From 653e52a3549b1be65c6278e1ec01f6760c81f043 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 14 May 2024 21:14:53 +0000 Subject: [PATCH] Publish Advisories GHSA-2w87-5qcj-j6gx GHSA-49jv-37hm-6gfp GHSA-5644-2v3h-5w4x GHSA-c36r-g737-9qp8 GHSA-f4g4-cj8f-3cr9 GHSA-g63p-mfcm-54c4 GHSA-jv34-xvjq-ppch GHSA-ph2h-hh49-vh27 GHSA-qr62-r9xc-r2gj GHSA-w429-xc55-hc48 GHSA-f4g4-cj8f-3cr9 --- .../GHSA-2w87-5qcj-j6gx.json | 43 +++++- .../GHSA-49jv-37hm-6gfp.json | 43 +++++- .../GHSA-5644-2v3h-5w4x.json | 39 +++++- .../GHSA-c36r-g737-9qp8.json | 47 ++++++- .../GHSA-f4g4-cj8f-3cr9.json | 127 ++++++++++++++++++ .../GHSA-g63p-mfcm-54c4.json | 39 +++++- .../GHSA-jv34-xvjq-ppch.json | 39 +++++- .../GHSA-ph2h-hh49-vh27.json | 43 +++++- .../GHSA-qr62-r9xc-r2gj.json | 31 ++++- .../GHSA-w429-xc55-hc48.json | 43 +++++- .../GHSA-f4g4-cj8f-3cr9.json | 50 ------- 11 files changed, 458 insertions(+), 86 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json (52%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json (65%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json (55%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json (57%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json (52%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json (67%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json (51%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json diff --git a/advisories/unreviewed/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json b/advisories/github-reviewed/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json rename to advisories/github-reviewed/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json index c9eb18aaf03..3bc160aeac8 100644 --- a/advisories/unreviewed/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json +++ b/advisories/github-reviewed/2022/05/GHSA-2w87-5qcj-j6gx/GHSA-2w87-5qcj-j6gx.json @@ -1,27 +1,62 @@ { "schema_version": "1.4.0", "id": "GHSA-2w87-5qcj-j6gx", - "modified": "2022-05-17T04:41:34Z", + "modified": "2024-05-14T21:14:01Z", "published": "2022-05-17T04:41:34Z", "aliases": [ "CVE-2013-4469" ], + "summary": "OpenStack Compute (Nova) Denial of service due to improper validation of virtual size of QCOW2 image", "details": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4469" }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/135faa7b5d9855312bedc19e5e1ecebae34d3d18" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/3cdfe894ab58f7b91bf7fb690fc5bc724e44066f" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/f6810be4ae1a6c93e7d8017ee67d5344dfdf4a30" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1206081" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2013/10/31/3" @@ -36,8 +71,8 @@ ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:14:01Z", "nvd_published_at": "2013-11-02T18:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json b/advisories/github-reviewed/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json rename to advisories/github-reviewed/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json index 61ae8c40cf7..6c9a9b23ba9 100644 --- a/advisories/unreviewed/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json +++ b/advisories/github-reviewed/2022/05/GHSA-49jv-37hm-6gfp/GHSA-49jv-37hm-6gfp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-49jv-37hm-6gfp", - "modified": "2022-05-14T01:58:44Z", + "modified": "2024-05-14T21:13:54Z", "published": "2022-05-14T01:58:44Z", "aliases": [ "CVE-2016-2140" ], + "summary": "OpenStack Nova host data access through resize/migration", "details": "The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.", "severity": [ { @@ -14,13 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "12.0.0" + }, + { + "fixed": "12.0.3" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2140" }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/0b194187db9da28225cb5e62be3b45aff5a1c793" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/116b1210ab772c55d1ed1f715687d83877c92701" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/f302bf04ab5dda89cf8ceaeed309006da90c0666" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:0363" @@ -49,6 +80,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1313454" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2016-007.html" @@ -71,8 +106,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:54Z", "nvd_published_at": "2016-04-12T14:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json b/advisories/github-reviewed/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json rename to advisories/github-reviewed/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json index cba77ffb18f..d87e2ebe6e0 100644 --- a/advisories/unreviewed/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json +++ b/advisories/github-reviewed/2022/05/GHSA-5644-2v3h-5w4x/GHSA-5644-2v3h-5w4x.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-5644-2v3h-5w4x", - "modified": "2022-05-17T04:41:48Z", + "modified": "2024-05-14T21:13:58Z", "published": "2022-05-17T04:41:48Z", "aliases": [ "CVE-2013-4463" ], + "summary": "OpenStack Nova denial of service through compressed disk images", "details": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,18 @@ "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1206081" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, + { + "type": "WEB", + "url": "http://github.com/openstack/nova/commit/3cdfe894ab58f7b91bf7fb690fc5bc724e44066f" + }, + { + "type": "WEB", + "url": "http://github.com/openstack/nova/commit/f6810be4ae1a6c93e7d8017ee67d5344dfdf4a30" + }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2014-0112.html" @@ -40,8 +71,8 @@ ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:58Z", "nvd_published_at": "2014-02-06T05:44:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json b/advisories/github-reviewed/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json similarity index 55% rename from advisories/unreviewed/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json rename to advisories/github-reviewed/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json index d050b435e1b..ae0ce6b0c81 100644 --- a/advisories/unreviewed/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json +++ b/advisories/github-reviewed/2022/05/GHSA-c36r-g737-9qp8/GHSA-c36r-g737-9qp8.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c36r-g737-9qp8", - "modified": "2022-05-14T01:58:45Z", + "modified": "2024-05-14T21:13:52Z", "published": "2022-05-14T01:58:45Z", "aliases": [ "CVE-2015-8749" ], + "summary": " OpenStack Nova Potential Xen connection password leak via StorageError", "details": "The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.", "severity": [ { @@ -14,17 +15,55 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "12.0.0" + }, + { + "fixed": "12.0.1" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8749" }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/cf197ec2d682fb4da777df2291ca7ef101f73b77" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/ef1ccdaca9512b88878155f7d8c2c77853d91252" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1516765" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2016-002.html" @@ -47,8 +86,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:52Z", "nvd_published_at": "2016-01-15T19:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json b/advisories/github-reviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json new file mode 100644 index 00000000000..42304b3092f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json @@ -0,0 +1,127 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f4g4-cj8f-3cr9", + "modified": "2024-05-14T21:13:46Z", + "published": "2022-05-14T03:53:47Z", + "aliases": [ + "CVE-2017-7214" + ], + "summary": "OpenStack Nova logs sensitive context from notification exceptions", + "details": "An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "13.0.0" + }, + { + "fixed": "13.1.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "14.0.0" + }, + { + "fixed": "14.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.1" + }, + { + "fixed": "15.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7214" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/3f985f1eda6f29180878a3d21c20c5057179486a" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/acb19160d4d348e29a21ad57c61c7369352c4d1c" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/c2c91ce44592fc5dc2aacee1cf7f5b5cfd2e9a0a" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/e193201fa1de5b08b29adefd8c149935c5529598" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2017:1508" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2017:1595" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, + { + "type": "WEB", + "url": "https://launchpad.net/bugs/1673569" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/96998" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:46Z", + "nvd_published_at": "2017-03-21T18:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json b/advisories/github-reviewed/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json rename to advisories/github-reviewed/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json index fc7f209d337..839f54964a1 100644 --- a/advisories/unreviewed/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json +++ b/advisories/github-reviewed/2022/05/GHSA-g63p-mfcm-54c4/GHSA-g63p-mfcm-54c4.json @@ -1,27 +1,58 @@ { "schema_version": "1.4.0", "id": "GHSA-g63p-mfcm-54c4", - "modified": "2022-05-14T01:08:49Z", + "modified": "2024-05-14T21:14:03Z", "published": "2022-05-14T01:08:49Z", "aliases": [ "CVE-2014-8333" ], + "summary": "OpenStack Nova VMware instance leak potentially leading to compute DoS", "details": "The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk consumption) by deleting an instance in the resize state.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8333" }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/d71445c7d2d2921d10a08f82330f0ab8ef4f7df2" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/e1f8664c9fa83f77f5bb763ffcc3157905ed954c" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1359138" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "http://lists.openstack.org/pipermail/openstack-announce/2014-October/000298.html" @@ -44,8 +75,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:14:03Z", "nvd_published_at": "2014-10-31T14:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json b/advisories/github-reviewed/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json rename to advisories/github-reviewed/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json index 27ac0f30007..039fea04afc 100644 --- a/advisories/unreviewed/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json +++ b/advisories/github-reviewed/2022/05/GHSA-jv34-xvjq-ppch/GHSA-jv34-xvjq-ppch.json @@ -1,27 +1,58 @@ { "schema_version": "1.4.0", "id": "GHSA-jv34-xvjq-ppch", - "modified": "2022-05-17T04:48:26Z", + "modified": "2024-05-14T21:13:56Z", "published": "2022-05-17T04:48:26Z", "aliases": [ "CVE-2014-2573" ], + "summary": "OpenStack Nova VMWare driver leaks rescued images", "details": "The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2573" }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/b3cc3f62a60662e5bb82136c0cfa464592a6afe9" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/efb66531bc37ee416778a70d46c657608ca767af" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1269418" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "http://secunia.com/advisories/57498" @@ -40,8 +71,8 @@ ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:56Z", "nvd_published_at": "2014-03-25T16:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json b/advisories/github-reviewed/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json rename to advisories/github-reviewed/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json index fb1e4b7ab0d..5deb3a71cf7 100644 --- a/advisories/unreviewed/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json +++ b/advisories/github-reviewed/2022/05/GHSA-ph2h-hh49-vh27/GHSA-ph2h-hh49-vh27.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-ph2h-hh49-vh27", - "modified": "2022-05-14T01:59:13Z", + "modified": "2024-05-14T21:13:48Z", "published": "2022-05-14T01:59:13Z", "aliases": [ "CVE-2013-4185" ], + "summary": "OpenStack Nova Denial of Service in network source security groups", "details": "Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,22 @@ "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1184041" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, + { + "type": "WEB", + "url": "http://github.com/openstack/nova/commit/52ad911963da4095b213952dee3a430fe0c4c30f" + }, + { + "type": "WEB", + "url": "http://github.com/openstack/nova/commit/85aac04704350566d6b06aa7a3b99649946c672c" + }, + { + "type": "WEB", + "url": "http://github.com/openstack/nova/commit/d4ee081c5c0a5132781235177c430ebcf72b0b0b" + }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-1199.html" @@ -36,8 +71,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:48Z", "nvd_published_at": "2013-10-29T22:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json b/advisories/github-reviewed/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json similarity index 67% rename from advisories/unreviewed/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json rename to advisories/github-reviewed/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json index e31fbeb15ac..d68470121f0 100644 --- a/advisories/unreviewed/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json +++ b/advisories/github-reviewed/2022/05/GHSA-qr62-r9xc-r2gj/GHSA-qr62-r9xc-r2gj.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-qr62-r9xc-r2gj", - "modified": "2022-05-14T01:58:50Z", + "modified": "2024-05-14T21:13:50Z", "published": "2022-05-14T01:58:50Z", "aliases": [ "CVE-2011-4596" ], + "summary": "OpenStack Nova Multiple directory traversal vulnerabilities", "details": "Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { @@ -34,6 +53,10 @@ "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/894755" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "https://lists.launchpad.net/openstack/msg06105.html" @@ -44,8 +67,8 @@ "CWE-22" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:50Z", "nvd_published_at": "2011-12-23T22:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json b/advisories/github-reviewed/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json similarity index 51% rename from advisories/unreviewed/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json rename to advisories/github-reviewed/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json index 87e9992b939..5a0b3c27a29 100644 --- a/advisories/unreviewed/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json +++ b/advisories/github-reviewed/2022/05/GHSA-w429-xc55-hc48/GHSA-w429-xc55-hc48.json @@ -1,27 +1,62 @@ { "schema_version": "1.4.0", "id": "GHSA-w429-xc55-hc48", - "modified": "2022-05-17T04:41:34Z", + "modified": "2024-05-14T21:13:59Z", "published": "2022-05-17T04:41:34Z", "aliases": [ "CVE-2014-0134" ], + "summary": "OpenStack Nova host data leak to vm instance in rescue mode", "details": "The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "12.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0134" }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/25e761acd56d4c820273fc0245ada06c500c1637" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/d416f4310bb946b4b127201ec3c37e530d988714" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/nova/commit/dc8de426066969a3f0624fdc2a7b29371a2d55bf" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/nova/+bug/1221190" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/nova" + }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2014/03/27/6" @@ -36,8 +71,8 @@ "CWE-200" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:13:59Z", "nvd_published_at": "2014-05-08T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json b/advisories/unreviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json deleted file mode 100644 index 43b22798c4c..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f4g4-cj8f-3cr9/GHSA-f4g4-cj8f-3cr9.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f4g4-cj8f-3cr9", - "modified": "2022-05-14T03:53:47Z", - "published": "2022-05-14T03:53:47Z", - "aliases": [ - "CVE-2017-7214" - ], - "details": "An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7214" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2017:1508" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2017:1595" - }, - { - "type": "WEB", - "url": "https://launchpad.net/bugs/1673569" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/96998" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-532" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-03-21T18:59:00Z" - } -} \ No newline at end of file