From 6f6896aee67626be62cf8bcd2c6ccfe0a19d4591 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 5 Dec 2024 19:58:33 +0000 Subject: [PATCH] Publish Advisories GHSA-6hqr-c69m-r76q GHSA-xq54-x54m-vcpx GHSA-xq54-x54m-vcpx --- .../GHSA-6hqr-c69m-r76q.json | 38 +++++++-- .../GHSA-xq54-x54m-vcpx.json | 80 +++++++++++++++++++ .../GHSA-xq54-x54m-vcpx.json | 36 --------- 3 files changed, 113 insertions(+), 41 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json (66%) create mode 100644 advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json delete mode 100644 advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json diff --git a/advisories/unreviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json b/advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json similarity index 66% rename from advisories/unreviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json rename to advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json index a43eab23835..97cae0a4b0e 100644 --- a/advisories/unreviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json +++ b/advisories/github-reviewed/2024/12/GHSA-6hqr-c69m-r76q/GHSA-6hqr-c69m-r76q.json @@ -1,19 +1,47 @@ { "schema_version": "1.4.0", "id": "GHSA-6hqr-c69m-r76q", - "modified": "2024-12-05T18:31:02Z", + "modified": "2024-12-05T19:57:26Z", "published": "2024-12-05T12:31:28Z", "aliases": [ "CVE-2022-41137" ], + "summary": "Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore", "details": "Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and can lead to Remote Code Execution (RCE) since it allows the deserialization of arbitrary data.\n\nIn real deployments, the vulnerability can be exploited only by authenticated users/clients that were able to successfully establish a connection to the Metastore. From an API perspective any code that calls the unsafe method may be vulnerable unless it performs additional prerechecks on the input arguments.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.hive:hive-exec" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0-alpha-1" + }, + { + "fixed": "4.0.0-alpha-2" + } + ] + } + ], + "versions": [ + "4.0.0-alpha-1" + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -24,7 +52,7 @@ "url": "https://github.com/apache/hive/commit/60027bb9c91a93affcfebd9068f064bc1f2a74c9" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/apache/hive" }, { @@ -45,8 +73,8 @@ "CWE-502" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-05T19:57:26Z", "nvd_published_at": "2024-12-05T10:15:04Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json b/advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json new file mode 100644 index 00000000000..e1c5f771461 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xq54-x54m-vcpx", + "modified": "2024-12-05T19:58:07Z", + "published": "2024-12-05T15:31:02Z", + "aliases": [ + "CVE-2024-11941" + ], + "summary": "Drupal core Denial of Service", + "details": "The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).\n\nSites that do not use the Comment module are not affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0" + }, + { + "fixed": "10.1.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "drupal/core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.2.0" + }, + { + "fixed": "10.2.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941" + }, + { + "type": "PACKAGE", + "url": "https://github.com/drupal/core" + }, + { + "type": "WEB", + "url": "https://www.drupal.org/sa-core-2024-001" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-835" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-12-05T19:58:07Z", + "nvd_published_at": "2024-12-05T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json b/advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json deleted file mode 100644 index 89c8097c8ae..00000000000 --- a/advisories/unreviewed/2024/12/GHSA-xq54-x54m-vcpx/GHSA-xq54-x54m-vcpx.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-xq54-x54m-vcpx", - "modified": "2024-12-05T18:31:03Z", - "published": "2024-12-05T15:31:02Z", - "aliases": [ - "CVE-2024-11941" - ], - "details": "A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941" - }, - { - "type": "WEB", - "url": "https://www.drupal.org/sa-core-2024-001" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-835" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-12-05T15:15:08Z" - } -} \ No newline at end of file