netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-v3w7-g6p2-mpx7
GHSA-36gq-35j3-p9r9
This commit is contained in:
advisory-database[bot]
2025-04-28 14:10:57 +00:00
parent 0dbcdf1e40
commit 522fbe0d64
2 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/11/GHSA-v3w7-g6p2-mpx7/GHSA-v3w7-g6p2-mpx7.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v3w7-g6p2-mpx7",
"modified": "2024-11-27T21:57:30Z",
"modified": "2025-04-28T14:09:15Z",
"published": "2024-11-25T09:30:58Z",
"aliases": [
"CVE-2024-6538"
advisories/github-reviewed/2025/01/GHSA-36gq-35j3-p9r9/GHSA-36gq-35j3-p9r9.json
+6 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-36gq-35j3-p9r9",
"modified": "2025-01-23T23:14:08Z",
"modified": "2025-04-28T14:09:27Z",
"published": "2025-01-21T20:24:02Z",
"aliases": [
"CVE-2024-10846"
],
"summary": "Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop",
"details": "### Impact\nThe `compose-go` library component in versions `v2.10-v2.4.0` allows an authorized user who sends malicious YAML payloads to cause the `compose-go` to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions ` v2.27.0` to `v2.29.7` included\n\n### Patches\ncompose-go `v2.24.1` fixed the issue\n\n### Workarounds\nThere isn't any known workaround.\n\n### References\n* https://github.com/docker/compose/issues/12235\n* https://github.com/compose-spec/compose-go/pull/703\n\n* https://github.com/compose-spec/compose-go/pull/618\n* https://github.com/docker/compose/commit/d239f0f3187a2ed5404c61f83bd5e995c81600ff#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R10\n",
"details": "### Impact\nThe `compose-go` library component in versions `v2.10-v2.4.0` allows an authorized user who sends malicious YAML payloads to cause the `compose-go` to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions ` v2.27.0` to `v2.29.7` included\n\n### Patches\ncompose-go `v2.24.1` fixed the issue\n\n### Workarounds\nThere isn't any known workaround.\n\n### References\n* https://github.com/docker/compose/issues/12235\n* https://github.com/compose-spec/compose-go/pull/703\n\n* https://github.com/compose-spec/compose-go/pull/618\n* https://github.com/docker/compose/commit/d239f0f3187a2ed5404c61f83bd5e995c81600ff#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R10",
"severity": [
{
"type": "CVSS_V3",
@@ -63,6 +63,10 @@
{
"type": "PACKAGE",
"url": "https://github.com/compose-spec/compose-go"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250425-0008"
}
],
"database_specific": {