diff --git a/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json b/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json new file mode 100644 index 00000000000..0eff037dc8c --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8h93-28hg-fj84", + "modified": "2025-01-31T21:06:18Z", + "published": "2025-01-08T21:32:25Z", + "aliases": [ + "CVE-2024-53526" + ], + "summary": "Composio Command Execution vulnerability", + "details": "composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "composio-claude" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.40" + }, + { + "fixed": "0.6.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "composio-openai" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.40" + }, + { + "fixed": "0.6.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "composio-julep" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.40" + }, + { + "fixed": "0.6.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53526" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/issues/1073" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/pull/1107" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/commit/f496f7fa776335ae7825cad2991c9b38923271fc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ComposioHQ/composio" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-31T21:06:18Z", + "nvd_published_at": "2025-01-08T19:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json b/advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json new file mode 100644 index 00000000000..63b504fa9ec --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json @@ -0,0 +1,159 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wxcc-2f3q-4h58", + "modified": "2025-01-31T21:06:23Z", + "published": "2025-01-31T18:31:07Z", + "aliases": [ + "CVE-2024-11741" + ], + "summary": "Grafana Alerting VictorOps integration could be exposed to users with Viewer permission", + "details": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.4.0" + }, + { + "fixed": "11.4.1" + } + ] + } + ], + "versions": [ + "11.4.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.3.0" + }, + { + "fixed": "11.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.2.0" + }, + { + "fixed": "11.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.1.0" + }, + { + "fixed": "11.1.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.0.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.4.15" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11741" + }, + { + "type": "PACKAGE", + "url": "https://github.com/grafana/grafana" + }, + { + "type": "WEB", + "url": "https://grafana.com/security/security-advisories/cve-2024-11741" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-31T21:06:23Z", + "nvd_published_at": "2025-01-31T16:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json b/advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json deleted file mode 100644 index aede070fb50..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json +++ /dev/null @@ -1,48 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8h93-28hg-fj84", - "modified": "2025-01-31T18:31:04Z", - "published": "2025-01-08T21:32:25Z", - "aliases": [ - "CVE-2024-53526" - ], - "details": "composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53526" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/issues/1073" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-77" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-08T19:15:37Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json b/advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json deleted file mode 100644 index 5346a3cb826..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wxcc-2f3q-4h58", - "modified": "2025-01-31T18:31:07Z", - "published": "2025-01-31T18:31:07Z", - "aliases": [ - "CVE-2024-11741" - ], - "details": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,  11.2.6, 11.1.11, 11.0.11 and 10.4.15", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11741" - }, - { - "type": "WEB", - "url": "https://grafana.com/security/security-advisories/cve-2024-11741" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-31T16:15:30Z" - } -} \ No newline at end of file