diff --git a/advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json b/advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json new file mode 100644 index 00000000000..2cdb7c45664 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-5qff-7944-vq4f", + "modified": "2022-12-22T14:02:34Z", + "published": "2022-05-24T17:12:41Z", + "aliases": [ + "CVE-2020-2168" + ], + "summary": "RCE vulnerability in Jenkins Azure Container Service Plugin", + "details": "Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Azure Container Service Plugin’s build step.\n\nAzure Container Service Plugin 1.0.2 configures its YAML parser to only instantiate safe types.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:azure-acs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2168" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/azure-acs-plugin" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json b/advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json new file mode 100644 index 00000000000..8d3c053404c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-m7pr-m4cx-6m22", + "modified": "2022-12-22T14:03:16Z", + "published": "2022-05-24T17:12:41Z", + "aliases": [ + "CVE-2020-2169" + ], + "summary": "Reflected XSS vulnerability in Jenkins Queue cleanup Plugin", + "details": "A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).\n\nQueue cleanup Plugin 1.4 correctly escapes the query parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:queue-cleanup" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2169" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/queue-cleanup-plugin" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json b/advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json deleted file mode 100644 index 20ecd90c5bd..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.3.0", - "id": "GHSA-5qff-7944-vq4f", - "modified": "2022-05-24T17:12:41Z", - "published": "2022-05-24T17:12:41Z", - "aliases": [ - "CVE-2020-2168" - ], - "details": "Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2168" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json b/advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json deleted file mode 100644 index faa9d75f602..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.3.0", - "id": "GHSA-m7pr-m4cx-6m22", - "modified": "2022-05-24T17:12:41Z", - "published": "2022-05-24T17:12:41Z", - "aliases": [ - "CVE-2020-2169" - ], - "details": "A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2169" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false - } -} \ No newline at end of file