diff --git a/advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json b/advisories/github-reviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json similarity index 65% rename from advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json rename to advisories/github-reviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json index 9efec6c6a84..0018a0816ae 100644 --- a/advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json +++ b/advisories/github-reviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2ppf-2m6f-6v6f", - "modified": "2024-11-17T12:30:29Z", + "modified": "2024-11-18T20:08:25Z", "published": "2024-11-17T12:30:29Z", "aliases": [ "CVE-2023-6110" ], + "summary": " OpenStack improperly deletes access rules", "details": "A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "python-openstackclient" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.3.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6110" }, + { + "type": "WEB", + "url": "https://github.com/openstack/python-openstackclient/commit/bc60e3bb908a7f10c87993d791184bfe46784d6c" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:2737" @@ -41,6 +64,10 @@ "type": "WEB", "url": "https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/python-openstackclient" + }, { "type": "WEB", "url": "https://review.opendev.org/c/openstack/python-openstackclient/+/888697" @@ -51,8 +78,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:08:25Z", "nvd_published_at": "2024-11-17T11:15:06Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json b/advisories/github-reviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json similarity index 62% rename from advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json rename to advisories/github-reviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json index c155fd75215..60d4ba8a58b 100644 --- a/advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json +++ b/advisories/github-reviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3jrv-jgp8-45v3", - "modified": "2024-11-17T12:30:29Z", + "modified": "2024-11-18T20:08:31Z", "published": "2024-11-17T12:30:29Z", "aliases": [ "CVE-2023-4639" ], + "summary": "Undertow incorrectly parses cookies", "details": "A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.", "severity": [ { @@ -14,13 +15,54 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "io.undertow:undertow-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0.Alpha1" + }, + { + "fixed": "2.3.11.Final" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.undertow:undertow-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.30.Final" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4639" }, + { + "type": "WEB", + "url": "https://github.com/undertow-io/undertow/commit/1f93a979d2ac264798e5779b5b7172dfafe0066f" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1674" @@ -56,6 +98,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166022" + }, + { + "type": "PACKAGE", + "url": "https://github.com/undertow-io/undertow" } ], "database_specific": { @@ -63,8 +109,8 @@ "CWE-444" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:08:30Z", "nvd_published_at": "2024-11-17T11:15:05Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json b/advisories/github-reviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json similarity index 61% rename from advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json rename to advisories/github-reviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json index 84901a90b97..186305f8640 100644 --- a/advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json +++ b/advisories/github-reviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-h7wq-jj8r-qm7p", - "modified": "2024-11-17T12:30:30Z", + "modified": "2024-11-18T20:08:13Z", "published": "2024-11-17T12:30:29Z", "aliases": [ "CVE-2024-0793" ], + "summary": "Kubernetes Nil pointer dereference in KCM after v1 HPA patch request", "details": "A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kubernetes" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.27.0-alpha.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0793" }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/107038#issuecomment-1911327145" + }, { "type": "WEB", "url": "https://github.com/openshift/kubernetes/pull/1876" @@ -40,15 +63,20 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2214402" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/kubernetes" } ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-476" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:08:13Z", "nvd_published_at": "2024-11-17T11:15:06Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json b/advisories/github-reviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json new file mode 100644 index 00000000000..2f272390348 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hvw5-3mgw-7rcf", + "modified": "2024-11-18T20:08:44Z", + "published": "2024-11-17T12:30:29Z", + "aliases": [ + "CVE-2023-1419" + ], + "summary": "Debezium database connector has a script injection vulnerability", + "details": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "io.debezium:debezium-connector-mysql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0.Alpha1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.debezium:debezium-connector-sqlserver" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0.Alpha1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "io.debezium:debezium-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0.Alpha1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1419" + }, + { + "type": "WEB", + "url": "https://github.com/debezium/debezium/commit/58ef4f0b98428cc795c2844eaa6e1762e8248227" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-1419" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178722" + }, + { + "type": "PACKAGE", + "url": "https://github.com/debezium/debezium" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-233" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-18T20:08:44Z", + "nvd_published_at": "2024-11-17T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json b/advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json deleted file mode 100644 index f684705adde..00000000000 --- a/advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hvw5-3mgw-7rcf", - "modified": "2024-11-17T12:30:29Z", - "published": "2024-11-17T12:30:29Z", - "aliases": [ - "CVE-2023-1419" - ], - "details": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1419" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2023-1419" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178722" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-233" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-11-17T11:15:05Z" - } -} \ No newline at end of file