diff --git a/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json b/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json index bcf14de41cf..9739be95ae0 100644 --- a/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json +++ b/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fwfj-8p36-rc64", - "modified": "2023-06-23T21:38:20Z", + "modified": "2023-06-30T20:21:14Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-35131" @@ -9,7 +9,10 @@ "summary": "Moodle vulnerable to Cross-site Scripting", "details": "Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ { @@ -101,6 +104,14 @@ "type": "PACKAGE", "url": "https://github.com/moodle/moodle" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=447829" diff --git a/advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json b/advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json new file mode 100644 index 00000000000..ef89e0071cb --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g98v-hv3f-hcfr", + "modified": "2023-06-30T20:21:59Z", + "published": "2023-06-30T20:21:59Z", + "aliases": [ + + ], + "summary": "atty potential unaligned read", + "details": "On windows, `atty` dereferences a potentially unaligned pointer.\n\nIn practice however, the pointer won't be unaligned unless a custom global allocator is used.\n\nIn particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.\n\n# atty is Unmaintained\n\nA Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.\n\nLast release of `atty` was almost 3 years ago.\n\n## Possible Alternative(s)\n\nThe below list has not been vetted in any way and may or may not contain alternatives;\n\n - [is-terminal](https://crates.io/crates/is-terminal)\n - std::io::IsTerminal *nightly-only experimental*\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "atty" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.2.14" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/softprops/atty/issues/50" + }, + { + "type": "WEB", + "url": "https://github.com/softprops/atty/pull/51" + }, + { + "type": "PACKAGE", + "url": "https://github.com/softprops/atty" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2021-0145.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2023-06-30T20:21:59Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json b/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json index 4aa419040ca..a203bc42b0e 100644 --- a/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json +++ b/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xxp4-mf4h-6cwm", - "modified": "2023-06-23T21:38:44Z", + "modified": "2023-06-30T20:21:55Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-35133" @@ -9,7 +9,10 @@ "summary": "Moodle vulnerable to Server Side Request Forgery", "details": "An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ { @@ -120,6 +123,14 @@ "type": "PACKAGE", "url": "https://github.com/moodle/moodle" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=447831" @@ -133,7 +144,7 @@ "cwe_ids": [ "CWE-918" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-06-23T21:38:44Z", "nvd_published_at": null