diff --git a/advisories/unreviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json b/advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json similarity index 66% rename from advisories/unreviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json rename to advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json index a43eab23835..97cae0a4b0e 100644 --- a/advisories/unreviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json +++ b/advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json @@ -1,19 +1,47 @@ { "schema_version": "1.4.0", "id": "GHSA-6hqr-c69m-r76q", - "modified": "2024-12-05T18:31:02Z", + "modified": "2024-12-05T19:57:26Z", "published": "2024-12-05T12:31:28Z", "aliases": [ "CVE-2022-41137" ], + "summary": "Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore", "details": "Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.hive:hive-exec" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0-alpha-1" + }, + { + "fixed": "4.0.0-alpha-2" + } + ] + } + ], + "versions": [ + "4.0.0-alpha-1" + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -24,7 +52,7 @@ "url": "https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/apache/hive" }, { @@ -45,8 +73,8 @@ "CWE-502" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-05T19:57:26Z", "nvd_published_at": "2024-12-05T10:15:04Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json b/advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json new file mode 100644 index 00000000000..e1c5f771461 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xq54-x54m-vcpx", + "modified": "2024-12-05T19:58:07Z", + "published": "2024-12-05T15:31:02Z", + "aliases": [ + "CVE-2024-11941" + ], + "summary": "Drupal core Denial of Service", + "details": "The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).\n\nSites that do not use the Comment module are not affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0" + }, + { + "fixed": "10.1.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.2.0" + }, + { + "fixed": "10.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2024-001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-835" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-12-05T19:58:07Z", + "nvd_published_at": "2024-12-05T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json b/advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json deleted file mode 100644 index 89c8097c8ae..00000000000 --- a/advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xq54-x54m-vcpx", - "modified": "2024-12-05T18:31:03Z", - "published": "2024-12-05T15:31:02Z", - "aliases": [ - "CVE-2024-11941" - ], - "details": "A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2024-001" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-835" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-12-05T15:15:08Z" - } -} \ No newline at end of file