From 5d3eb9b01e4254d5077cf54cda9d2c1e65ed982a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 23:15:07 +0000 Subject: [PATCH] Publish Advisories GHSA-pm9m-w23q-5967 GHSA-r9mw-gwx9-v3h5 GHSA-pm9m-w23q-5967 --- .../GHSA-pm9m-w23q-5967.json | 130 ++++++++++++++++++ .../GHSA-r9mw-gwx9-v3h5.json | 88 +++++++++++- .../GHSA-pm9m-w23q-5967.json | 42 ------ 3 files changed, 214 insertions(+), 46 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json (50%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json diff --git a/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json b/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json new file mode 100644 index 00000000000..70d46732f7c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pm9m-w23q-5967", + "modified": "2024-04-23T23:12:50Z", + "published": "2022-05-17T00:26:26Z", + "aliases": [ + "CVE-2015-7503" + ], + "summary": "Zend Framework Information Disclosure", + "details": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-crypt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-crypt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7503" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137" + }, + { + "type": "WEB", + "url": "https://framework.zend.com/security/advisory/ZF2015-10" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-crypt/CVE-2015-7503.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-7503.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/zendframework/zendframework" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:12:49Z", + "nvd_published_at": "2017-10-10T16:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json b/advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json rename to advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json index 37da80eaa72..f9f395358a1 100644 --- a/advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json +++ b/advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r9mw-gwx9-v3h5", - "modified": "2022-05-14T02:19:49Z", + "modified": "2024-04-23T23:13:14Z", "published": "2022-05-14T02:19:49Z", "aliases": [ "CVE-2016-10034" ], + "summary": "zend-mail remote code execution via Sendmail adapter", "details": "The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.", "severity": [ { @@ -14,7 +15,82 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5" + }, + { + "last_affected": "2.5.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6" + }, + { + "last_affected": "2.6.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-mail" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +101,10 @@ "type": "WEB", "url": "https://framework.zend.com/security/advisory/ZF2016-04" }, + { + "type": "PACKAGE", + "url": "https://github.com/zendframework/zend-mail" + }, { "type": "WEB", "url": "https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html" @@ -59,8 +139,8 @@ "CWE-77" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T23:13:13Z", "nvd_published_at": "2016-12-30T19:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json b/advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json deleted file mode 100644 index 1b6d61d0d69..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-pm9m-w23q-5967", - "modified": "2022-05-17T00:26:26Z", - "published": "2022-05-17T00:26:26Z", - "aliases": [ - "CVE-2015-7503" - ], - "details": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7503" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137" - }, - { - "type": "WEB", - "url": "https://framework.zend.com/security/advisory/ZF2015-10" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-10-10T16:29:00Z" - } -} \ No newline at end of file