From 692cf32b878abfe02e86a72cfeb2c2bfbdaf78eb Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 22 Dec 2022 14:03:56 +0000 Subject: [PATCH] Publish Advisories GHSA-5qff-7944-vq4f GHSA-m7pr-m4cx-6m22 GHSA-5qff-7944-vq4f GHSA-m7pr-m4cx-6m22 --- .../GHSA-5qff-7944-vq4f.json | 64 +++++++++++++++++++ .../GHSA-m7pr-m4cx-6m22.json | 63 ++++++++++++++++++ .../GHSA-5qff-7944-vq4f.json | 37 ----------- .../GHSA-m7pr-m4cx-6m22.json | 37 ----------- 4 files changed, 127 insertions(+), 74 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json diff --git a/advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json b/advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json new file mode 100644 index 00000000000..2cdb7c45664 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-5qff-7944-vq4f", + "modified": "2022-12-22T14:02:34Z", + "published": "2022-05-24T17:12:41Z", + "aliases": [ + "CVE-2020-2168" + ], + "summary": "RCE vulnerability in Jenkins Azure Container Service Plugin", + "details": "Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Azure Container Service Plugin’s build step.\n\nAzure Container Service Plugin 1.0.2 configures its YAML parser to only instantiate safe types.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:azure-acs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2168" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/azure-acs-plugin" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json b/advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json new file mode 100644 index 00000000000..8d3c053404c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.3.0", + "id": "GHSA-m7pr-m4cx-6m22", + "modified": "2022-12-22T14:03:16Z", + "published": "2022-05-24T17:12:41Z", + "aliases": [ + "CVE-2020-2169" + ], + "summary": "Reflected XSS vulnerability in Jenkins Queue cleanup Plugin", + "details": "A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).\n\nQueue cleanup Plugin 1.4 correctly escapes the query parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:queue-cleanup" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2169" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jenkinsci/queue-cleanup-plugin" + }, + { + "type": "WEB", + "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json b/advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json deleted file mode 100644 index 20ecd90c5bd..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5qff-7944-vq4f/GHSA-5qff-7944-vq4f.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.3.0", - "id": "GHSA-5qff-7944-vq4f", - "modified": "2022-05-24T17:12:41Z", - "published": "2022-05-24T17:12:41Z", - "aliases": [ - "CVE-2020-2168" - ], - "details": "Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2168" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1732" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json b/advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json deleted file mode 100644 index faa9d75f602..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m7pr-m4cx-6m22/GHSA-m7pr-m4cx-6m22.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.3.0", - "id": "GHSA-m7pr-m4cx-6m22", - "modified": "2022-05-24T17:12:41Z", - "published": "2022-05-24T17:12:41Z", - "aliases": [ - "CVE-2020-2169" - ], - "details": "A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message, resulting in a reflected XSS vulnerability.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2169" - }, - { - "type": "WEB", - "url": "https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1724" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2020/03/25/2" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false - } -} \ No newline at end of file