Publish Advisories

GHSA-4822-jvwx-w47h
GHSA-crjr-9rc5-ghw8
GHSA-jf2p-4gqj-849g
GHSA-9766-v29c-4vm7
GHSA-mpv3-g8m3-3fjc
GHSA-q57w-826p-46jr

advisories/github-reviewed/2022/04/GHSA-4822-jvwx-w47h/GHSA-4822-jvwx-w47h.json

@@ -67,7 +67,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-772"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,

advisories/github-reviewed/2022/04/GHSA-crjr-9rc5-ghw8/GHSA-crjr-9rc5-ghw8.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-crjr-9rc5-ghw8",
-  "modified": "2023-05-04T19:53:59Z",
+  "modified": "2023-07-06T16:02:37Z",
   "published": "2022-04-11T21:18:06Z",
   "aliases": [
     "CVE-2022-24836"
   ],
   "summary": "Nokogiri Inefficient Regular Expression Complexity",
-  "details": "## Summary\n\nNokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.\n\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.13.4`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\n## References\n\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity\n\n\n## Credit\n\nThis vulnerability was reported by HackerOne user ooooooo_q (ななおく).\n",
+  "details": "## Summary\n\nNokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.13.4`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\n## References\n\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity\n\n\n## Credit\n\nThis vulnerability was reported by HackerOne user ooooooo_q (ななおく).\n",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json

@@ -131,7 +131,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-668"
     ],
     "severity": "LOW",
     "github_reviewed": true,

advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9766-v29c-4vm7",
-  "modified": "2023-06-30T20:26:04Z",
+  "modified": "2023-07-06T16:02:24Z",
   "published": "2023-06-27T12:30:42Z",
   "aliases": [
     "CVE-2023-34395"
@@ -9,7 +9,10 @@
   "summary": "Apache Airflow ODBC Provider Argument Injection vulnerability",
   "details": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.\nIn OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.\nStarting version 4.0.0 driver can be set only from the hook constructor.\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0.\n\n",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {
@@ -58,7 +61,7 @@
     "cwe_ids": [
       "CWE-88"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-06-30T20:26:04Z",
     "nvd_published_at": null

advisories/github-reviewed/2023/06/GHSA-mpv3-g8m3-3fjc/GHSA-mpv3-g8m3-3fjc.json

@@ -93,6 +93,10 @@
     }
   ],
   "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp"
+    },
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3128"

advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q57w-826p-46jr",
-  "modified": "2023-06-30T20:26:33Z",
+  "modified": "2023-07-06T16:02:12Z",
   "published": "2023-06-27T12:30:42Z",
   "aliases": [
     "CVE-2023-35798"
@@ -9,7 +9,10 @@
   "summary": "Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability",
   "details": "Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.\n\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.\n\nIt is recommended to upgrade to a version that is not affected\n\n",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
   ],
   "affected": [
     {