Publish Advisories

GHSA-fwfj-8p36-rc64
GHSA-g98v-hv3f-hcfr
GHSA-xxp4-mf4h-6cwm

advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fwfj-8p36-rc64",
-  "modified": "2023-06-23T21:38:20Z",
+  "modified": "2023-06-30T20:21:14Z",
   "published": "2023-06-22T21:30:49Z",
   "aliases": [
     "CVE-2023-35131"
@@ -9,7 +9,10 @@
   "summary": "Moodle vulnerable to Cross-site Scripting",
   "details": "Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {
@@ -101,6 +104,14 @@
       "type": "PACKAGE",
       "url": "https://github.com/moodle/moodle"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/"
+    },
     {
       "type": "WEB",
       "url": "https://moodle.org/mod/forum/discuss.php?d=447829"

advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json

@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g98v-hv3f-hcfr",
+  "modified": "2023-06-30T20:21:59Z",
+  "published": "2023-06-30T20:21:59Z",
+  "aliases": [
+
+  ],
+  "summary": "atty potential unaligned read",
+  "details": "On windows, `atty` dereferences a potentially unaligned pointer.\n\nIn practice however, the pointer won't be unaligned unless a custom global allocator is used.\n\nIn particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.\n\n# atty is Unmaintained\n\nA Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.\n\nLast release of `atty` was almost 3 years ago.\n\n## Possible Alternative(s)\n\nThe below list has not been vetted in any way and may or may not contain alternatives;\n\n - [is-terminal](https://crates.io/crates/is-terminal)\n - std::io::IsTerminal *nightly-only experimental*\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "atty"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.2.14"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/softprops/atty/issues/50"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/softprops/atty/pull/51"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/softprops/atty"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2021-0145.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-06-30T20:21:59Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xxp4-mf4h-6cwm",
-  "modified": "2023-06-23T21:38:44Z",
+  "modified": "2023-06-30T20:21:55Z",
   "published": "2023-06-22T21:30:49Z",
   "aliases": [
     "CVE-2023-35133"
@@ -9,7 +9,10 @@
   "summary": "Moodle vulnerable to Server Side Request Forgery",
   "details": "An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
     {
@@ -120,6 +123,14 @@
       "type": "PACKAGE",
       "url": "https://github.com/moodle/moodle"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/"
+    },
     {
       "type": "WEB",
       "url": "https://moodle.org/mod/forum/discuss.php?d=447831"
@@ -133,7 +144,7 @@
     "cwe_ids": [
       "CWE-918"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-06-23T21:38:44Z",
     "nvd_published_at": null