diff --git a/advisories/unreviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json b/advisories/github-reviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json similarity index 51% rename from advisories/unreviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json rename to advisories/github-reviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json index 94b1adb2560..2bef26f627b 100644 --- a/advisories/unreviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json +++ b/advisories/github-reviewed/2024/08/GHSA-2fm6-mv57-p2qh/GHSA-2fm6-mv57-p2qh.json @@ -1,17 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-2fm6-mv57-p2qh", - "modified": "2024-08-20T09:30:28Z", + "modified": "2024-08-20T20:04:18Z", "published": "2024-08-20T09:30:28Z", "aliases": [ "CVE-2024-43202" ], + "summary": "Apache Dolphinscheduler Code Injection vulnerability", "details": "Exposure of Remote Code Execution in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.2. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.dolphinscheduler:dolphinscheduler-task-api" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.2" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +48,14 @@ "type": "WEB", "url": "https://github.com/apache/dolphinscheduler/pull/15758" }, + { + "type": "WEB", + "url": "https://github.com/apache/dolphinscheduler/commit/dc306bfa1d3ed72eb7b72b177e33a46042d2a9c3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/dolphinscheduler" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5" @@ -39,9 +73,9 @@ "cwe_ids": [ "CWE-94" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T20:04:18Z", "nvd_published_at": "2024-08-20T08:15:05Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json b/advisories/github-reviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json new file mode 100644 index 00000000000..aa30ebb686b --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9cmq-m9j5-mvww", + "modified": "2024-08-20T20:03:25Z", + "published": "2024-08-20T09:30:28Z", + "aliases": [ + "CVE-2024-38808" + ], + "summary": "Spring Framework vulnerable to Denial of Service", + "details": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition. Older, unsupported versions are also affected.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework:spring-expression" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.3.39" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" + }, + { + "type": "WEB", + "url": "https://github.com/spring-projects/spring-framework/commit/26f2dad388499faecf99e75b8856788e95d8d658" + }, + { + "type": "WEB", + "url": "https://github.com/spring-projects/spring-framework/commit/f44d13cb7816e586b86c02421af4f5498391111c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/spring-projects/spring-framework" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-38808" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T20:03:25Z", + "nvd_published_at": "2024-08-20T08:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json b/advisories/github-reviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json similarity index 50% rename from advisories/unreviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json rename to advisories/github-reviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json index 5921e59bf2f..9ea1cec9604 100644 --- a/advisories/unreviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json +++ b/advisories/github-reviewed/2024/08/GHSA-hmqf-wpq9-jq83/GHSA-hmqf-wpq9-jq83.json @@ -1,26 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-hmqf-wpq9-jq83", - "modified": "2024-08-20T06:31:36Z", + "modified": "2024-08-20T20:03:33Z", "published": "2024-08-20T06:31:36Z", "aliases": [ "CVE-2024-38810" ], + "summary": "Spring Security Missing Authorization vulnerability", "details": "Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.security:spring-security-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.3.0" + }, + { + "fixed": "6.3.2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38810" }, + { + "type": "PACKAGE", + "url": "https://github.com/spring-projects/spring-security" + }, { "type": "WEB", "url": "https://spring.io/security/cve-2024-38810" @@ -31,8 +58,8 @@ "CWE-287" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-20T20:03:33Z", "nvd_published_at": "2024-08-20T04:15:07Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json b/advisories/unreviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json deleted file mode 100644 index 48feb22ab1c..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-9cmq-m9j5-mvww/GHSA-9cmq-m9j5-mvww.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-9cmq-m9j5-mvww", - "modified": "2024-08-20T09:30:28Z", - "published": "2024-08-20T09:30:28Z", - "aliases": [ - "CVE-2024-38808" - ], - "details": "In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.\n\nSpecifically, an application is vulnerable when the following is true:\n\n * The application evaluates user-supplied SpEL expressions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38808" - }, - { - "type": "WEB", - "url": "https://spring.io/security/cve-2024-38808" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-20T08:15:05Z" - } -} \ No newline at end of file