From 5fdd0a097577d40cddb9ca9f74a6d03cb1258cbb Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 26 Oct 2023 22:52:59 +0000
Subject: [PATCH] Publish Advisories

GHSA-x7p9-vx6v-wv84
GHSA-x7p9-vx6v-wv84
---
 .../GHSA-x7p9-vx6v-wv84.json                  | 61 +++++++++++++++++++
 .../GHSA-x7p9-vx6v-wv84.json                  | 42 -------------
 2 files changed, 61 insertions(+), 42 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json b/advisories/github-reviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json
new file mode 100644
index 00000000000..2559c725ee5
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x7p9-vx6v-wv84",
+  "modified": "2023-10-26T22:51:26Z",
+  "published": "2022-05-24T16:52:46Z",
+  "aliases": [
+    "CVE-2019-10380"
+  ],
+  "summary": "Jenkins Simple Travis Pipeline Runner Plugin script sandbox bypass vulnerability",
+  "details": "Jenkins Simple Travis Pipeline Runner Plugin defines a custom list of pre-approved signatures for scripts protected by the Script Security sandbox.\n\nThis custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.\n\nAs of publication of this advisory, there is no fix.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:simple-travis-runner"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10380"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2019/08/07/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-10-26T22:51:26Z",
+    "nvd_published_at": "2019-08-07T15:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json b/advisories/unreviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json
deleted file mode 100644
index f98c632cd6b..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-x7p9-vx6v-wv84/GHSA-x7p9-vx6v-wv84.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-x7p9-vx6v-wv84",
-  "modified": "2023-10-25T18:31:24Z",
-  "published": "2022-05-24T16:52:46Z",
-  "aliases": [
-    "CVE-2019-10380"
-  ],
-  "details": "Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10380"
-    },
-    {
-      "type": "WEB",
-      "url": "https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2019/08/07/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2019-08-07T15:15:00Z"
-  }
-}
\ No newline at end of file