From 522abaae0a04939010c0345c9a6197aff9e2ca50 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 31 Jan 2025 21:07:21 +0000 Subject: [PATCH] Publish Advisories GHSA-8h93-28hg-fj84 GHSA-wxcc-2f3q-4h58 GHSA-8h93-28hg-fj84 GHSA-wxcc-2f3q-4h58 --- .../GHSA-8h93-28hg-fj84.json | 119 +++++++++++++ .../GHSA-wxcc-2f3q-4h58.json | 159 ++++++++++++++++++ .../GHSA-8h93-28hg-fj84.json | 48 ------ .../GHSA-wxcc-2f3q-4h58.json | 36 ---- 4 files changed, 278 insertions(+), 84 deletions(-) create mode 100644 advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json diff --git a/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json b/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json new file mode 100644 index 00000000000..0eff037dc8c --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8h93-28hg-fj84", + "modified": "2025-01-31T21:06:18Z", + "published": "2025-01-08T21:32:25Z", + "aliases": [ + "CVE-2024-53526" + ], + "summary": "Composio Command Execution vulnerability", + "details": "composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "composio-claude" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.40" + }, + { + "fixed": "0.6.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "composio-openai" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.40" + }, + { + "fixed": "0.6.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "composio-julep" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.5.40" + }, + { + "fixed": "0.6.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53526" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/issues/1073" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/pull/1107" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/commit/f496f7fa776335ae7825cad2991c9b38923271fc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ComposioHQ/composio" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21" + }, + { + "type": "WEB", + "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-31T21:06:18Z", + "nvd_published_at": "2025-01-08T19:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json b/advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json new file mode 100644 index 00000000000..63b504fa9ec --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json @@ -0,0 +1,159 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wxcc-2f3q-4h58", + "modified": "2025-01-31T21:06:23Z", + "published": "2025-01-31T18:31:07Z", + "aliases": [ + "CVE-2024-11741" + ], + "summary": "Grafana Alerting VictorOps integration could be exposed to users with Viewer permission", + "details": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.4.0" + }, + { + "fixed": "11.4.1" + } + ] + } + ], + "versions": [ + "11.4.0" + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.3.0" + }, + { + "fixed": "11.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.2.0" + }, + { + "fixed": "11.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.1.0" + }, + { + "fixed": "11.1.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.0.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/grafana/grafana" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.4.15" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11741" + }, + { + "type": "PACKAGE", + "url": "https://github.com/grafana/grafana" + }, + { + "type": "WEB", + "url": "https://grafana.com/security/security-advisories/cve-2024-11741" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-31T21:06:23Z", + "nvd_published_at": "2025-01-31T16:15:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json b/advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json deleted file mode 100644 index aede070fb50..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-8h93-28hg-fj84/GHSA-8h93-28hg-fj84.json +++ /dev/null @@ -1,48 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-8h93-28hg-fj84", - "modified": "2025-01-31T18:31:04Z", - "published": "2025-01-08T21:32:25Z", - "aliases": [ - "CVE-2024-53526" - ], - "details": "composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53526" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/issues/1073" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21" - }, - { - "type": "WEB", - "url": "https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-77" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-08T19:15:37Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json b/advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json deleted file mode 100644 index 5346a3cb826..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-wxcc-2f3q-4h58/GHSA-wxcc-2f3q-4h58.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wxcc-2f3q-4h58", - "modified": "2025-01-31T18:31:07Z", - "published": "2025-01-31T18:31:07Z", - "aliases": [ - "CVE-2024-11741" - ], - "details": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3,  11.2.6, 11.1.11, 11.0.11 and 10.4.15", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11741" - }, - { - "type": "WEB", - "url": "https://grafana.com/security/security-advisories/cve-2024-11741" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-31T16:15:30Z" - } -} \ No newline at end of file