Publish Advisories

GHSA-6hqr-c69m-r76q
GHSA-xq54-x54m-vcpx
GHSA-xq54-x54m-vcpx

advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json

@@ -1,19 +1,47 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6hqr-c69m-r76q",
-  "modified": "2024-12-05T18:31:02Z",
+  "modified": "2024-12-05T19:57:26Z",
   "published": "2024-12-05T12:31:28Z",
   "aliases": [
     "CVE-2022-41137"
   ],
+  "summary": "Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore",
   "details": "Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.apache.hive:hive-exec"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0-alpha-1"
+            },
+            {
+              "fixed": "4.0.0-alpha-2"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "4.0.0-alpha-1"
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -24,7 +52,7 @@
       "url": "https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9"
     },
     {
-      "type": "WEB",
+      "type": "PACKAGE",
       "url": "https://github.com/apache/hive"
     },
     {
@@ -45,8 +73,8 @@
       "CWE-502"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-05T19:57:26Z",
     "nvd_published_at": "2024-12-05T10:15:04Z"
   }
 }

advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json

@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xq54-x54m-vcpx",
+  "modified": "2024-12-05T19:58:07Z",
+  "published": "2024-12-05T15:31:02Z",
+  "aliases": [
+    "CVE-2024-11941"
+  ],
+  "summary": "Drupal core Denial of Service",
+  "details": "The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).\n\nSites that do not use the Comment module are not affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "10.1.0"
+            },
+            {
+              "fixed": "10.1.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "10.2.0"
+            },
+            {
+              "fixed": "10.2.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/core"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2024-001"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-835"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-05T19:58:07Z",
+    "nvd_published_at": "2024-12-05T15:15:08Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json

@@ -1,36 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-xq54-x54m-vcpx",
-  "modified": "2024-12-05T18:31:03Z",
-  "published": "2024-12-05T15:31:02Z",
-  "aliases": [
-    "CVE-2024-11941"
-  ],
-  "details": "A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.drupal.org/sa-core-2024-001"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-835"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-12-05T15:15:08Z"
-  }
-}