diff --git a/advisories/github-reviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json b/advisories/github-reviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json new file mode 100644 index 00000000000..fc64049a420 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json @@ -0,0 +1,123 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7j69-qfc3-2fq9", + "modified": "2023-12-20T20:30:30Z", + "published": "2023-12-13T00:30:37Z", + "aliases": [ + "CVE-2023-5764" + ], + "summary": "Ansible template injection vulnerability", + "details": "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce code injection when supplying templating data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.16.0" + }, + { + "fixed": "2.16.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.15.0" + }, + { + "fixed": "2.15.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.14.12" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5764" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/270b39f6ff02511a2199505161218cbd1a5ae34f" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/7239d2d371bc6e274cbb7314e01431adce6ae25a" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/fea130480d261ea5bf6fcd5cf19a348f1686ceb1" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7773" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-5764" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247629" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ansible/ansible/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:30:30Z", + "nvd_published_at": "2023-12-12T22:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json b/advisories/github-reviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json similarity index 59% rename from advisories/unreviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json rename to advisories/github-reviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json index 8117734d610..5ccf83548be 100644 --- a/advisories/unreviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json +++ b/advisories/github-reviewed/2023/12/GHSA-v68g-wm8c-6x7j/GHSA-v68g-wm8c-6x7j.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-v68g-wm8c-6x7j", - "modified": "2023-12-20T18:30:32Z", + "modified": "2023-12-20T20:29:40Z", "published": "2023-12-20T18:30:32Z", "aliases": [ "CVE-2023-7018" ], + "summary": "transformers has a Deserialization of Untrusted Data vulnerability", "details": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "transformers" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.36.0" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce" }, + { + "type": "PACKAGE", + "url": "https://github.com/huggingface/transformers" + }, { "type": "WEB", "url": "https://huntr.com/bounties/e1a3e548-e53a-48df-b708-9ee62140963c" @@ -35,8 +58,8 @@ "CWE-502" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-20T20:29:40Z", "nvd_published_at": "2023-12-20T17:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json b/advisories/unreviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json deleted file mode 100644 index 590a1bd2ce7..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-7j69-qfc3-2fq9/GHSA-7j69-qfc3-2fq9.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7j69-qfc3-2fq9", - "modified": "2023-12-13T00:30:37Z", - "published": "2023-12-13T00:30:37Z", - "aliases": [ - "CVE-2023-5764" - ], - "details": "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce code injection when supplying templating data.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5764" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2023:7773" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2023-5764" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247629" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-1336" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-12T22:15:22Z" - } -} \ No newline at end of file