases": [
"CVE-2024-38808"
],
"details": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2024-38808"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-20T08:15:05Z"
}
}