diff --git a/advisories/github-reviewed/2024/10/GHSA-hxf3-vgpm-fv9p/GHSA-hxf3-vgpm-fv9p.json b/advisories/github-reviewed/2024/10/GHSA-hxf3-vgpm-fv9p/GHSA-hxf3-vgpm-fv9p.json index 019539752e6..dd607686dd1 100644 --- a/advisories/github-reviewed/2024/10/GHSA-hxf3-vgpm-fv9p/GHSA-hxf3-vgpm-fv9p.json +++ b/advisories/github-reviewed/2024/10/GHSA-hxf3-vgpm-fv9p/GHSA-hxf3-vgpm-fv9p.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-hxf3-vgpm-fv9p", - "modified": "2024-10-28T15:05:26Z", + "modified": "2025-02-03T13:26:39Z", "published": "2024-10-28T00:30:48Z", "aliases": [ "CVE-2024-50611" ], "summary": "CycloneDX cdxgen may execute code contained within build-related files", - "details": "CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.", + "details": "CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.", "severity": [ { "type": "CVSS_V3", @@ -32,7 +32,7 @@ "introduced": "0" }, { - "last_affected": "10.10.7" + "fixed": "11.1.7" } ] } @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/CycloneDX/cdxgen/issues/1328" }, + { + "type": "WEB", + "url": "https://github.com/CycloneDX/cdxgen/pull/1614" + }, { "type": "PACKAGE", "url": "https://github.com/CycloneDX/cdxgen" @@ -56,6 +60,10 @@ "type": "WEB", "url": "https://github.com/CycloneDX/cdxgen/releases" }, + { + "type": "WEB", + "url": "https://github.com/CycloneDX/cdxgen/releases/tag/v11.1.7" + }, { "type": "WEB", "url": "https://owasp.org/www-project-dep-scan"