netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7j69-qfc3-2fq9
GHSA-v68g-wm8c-6x7j
GHSA-7j69-qfc3-2fq9
This commit is contained in:
advisory-database[bot]
2023-12-20 20:31:22 +00:00
parent bbe9e4aec9
commit 5f627421b9
3 changed files with 150 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json
+123
View File
@@ -0,0 +1,123 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7j69-qfc3-2fq9",
"modified": "2023-12-20T20:30:30Z",
"published": "2023-12-13T00:30:37Z",
"aliases": [
"CVE-2023-5764"
],
"summary": "Ansible template injection vulnerability",
"details": "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce code injection when supplying templating data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.16.0"
},
{
"fixed": "2.16.1"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.15.0"
},
{
"fixed": "2.15.8"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.12"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5764"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/270b39f6ff02511a2199505161218cbd1a5ae34f"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/7239d2d371bc6e274cbb7314e01431adce6ae25a"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/fea130480d261ea5bf6fcd5cf19a348f1686ceb1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7773"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5764"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247629"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible/"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-20T20:30:30Z",
"nvd_published_at": "2023-12-12T22:15:22Z"
}
}
advisories/unreviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json → advisories/github-reviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v68g-wm8c-6x7j",
"modified": "2023-12-20T18:30:32Z",
"modified": "2023-12-20T20:29:40Z",
"published": "2023-12-20T18:30:32Z",
"aliases": [
"CVE-2023-7018"
],
"summary": "transformers has a Deserialization of Untrusted Data vulnerability",
"details": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "transformers"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.36.0"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce"
},
{
"type": "PACKAGE",
"url": "https://github.com/huggingface/transformers"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e1a3e548-e53a-48df-b708-9ee62140963c"
@@ -35,8 +58,8 @@
"CWE-502"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-12-20T20:29:40Z",
"nvd_published_at": "2023-12-20T17:15:08Z"
}
}
advisories/unreviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7j69-qfc3-2fq9",
"modified": "2023-12-13T00:30:37Z",
"published": "2023-12-13T00:30:37Z",
"aliases": [
"CVE-2023-5764"
],
"details": "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce code injection when supplying templating data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5764"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7773"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5764"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247629"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-12T22:15:22Z"
}
}