From 657497cc08dc6067d8172a60b5428d09af394967 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Feb 2024 00:23:17 +0000 Subject: [PATCH] Publish Advisories GHSA-36xr-4x2f-cfj9 GHSA-ff2w-wm48-jhqj GHSA-m43p-55rf-8c2j GHSA-vjqc-g788-f378 GHSA-36xr-4x2f-cfj9 GHSA-m43p-55rf-8c2j --- .../GHSA-36xr-4x2f-cfj9.json | 147 ++++++++++++++++++ .../GHSA-ff2w-wm48-jhqj.json | 33 +++- .../GHSA-m43p-55rf-8c2j.json | 119 ++++++++++++++ .../GHSA-vjqc-g788-f378.json | 35 ++++- .../GHSA-36xr-4x2f-cfj9.json | 35 ----- .../GHSA-m43p-55rf-8c2j.json | 35 ----- 6 files changed, 323 insertions(+), 81 deletions(-) create mode 100644 advisories/github-reviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json (61%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json (58%) delete mode 100644 advisories/unreviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json diff --git a/advisories/github-reviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json b/advisories/github-reviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json new file mode 100644 index 00000000000..b74aa345554 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json @@ -0,0 +1,147 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-36xr-4x2f-cfj9", + "modified": "2024-02-21T00:22:48Z", + "published": "2024-02-20T15:31:06Z", + "aliases": [ + "CVE-2024-22369" + ], + "summary": "Deserialization of Untrusted Data in Apache Camel SQL", + "details": "Deserialization of Untrusted Data vulnerability in Apache Camel SQL Component. This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.\n\nUsers are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1\n\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-sql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.21.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-sql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.22.0" + }, + { + "fixed": "3.22.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-sql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-sql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "fixed": "4.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22369" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12706" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12707" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12708" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12709" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12716" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12717" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12718" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12719" + }, + { + "type": "WEB", + "url": "https://github.com/apache/camel/pull/12789" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/3dko781dy2gy5l3fs48p56fgp429yb0f" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:22:48Z", + "nvd_published_at": "2024-02-20T15:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json b/advisories/github-reviewed/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json similarity index 61% rename from advisories/unreviewed/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json rename to advisories/github-reviewed/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json index 9821deaa31a..0f82447a416 100644 --- a/advisories/unreviewed/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json +++ b/advisories/github-reviewed/2024/02/GHSA-ff2w-wm48-jhqj/GHSA-ff2w-wm48-jhqj.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-ff2w-wm48-jhqj", - "modified": "2024-02-20T15:31:03Z", + "modified": "2024-02-21T00:21:46Z", "published": "2024-02-20T12:31:00Z", "aliases": [ "CVE-2023-51770" ], + "summary": "Arbitrary File Read Vulnerability in Apache Dolphinscheduler", "details": "Arbitrary File Read Vulnerability in Apache Dolphinscheduler.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1. \n\nWe recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.dolphinscheduler:dolphinscheduler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.1" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://github.com/apache/dolphinscheduler/pull/15433" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/dolphinscheduler" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/4t8bdjqnfhldh73gy9p0whlgvnnbtn7g" @@ -39,9 +62,9 @@ "cwe_ids": [ "CWE-94" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:21:46Z", "nvd_published_at": "2024-02-20T10:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json b/advisories/github-reviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json new file mode 100644 index 00000000000..b1d7577af80 --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json @@ -0,0 +1,119 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m43p-55rf-8c2j", + "modified": "2024-02-21T00:22:04Z", + "published": "2024-02-20T15:31:06Z", + "aliases": [ + "CVE-2024-23114" + ], + "summary": "Deserialization of Untrusted Data in Apache Camel CassandraQL", + "details": "Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.\n\nUsers are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1\n\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-cassandraql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.21.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-cassandraql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.22.0" + }, + { + "fixed": "3.22.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-cassandraql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.camel:camel-cassandraql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "fixed": "4.4.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23114" + }, + { + "type": "WEB", + "url": "https://camel.apache.org/security/CVE-2024-23114.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/camel" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/CAMEL-20306" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:22:04Z", + "nvd_published_at": "2024-02-20T15:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json b/advisories/github-reviewed/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json similarity index 58% rename from advisories/unreviewed/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json rename to advisories/github-reviewed/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json index 5ac399c0e97..e731445a96b 100644 --- a/advisories/unreviewed/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json +++ b/advisories/github-reviewed/2024/02/GHSA-vjqc-g788-f378/GHSA-vjqc-g788-f378.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-vjqc-g788-f378", - "modified": "2024-02-20T15:31:03Z", + "modified": "2024-02-21T00:21:28Z", "published": "2024-02-20T12:31:00Z", "aliases": [ "CVE-2023-50270" ], - "details": "Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue.", + "summary": "Session Fixation Apache DolphinScheduler", + "details": "Session Fixation Apache DolphinScheduler before version 3.2.1, which session is still valid after the password change.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes this issue.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.dolphinscheduler:dolphinscheduler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.1" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://github.com/apache/dolphinscheduler/pull/15219" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/dolphinscheduler" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/94prw8hyk60vvw7s6cs3tr708qzqlwl6" @@ -39,9 +62,9 @@ "cwe_ids": [ "CWE-613" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-21T00:21:28Z", "nvd_published_at": "2024-02-20T10:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json b/advisories/unreviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json deleted file mode 100644 index aa4c848c05a..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-36xr-4x2f-cfj9/GHSA-36xr-4x2f-cfj9.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-36xr-4x2f-cfj9", - "modified": "2024-02-20T15:31:06Z", - "published": "2024-02-20T15:31:06Z", - "aliases": [ - "CVE-2024-22369" - ], - "details": "Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.\n\nUsers are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1\n\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22369" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/3dko781dy2gy5l3fs48p56fgp429yb0f" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-20T15:15:10Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json b/advisories/unreviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json deleted file mode 100644 index fbe9ac9ba4d..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-m43p-55rf-8c2j/GHSA-m43p-55rf-8c2j.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m43p-55rf-8c2j", - "modified": "2024-02-20T15:31:06Z", - "published": "2024-02-20T15:31:06Z", - "aliases": [ - "CVE-2024-23114" - ], - "details": "Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0.\n\nUsers are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1\n\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23114" - }, - { - "type": "WEB", - "url": "https://camel.apache.org/security/CVE-2024-23114.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-20T15:15:10Z" - } -} \ No newline at end of file