diff --git a/advisories/unreviewed/2024/12/GHSA-9mgx-552f-59p6/GHSA-9mgx-552f-59p6.json b/advisories/github-reviewed/2024/12/GHSA-9mgx-552f-59p6/GHSA-9mgx-552f-59p6.json similarity index 51% rename from advisories/unreviewed/2024/12/GHSA-9mgx-552f-59p6/GHSA-9mgx-552f-59p6.json rename to advisories/github-reviewed/2024/12/GHSA-9mgx-552f-59p6/GHSA-9mgx-552f-59p6.json index 88ee6ea2020..dfd9322f268 100644 --- a/advisories/unreviewed/2024/12/GHSA-9mgx-552f-59p6/GHSA-9mgx-552f-59p6.json +++ b/advisories/github-reviewed/2024/12/GHSA-9mgx-552f-59p6/GHSA-9mgx-552f-59p6.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-9mgx-552f-59p6", - "modified": "2024-12-27T06:30:47Z", + "modified": "2024-12-27T19:54:48Z", "published": "2024-12-27T06:30:47Z", "aliases": [ "CVE-2024-56521" ], + "summary": "TCPDF missing certificate validation", "details": "An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "tecnickcom/tcpdf" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.8.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,6 +44,10 @@ "type": "WEB", "url": "https://github.com/tecnickcom/TCPDF/commit/aab43ab0a824e956276141a28a24c7c0be20f554" }, + { + "type": "PACKAGE", + "url": "https://github.com/tecnickcom/TCPDF" + }, { "type": "WEB", "url": "https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0" @@ -31,9 +61,9 @@ "cwe_ids": [ "CWE-295" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-12-27T19:54:48Z", "nvd_published_at": "2024-12-27T05:15:07Z" } } \ No newline at end of file