From 70a90b1824da68ce6e71d28f469cfd2de75bd4a8 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 8 Feb 2023 18:12:42 +0000 Subject: [PATCH] Publish Advisories GHSA-527r-mfmj-prqf GHSA-5xrj-ghhp-hx7p GHSA-67rh-9p29-vrxr --- .../GHSA-527r-mfmj-prqf.json | 35 ++++++++++-- .../GHSA-5xrj-ghhp-hx7p.json | 35 +++++++++--- .../GHSA-67rh-9p29-vrxr.json | 54 ++++++++++++++++--- 3 files changed, 108 insertions(+), 16 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json (62%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json (69%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json (62%) diff --git a/advisories/unreviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json b/advisories/github-reviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json rename to advisories/github-reviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json index 5835318e9e7..16c46c5c4f4 100644 --- a/advisories/unreviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json +++ b/advisories/github-reviewed/2022/05/GHSA-527r-mfmj-prqf/GHSA-527r-mfmj-prqf.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-527r-mfmj-prqf", - "modified": "2022-05-14T01:09:00Z", + "modified": "2023-02-08T18:11:20Z", "published": "2022-05-14T01:09:00Z", "aliases": [ "CVE-2016-3072" ], + "summary": "Katello SQL Injection vulnerabilities", "details": "Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "RubyGems", + "name": "katello" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/Katello/katello/pull/6051" }, + { + "type": "WEB", + "url": "https://github.com/Katello/katello/commit/5645ed4365980a34e30a9c57fe0793dff729e8e4" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1083" @@ -36,6 +59,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1322050" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Katello/katello" } ], "database_specific": { @@ -43,8 +70,8 @@ "CWE-89" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:11:20Z", "nvd_published_at": "2016-06-07T18:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json b/advisories/github-reviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json similarity index 69% rename from advisories/unreviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json rename to advisories/github-reviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json index 5e1030e09d7..0c3c704c223 100644 --- a/advisories/unreviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json +++ b/advisories/github-reviewed/2022/05/GHSA-5xrj-ghhp-hx7p/GHSA-5xrj-ghhp-hx7p.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-5xrj-ghhp-hx7p", - "modified": "2022-05-17T03:43:30Z", + "modified": "2023-02-08T18:11:54Z", "published": "2022-05-17T03:43:30Z", "aliases": [ "CVE-2016-0757" ], + "summary": "OpenStack Image Service (Glance) vulnerable to Improper Access Control", "details": "OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "glance" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0" + }, + { + "fixed": "11.0.2" + } + ] + } + ] + } ], "references": [ { @@ -45,17 +64,21 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1302607" }, + { + "type": "PACKAGE", + "url": "https://opendev.org/openstack/glance" + }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2016-006.html" }, { "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2016-0309.html" + "url": "https://web.archive.org/web/20210123081823/https://www.securityfocus.com/bid/82696/" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/82696" + "url": "http://rhn.redhat.com/errata/RHSA-2016-0309.html" } ], "database_specific": { @@ -63,8 +86,8 @@ "CWE-284" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:11:54Z", "nvd_published_at": "2016-04-13T17:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json b/advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json rename to advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json index d01e225b2a4..6b9cc38b934 100644 --- a/advisories/unreviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json +++ b/advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json @@ -1,17 +1,55 @@ { "schema_version": "1.3.0", "id": "GHSA-67rh-9p29-vrxr", - "modified": "2022-05-14T01:58:45Z", + "modified": "2023-02-08T18:12:12Z", "published": "2022-05-14T01:58:45Z", "aliases": [ "CVE-2015-7713" ], + "summary": "OpenStack Compute (Nova) allows remote attackers to bypass intended restriction", "details": "OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2014.2.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "nova" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2015.1.0" + }, + { + "fixed": "2015.1.2" + } + ] + } + ] + } ], "references": [ { @@ -50,17 +88,21 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1269119" }, + { + "type": "PACKAGE", + "url": "https://opendev.org/openstack/nova" + }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2015-021.html" }, { "type": "WEB", - "url": "http://rhn.redhat.com/errata/RHSA-2015-2684.html" + "url": "https://web.archive.org/web/20200228024902/http://www.securityfocus.com/bid/76960" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/76960" + "url": "http://rhn.redhat.com/errata/RHSA-2015-2684.html" } ], "database_specific": { @@ -68,8 +110,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:12:12Z", "nvd_published_at": "2015-10-29T20:59:00Z" } } \ No newline at end of file