Publish Advisories

GHSA-5qff-7944-vq4f
GHSA-m7pr-m4cx-6m22
GHSA-5qff-7944-vq4f
GHSA-m7pr-m4cx-6m22

advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json

@@ -0,0 +1,64 @@
+{
+  "schema_version": "1.3.0",
+  "id": "GHSA-5qff-7944-vq4f",
+  "modified": "2022-12-22T14:02:34Z",
+  "published": "2022-05-24T17:12:41Z",
+  "aliases": [
+    "CVE-2020-2168"
+  ],
+  "summary": "RCE vulnerability in Jenkins Azure Container Service Plugin",
+  "details": "Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Azure Container Service Plugin’s build step.\n\nAzure Container Service Plugin 1.0.2 configures its YAML parser to only instantiate safe types.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:azure-acs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2168"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/azure-acs-plugin"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20",
+      "CWE-502"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true
+  }
+}

advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json

@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.3.0",
+  "id": "GHSA-m7pr-m4cx-6m22",
+  "modified": "2022-12-22T14:03:16Z",
+  "published": "2022-05-24T17:12:41Z",
+  "aliases": [
+    "CVE-2020-2169"
+  ],
+  "summary": "Reflected XSS vulnerability in Jenkins Queue cleanup Plugin",
+  "details": "A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).\n\nQueue cleanup Plugin 1.4 correctly escapes the query parameter.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:queue-cleanup"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2169"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/queue-cleanup-plugin"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true
+  }
+}

advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json

@@ -1,37 +0,0 @@
-{
-  "schema_version": "1.3.0",
-  "id": "GHSA-5qff-7944-vq4f",
-  "modified": "2022-05-24T17:12:41Z",
-  "published": "2022-05-24T17:12:41Z",
-  "aliases": [
-    "CVE-2020-2168"
-  ],
-  "details": "Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2168"
-    },
-    {
-      "type": "WEB",
-      "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false
-  }
-}

advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json

@@ -1,37 +0,0 @@
-{
-  "schema_version": "1.3.0",
-  "id": "GHSA-m7pr-m4cx-6m22",
-  "modified": "2022-05-24T17:12:41Z",
-  "published": "2022-05-24T17:12:41Z",
-  "aliases": [
-    "CVE-2020-2169"
-  ],
-  "details": "A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2169"
-    },
-    {
-      "type": "WEB",
-      "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false
-  }
-}