From 62e00a14bcbfa424bd87cf612c672b7f69e87e67 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 28 Oct 2024 14:45:50 +0000 Subject: [PATCH] Publish Advisories GHSA-844w-j86r-4x2j GHSA-p8pc-3f7w-jr5q GHSA-pmvv-57rg-5g86 --- .../GHSA-844w-j86r-4x2j.json | 24 ++++++++++--- .../GHSA-p8pc-3f7w-jr5q.json | 35 +++++++++++++++---- .../GHSA-pmvv-57rg-5g86.json | 35 +++++++++++++++---- 3 files changed, 78 insertions(+), 16 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json (59%) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json (59%) diff --git a/advisories/github-reviewed/2019/12/GHSA-844w-j86r-4x2j/GHSA-844w-j86r-4x2j.json b/advisories/github-reviewed/2019/12/GHSA-844w-j86r-4x2j/GHSA-844w-j86r-4x2j.json index f92df609c9c..653d9356348 100644 --- a/advisories/github-reviewed/2019/12/GHSA-844w-j86r-4x2j/GHSA-844w-j86r-4x2j.json +++ b/advisories/github-reviewed/2019/12/GHSA-844w-j86r-4x2j/GHSA-844w-j86r-4x2j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-844w-j86r-4x2j", - "modified": "2021-11-01T14:12:42Z", + "modified": "2024-10-28T14:44:38Z", "published": "2019-12-16T20:17:10Z", "aliases": [ "CVE-2019-16778" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" } ], "affected": [ @@ -28,7 +32,7 @@ "introduced": "0" }, { - "fixed": "1.15" + "fixed": "1.15.0" } ] } @@ -47,7 +51,7 @@ "introduced": "0" }, { - "fixed": "1.15" + "fixed": "1.15.0" } ] } @@ -66,7 +70,7 @@ "introduced": "0" }, { - "fixed": "1.15" + "fixed": "1.15.0" } ] } @@ -86,6 +90,18 @@ "type": "WEB", "url": "https://github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-227.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-234.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-209.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/tensorflow/tensorflow" diff --git a/advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json b/advisories/github-reviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json similarity index 59% rename from advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json rename to advisories/github-reviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json index 75e9375abf7..5247a0b7991 100644 --- a/advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json +++ b/advisories/github-reviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json @@ -1,20 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-p8pc-3f7w-jr5q", - "modified": "2024-10-26T21:30:46Z", + "modified": "2024-10-28T14:44:05Z", "published": "2024-10-26T21:30:46Z", "aliases": [ "CVE-2020-26304" ], + "summary": "Foundation Regular Expression Denial of Service vulnerability", "details": "Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "foundation-sites" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "6.3.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/foundation/foundation-sites/issues/12180" }, + { + "type": "PACKAGE", + "url": "https://github.com/foundation/foundation-sites" + }, { "type": "ADVISORY", "url": "https://securitylab.github.com/advisories/GHSL-2020-290-redos-foundation-sites" @@ -34,9 +57,9 @@ "cwe_ids": [ "CWE-1333" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T14:44:05Z", "nvd_published_at": "2024-10-26T21:15:13Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json b/advisories/github-reviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json similarity index 59% rename from advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json rename to advisories/github-reviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json index 79a339560fc..9a602a39fc5 100644 --- a/advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json +++ b/advisories/github-reviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json @@ -1,20 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-pmvv-57rg-5g86", - "modified": "2024-10-26T21:30:46Z", + "modified": "2024-10-28T14:44:58Z", "published": "2024-10-26T21:30:46Z", "aliases": [ "CVE-2020-26305" ], + "summary": "CommonRegexJS Regular Expression Denial of Service vulnerability", "details": "CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "commonregex" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.3.1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/talyssonoc/CommonRegexJS/issues/4" }, + { + "type": "PACKAGE", + "url": "https://github.com/talyssonoc/CommonRegexJS" + }, { "type": "ADVISORY", "url": "https://securitylab.github.com/advisories/GHSL-2020-291-redos-CommonRegexJS" @@ -34,9 +57,9 @@ "cwe_ids": [ "CWE-1333" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T14:44:58Z", "nvd_published_at": "2024-10-26T21:15:13Z" } } \ No newline at end of file