diff --git a/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json b/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json new file mode 100644 index 00000000000..70d46732f7c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pm9m-w23q-5967", + "modified": "2024-04-23T23:12:50Z", + "published": "2022-05-17T00:26:26Z", + "aliases": [ + "CVE-2015-7503" + ], + "summary": "Zend Framework Information Disclosure", + "details": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-crypt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-crypt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7503" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137" + }, + { + "type": "WEB", + "url": "https://framework.zend.com/security/advisory/ZF2015-10" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-crypt/CVE-2015-7503.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-7503.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/zendframework/zendframework" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:12:49Z", + "nvd_published_at": "2017-10-10T16:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json b/advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json rename to advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json index 37da80eaa72..f9f395358a1 100644 --- a/advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json +++ b/advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r9mw-gwx9-v3h5", - "modified": "2022-05-14T02:19:49Z", + "modified": "2024-04-23T23:13:14Z", "published": "2022-05-14T02:19:49Z", "aliases": [ "CVE-2016-10034" ], + "summary": "zend-mail remote code execution via Sendmail adapter", "details": "The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.", "severity": [ { @@ -14,7 +15,82 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5" + }, + { + "last_affected": "2.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6" + }, + { + "last_affected": "2.6.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +101,10 @@ "type": "WEB", "url": "https://framework.zend.com/security/advisory/ZF2016-04" }, + { + "type": "PACKAGE", + "url": "https://github.com/zendframework/zend-mail" + }, { "type": "WEB", "url": "https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html" @@ -59,8 +139,8 @@ "CWE-77" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:13:13Z", "nvd_published_at": "2016-12-30T19:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json b/advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json deleted file mode 100644 index 1b6d61d0d69..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-pm9m-w23q-5967", - "modified": "2022-05-17T00:26:26Z", - "published": "2022-05-17T00:26:26Z", - "aliases": [ - "CVE-2015-7503" - ], - "details": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7503" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137" - }, - { - "type": "WEB", - "url": "https://framework.zend.com/security/advisory/ZF2015-10" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-10-10T16:29:00Z" - } -} \ No newline at end of file