diff --git a/advisories/unreviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json b/advisories/github-reviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json rename to advisories/github-reviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json index 5835318e9e7..16c46c5c4f4 100644 --- a/advisories/unreviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json +++ b/advisories/github-reviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-527r-mfmj-prqf", - "modified": "2022-05-14T01:09:00Z", + "modified": "2023-02-08T18:11:20Z", "published": "2022-05-14T01:09:00Z", "aliases": [ "CVE-2016-3072" ], + "summary": "Katello SQL Injection vulnerabilities", "details": "Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "RubyGems", + "name": "katello" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Katello/katello/pull/6051" }, + { + "type": "WEB", + "url": "https://github.com/Katello/katello/commit/5645ed4365980a34e30a9c57fe0793dff729e8e4" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1083" @@ -36,6 +59,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1322050" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Katello/katello" } ], "database_specific": { @@ -43,8 +70,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:11:20Z", "nvd_published_at": "2016-06-07T18:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json b/advisories/github-reviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json similarity index 69% rename from advisories/unreviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json rename to advisories/github-reviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json index 5e1030e09d7..0c3c704c223 100644 --- a/advisories/unreviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json +++ b/advisories/github-reviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-5xrj-ghhp-hx7p", - "modified": "2022-05-17T03:43:30Z", + "modified": "2023-02-08T18:11:54Z", "published": "2022-05-17T03:43:30Z", "aliases": [ "CVE-2016-0757" ], + "summary": "OpenStack Image Service (Glance) vulnerable to Improper Access Control", "details": "OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "glance" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.0.2" + } + ] + } + ] + } ], "references": [ { @@ -45,17 +64,21 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302607" }, + { + "type": "PACKAGE", + "url": "https://opendev.org/openstack/glance" + }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2016-006.html" }, { "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0309.html" + "url": "https://web.archive.org/web/20210123081823/https://www.securityfocus.com/bid/82696/" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/82696" + "url": "http://rhn.redhat.com/errata/RHSA-2016-0309.html" } ], "database_specific": { @@ -63,8 +86,8 @@ "CWE-284" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:11:54Z", "nvd_published_at": "2016-04-13T17:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json b/advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json rename to advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json index d01e225b2a4..6b9cc38b934 100644 --- a/advisories/unreviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json +++ b/advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json @@ -1,17 +1,55 @@ { "schema_version": "1.3.0", "id": "GHSA-67rh-9p29-vrxr", - "modified": "2022-05-14T01:58:45Z", + "modified": "2023-02-08T18:12:12Z", "published": "2022-05-14T01:58:45Z", "aliases": [ "CVE-2015-7713" ], + "summary": "OpenStack Compute (Nova) allows remote attackers to bypass intended restriction", "details": "OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2014.2.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2015.1.0" + }, + { + "fixed": "2015.1.2" + } + ] + } + ] + } ], "references": [ { @@ -50,17 +88,21 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269119" }, + { + "type": "PACKAGE", + "url": "https://opendev.org/openstack/nova" + }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2015-021.html" }, { "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2015-2684.html" + "url": "https://web.archive.org/web/20200228024902/http://www.securityfocus.com/bid/76960" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/76960" + "url": "http://rhn.redhat.com/errata/RHSA-2015-2684.html" } ], "database_specific": { @@ -68,8 +110,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:12:12Z", "nvd_published_at": "2015-10-29T20:59:00Z" } } \ No newline at end of file