From 6e8cda0840f106efc1bad39b8ab14fbc4611032a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 21 Mar 2025 23:58:09 +0000
Subject: [PATCH] Publish Advisories

GHSA-32g6-mg92-ghm2
GHSA-hc5x-x2vx-497g
---
 .../GHSA-32g6-mg92-ghm2.json                  | 33 +++++++++++++++--
 .../GHSA-hc5x-x2vx-497g.json                  | 37 +++++++++++++++++--
 2 files changed, 62 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json (64%)
 rename advisories/{unreviewed => github-reviewed}/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json (60%)

diff --git a/advisories/unreviewed/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json b/advisories/github-reviewed/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json
similarity index 64%
rename from advisories/unreviewed/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json
rename to advisories/github-reviewed/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json
index 454bdee8086..6d6131442f9 100644
--- a/advisories/unreviewed/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json
+++ b/advisories/github-reviewed/2025/03/GHSA-32g6-mg92-ghm2/GHSA-32g6-mg92-ghm2.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-32g6-mg92-ghm2",
-  "modified": "2025-03-20T12:32:52Z",
+  "modified": "2025-03-21T23:57:42Z",
   "published": "2025-03-20T12:32:52Z",
   "aliases": [
     "CVE-2025-0508"
   ],
+  "summary": "SageMaker Workflow component allows possibility of MD5 hash collisions",
   "details": "A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "sagemaker"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.237.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -23,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/aws/sagemaker-python-sdk"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2"
@@ -33,8 +58,8 @@
       "CWE-440"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-21T23:57:42Z",
     "nvd_published_at": "2025-03-20T10:15:53Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json b/advisories/github-reviewed/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json
similarity index 60%
rename from advisories/unreviewed/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json
rename to advisories/github-reviewed/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json
index 15074ae2497..7730c412a9c 100644
--- a/advisories/unreviewed/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json
+++ b/advisories/github-reviewed/2025/03/GHSA-hc5x-x2vx-497g/GHSA-hc5x-x2vx-497g.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hc5x-x2vx-497g",
-  "modified": "2025-03-20T12:32:45Z",
+  "modified": "2025-03-21T23:56:30Z",
   "published": "2025-03-20T12:32:45Z",
   "aliases": [
     "CVE-2024-6827"
   ],
+  "summary": "Gunicorn HTTP Request/Response Smuggling vulnerability",
   "details": "Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.",
   "severity": [
     {
@@ -13,12 +14,40 @@
       "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "gunicorn"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "23.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6827"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/benoitc/gunicorn/issues/3278"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/benoitc/gunicorn"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7"
@@ -29,8 +58,8 @@
       "CWE-444"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-21T23:56:30Z",
     "nvd_published_at": "2025-03-20T10:15:33Z"
   }
 }
\ No newline at end of file