netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2ppf-2m6f-6v6f
GHSA-3jrv-jgp8-45v3
GHSA-h7wq-jj8r-qm7p
GHSA-hvw5-3mgw-7rcf
GHSA-hvw5-3mgw-7rcf
This commit is contained in:
advisory-database[bot]
2024-11-18 20:09:29 +00:00
parent abed381c20
commit 59e3eabea6
5 changed files with 221 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json → advisories/github-reviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2ppf-2m6f-6v6f",
"modified": "2024-11-17T12:30:29Z",
"modified": "2024-11-18T20:08:25Z",
"published": "2024-11-17T12:30:29Z",
"aliases": [
"CVE-2023-6110"
],
"summary": " OpenStack improperly deletes access rules",
"details": "A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "python-openstackclient"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6110"
},
{
"type": "WEB",
"url": "https://github.com/openstack/python-openstackclient/commit/bc60e3bb908a7f10c87993d791184bfe46784d6c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2737"
@@ -41,6 +64,10 @@
"type": "WEB",
"url": "https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/python-openstackclient"
},
{
"type": "WEB",
"url": "https://review.opendev.org/c/openstack/python-openstackclient/+/888697"
@@ -51,8 +78,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T20:08:25Z",
"nvd_published_at": "2024-11-17T11:15:06Z"
}
}
advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json → advisories/github-reviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json
+50 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3jrv-jgp8-45v3",
"modified": "2024-11-17T12:30:29Z",
"modified": "2024-11-18T20:08:31Z",
"published": "2024-11-17T12:30:29Z",
"aliases": [
"CVE-2023-4639"
],
"summary": "Undertow incorrectly parses cookies",
"details": "A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.",
"severity": [
{
@@ -14,13 +15,54 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0.Alpha1"
},
{
"fixed": "2.3.11.Final"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.30.Final"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4639"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/commit/1f93a979d2ac264798e5779b5b7172dfafe0066f"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1674"
@@ -56,6 +98,10 @@
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166022"
},
{
"type": "PACKAGE",
"url": "https://github.com/undertow-io/undertow"
}
],
"database_specific": {
@@ -63,8 +109,8 @@
"CWE-444"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T20:08:30Z",
"nvd_published_at": "2024-11-17T11:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json → advisories/github-reviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json
+33 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h7wq-jj8r-qm7p",
"modified": "2024-11-17T12:30:30Z",
"modified": "2024-11-18T20:08:13Z",
"published": "2024-11-17T12:30:29Z",
"aliases": [
"CVE-2024-0793"
],
"summary": "Kubernetes Nil pointer dereference in KCM after v1 HPA patch request",
"details": "A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.0-alpha.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0793"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/107038#issuecomment-1911327145"
},
{
"type": "WEB",
"url": "https://github.com/openshift/kubernetes/pull/1876"
@@ -40,15 +63,20 @@
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2214402"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-476"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T20:08:13Z",
"nvd_published_at": "2024-11-17T11:15:06Z"
}
}
advisories/github-reviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json
+107
View File
@@ -0,0 +1,107 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hvw5-3mgw-7rcf",
"modified": "2024-11-18T20:08:44Z",
"published": "2024-11-17T12:30:29Z",
"aliases": [
"CVE-2023-1419"
],
"summary": "Debezium database connector has a script injection vulnerability",
"details": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.debezium:debezium-connector-mysql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0.Alpha1"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.debezium:debezium-connector-sqlserver"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0.Alpha1"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.debezium:debezium-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0.Alpha1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1419"
},
{
"type": "WEB",
"url": "https://github.com/debezium/debezium/commit/58ef4f0b98428cc795c2844eaa6e1762e8248227"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-1419"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178722"
},
{
"type": "PACKAGE",
"url": "https://github.com/debezium/debezium"
}
],
"database_specific": {
"cwe_ids": [
"CWE-233"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T20:08:44Z",
"nvd_published_at": "2024-11-17T11:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hvw5-3mgw-7rcf",
"modified": "2024-11-17T12:30:29Z",
"published": "2024-11-17T12:30:29Z",
"aliases": [
"CVE-2023-1419"
],
"details": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1419"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-1419"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178722"
}
],
"database_specific": {
"cwe_ids": [
"CWE-233"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-17T11:15:05Z"
}
}