From 5d1819f7d4350f220ce3ac40ebab1c0f5fdbb449 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 6 Jul 2023 16:03:55 +0000 Subject: [PATCH] Publish Advisories GHSA-4822-jvwx-w47h GHSA-crjr-9rc5-ghw8 GHSA-jf2p-4gqj-849g GHSA-9766-v29c-4vm7 GHSA-mpv3-g8m3-3fjc GHSA-q57w-826p-46jr --- .../2022/04/GHSA-4822-jvwx-w47h/GHSA-4822-jvwx-w47h.json | 3 ++- .../2022/04/GHSA-crjr-9rc5-ghw8/GHSA-crjr-9rc5-ghw8.json | 4 ++-- .../2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json | 3 ++- .../2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json | 9 ++++++--- .../2023/06/GHSA-mpv3-g8m3-3fjc/GHSA-mpv3-g8m3-3fjc.json | 4 ++++ .../2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json | 7 +++++-- 6 files changed, 21 insertions(+), 9 deletions(-) diff --git a/advisories/github-reviewed/2022/04/GHSA-4822-jvwx-w47h/GHSA-4822-jvwx-w47h.json b/advisories/github-reviewed/2022/04/GHSA-4822-jvwx-w47h/GHSA-4822-jvwx-w47h.json index fb2da51c884..634ae7fba27 100644 --- a/advisories/github-reviewed/2022/04/GHSA-4822-jvwx-w47h/GHSA-4822-jvwx-w47h.json +++ b/advisories/github-reviewed/2022/04/GHSA-4822-jvwx-w47h/GHSA-4822-jvwx-w47h.json @@ -67,7 +67,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-772" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2022/04/GHSA-crjr-9rc5-ghw8/GHSA-crjr-9rc5-ghw8.json b/advisories/github-reviewed/2022/04/GHSA-crjr-9rc5-ghw8/GHSA-crjr-9rc5-ghw8.json index 50b3cb576a7..d5e0e10a271 100644 --- a/advisories/github-reviewed/2022/04/GHSA-crjr-9rc5-ghw8/GHSA-crjr-9rc5-ghw8.json +++ b/advisories/github-reviewed/2022/04/GHSA-crjr-9rc5-ghw8/GHSA-crjr-9rc5-ghw8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-crjr-9rc5-ghw8", - "modified": "2023-05-04T19:53:59Z", + "modified": "2023-07-06T16:02:37Z", "published": "2022-04-11T21:18:06Z", "aliases": [ "CVE-2022-24836" ], "summary": "Nokogiri Inefficient Regular Expression Complexity", - "details": "## Summary\n\nNokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.\n\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.13.4`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\n## References\n\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity\n\n\n## Credit\n\nThis vulnerability was reported by HackerOne user ooooooo_q (ななおく).\n", + "details": "## Summary\n\nNokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.13.4`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\n\n## References\n\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity\n\n\n## Credit\n\nThis vulnerability was reported by HackerOne user ooooooo_q (ななおく).\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json b/advisories/github-reviewed/2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json index 8f19c677728..0bf0f2e34ac 100644 --- a/advisories/github-reviewed/2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json +++ b/advisories/github-reviewed/2022/11/GHSA-jf2p-4gqj-849g/GHSA-jf2p-4gqj-849g.json @@ -131,7 +131,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-668" ], "severity": "LOW", "github_reviewed": true, diff --git a/advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json b/advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json index f6bad5a8328..31c6b533e0f 100644 --- a/advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json +++ b/advisories/github-reviewed/2023/06/GHSA-9766-v29c-4vm7/GHSA-9766-v29c-4vm7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9766-v29c-4vm7", - "modified": "2023-06-30T20:26:04Z", + "modified": "2023-07-06T16:02:24Z", "published": "2023-06-27T12:30:42Z", "aliases": [ "CVE-2023-34395" @@ -9,7 +9,10 @@ "summary": "Apache Airflow ODBC Provider Argument Injection vulnerability", "details": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.\nIn OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.\nStarting version 4.0.0 driver can be set only from the hook constructor.\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -58,7 +61,7 @@ "cwe_ids": [ "CWE-88" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-06-30T20:26:04Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2023/06/GHSA-mpv3-g8m3-3fjc/GHSA-mpv3-g8m3-3fjc.json b/advisories/github-reviewed/2023/06/GHSA-mpv3-g8m3-3fjc/GHSA-mpv3-g8m3-3fjc.json index 664ff8d5861..e45100f7b3d 100644 --- a/advisories/github-reviewed/2023/06/GHSA-mpv3-g8m3-3fjc/GHSA-mpv3-g8m3-3fjc.json +++ b/advisories/github-reviewed/2023/06/GHSA-mpv3-g8m3-3fjc/GHSA-mpv3-g8m3-3fjc.json @@ -93,6 +93,10 @@ } ], "references": [ + { + "type": "WEB", + "url": "https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp" + }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3128" diff --git a/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json b/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json index 39803ea21e7..f3c66f5d19b 100644 --- a/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json +++ b/advisories/github-reviewed/2023/06/GHSA-q57w-826p-46jr/GHSA-q57w-826p-46jr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q57w-826p-46jr", - "modified": "2023-06-30T20:26:33Z", + "modified": "2023-07-06T16:02:12Z", "published": "2023-06-27T12:30:42Z", "aliases": [ "CVE-2023-35798" @@ -9,7 +9,10 @@ "summary": "Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability", "details": "Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.\n\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.\n\nIt is recommended to upgrade to a version that is not affected\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ {