From 63b0a9c754d1fbce59e6f8be7c502cb7aa7dcc09 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 30 Jun 2023 20:22:37 +0000 Subject: [PATCH] Publish Advisories GHSA-fwfj-8p36-rc64 GHSA-g98v-hv3f-hcfr GHSA-xxp4-mf4h-6cwm --- .../GHSA-fwfj-8p36-rc64.json | 15 ++++- .../GHSA-g98v-hv3f-hcfr.json | 62 +++++++++++++++++++ .../GHSA-xxp4-mf4h-6cwm.json | 17 ++++- 3 files changed, 89 insertions(+), 5 deletions(-) create mode 100644 advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json diff --git a/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json b/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json index bcf14de41cf..9739be95ae0 100644 --- a/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json +++ b/advisories/github-reviewed/2023/06/GHSA-fwfj-8p36-rc64/GHSA-fwfj-8p36-rc64.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fwfj-8p36-rc64", - "modified": "2023-06-23T21:38:20Z", + "modified": "2023-06-30T20:21:14Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-35131" @@ -9,7 +9,10 @@ "summary": "Moodle vulnerable to Cross-site Scripting", "details": "Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ { @@ -101,6 +104,14 @@ "type": "PACKAGE", "url": "https://github.com/moodle/moodle" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=447829" diff --git a/advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json b/advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json new file mode 100644 index 00000000000..ef89e0071cb --- /dev/null +++ b/advisories/github-reviewed/2023/06/GHSA-g98v-hv3f-hcfr/GHSA-g98v-hv3f-hcfr.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g98v-hv3f-hcfr", + "modified": "2023-06-30T20:21:59Z", + "published": "2023-06-30T20:21:59Z", + "aliases": [ + + ], + "summary": "atty potential unaligned read", + "details": "On windows, `atty` dereferences a potentially unaligned pointer.\n\nIn practice however, the pointer won't be unaligned unless a custom global allocator is used.\n\nIn particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.\n\n# atty is Unmaintained\n\nA Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.\n\nLast release of `atty` was almost 3 years ago.\n\n## Possible Alternative(s)\n\nThe below list has not been vetted in any way and may or may not contain alternatives;\n\n - [is-terminal](https://crates.io/crates/is-terminal)\n - std::io::IsTerminal *nightly-only experimental*\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "atty" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.2.14" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/softprops/atty/issues/50" + }, + { + "type": "WEB", + "url": "https://github.com/softprops/atty/pull/51" + }, + { + "type": "PACKAGE", + "url": "https://github.com/softprops/atty" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2021-0145.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2023-06-30T20:21:59Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json b/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json index 4aa419040ca..a203bc42b0e 100644 --- a/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json +++ b/advisories/github-reviewed/2023/06/GHSA-xxp4-mf4h-6cwm/GHSA-xxp4-mf4h-6cwm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xxp4-mf4h-6cwm", - "modified": "2023-06-23T21:38:44Z", + "modified": "2023-06-30T20:21:55Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-35133" @@ -9,7 +9,10 @@ "summary": "Moodle vulnerable to Server Side Request Forgery", "details": "An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ { @@ -120,6 +123,14 @@ "type": "PACKAGE", "url": "https://github.com/moodle/moodle" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=447831" @@ -133,7 +144,7 @@ "cwe_ids": [ "CWE-918" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-06-23T21:38:44Z", "nvd_published_at": null