Publish Advisories

GHSA-jwfr-h6jp-9p2g
GHSA-h5gf-cmm8-cg7c

advisories/github-reviewed/2022/05/GHSA-jwfr-h6jp-9p2g/GHSA-jwfr-h6jp-9p2g.json

@@ -1,17 +1,55 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jwfr-h6jp-9p2g",
-  "modified": "2022-05-05T02:48:30Z",
+  "modified": "2024-03-06T15:23:11Z",
   "published": "2022-05-05T02:48:30Z",
   "aliases": [
     "CVE-2013-0158"
   ],
+  "summary": "Jenkins allows attackers to obtain the master cryptographic key",
   "details": "Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.main:jenkins-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.481"
+            },
+            {
+              "fixed": "1.498"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.main:jenkins-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.480.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -26,10 +64,30 @@
       "type": "WEB",
       "url": "https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/jenkins/commit/48ecccc1669f325acf72953923f9d9620b2590e3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/jenkins/commit/56e4b6e287046e4ad2a02f8bd70225a86e74bd34"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/jenkins/commit/7983ae3baea779df18862623d594744b8d285392"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/jenkins/commit/9fb6c2ca0c73b43cc2e6d08c09707ee67005e526"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/jenkins/commit/a411b0c3b32eb314d5a26b64de1b3d5db2760443"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fd"
@@ -38,10 +96,18 @@
       "type": "WEB",
       "url": "https://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/jenkins/commit/e401c7cfe7b28b6ff9d0893e89c2568596b96915"
+    },
     {
       "type": "WEB",
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=892795"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/jenkinsci/jenkins"
+    },
     {
       "type": "WEB",
       "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04"
@@ -64,8 +130,8 @@
 
     ],
     "severity": "LOW",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-06T15:23:11Z",
     "nvd_published_at": "2013-02-24T22:55:00Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-h5gf-cmm8-cg7c/GHSA-h5gf-cmm8-cg7c.json

@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h5gf-cmm8-cg7c",
+  "modified": "2024-03-06T15:22:07Z",
+  "published": "2024-03-06T15:22:07Z",
+  "aliases": [
+    "CVE-2024-24765"
+  ],
+  "summary": "CasaOS-UserService allows unauthorized access to any file",
+  "details": "### Summary\n\nhttp://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png\n\nOriginally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system.\n\n\n### Details\n\nConstruct paths to get any file.\n\nSuch as the CasaOS user database, and furthermore can obtain system root privileges.\n\n### PoC\n\nhttp://demo.casaos.io/v1/users/image?path=/var/lib/casaos/conf/../db/user.db\n\n### Impact\n\nv0.4.6 all previous versions\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/IceWhaleTech/CasaOS-UserService"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.4.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/security/advisories/GHSA-h5gf-cmm8-cg7c"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/commit/3f4558e23c0a9958f9a0e20aabc64aa8fd51840e"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/IceWhaleTech/CasaOS-UserService/releases/tag/v0.4.7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-06T15:22:07Z",
+    "nvd_published_at": null
+  }
+}