netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-56jp-w6vw-j3jw
GHSA-57m2-h3fw-rxhw
GHSA-pq2g-wx69-c263
GHSA-56jp-w6vw-j3jw
GHSA-57m2-h3fw-rxhw
This commit is contained in:
advisory-database[bot]
2025-02-06 19:02:55 +00:00
parent 74ca1b72be
commit 70e5abbb1c
5 changed files with 224 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json
+89
View File
@@ -0,0 +1,89 @@
{
"schema_version": "1.4.0",
"id": "GHSA-56jp-w6vw-j3jw",
"modified": "2025-02-06T19:01:59Z",
"published": "2025-02-06T12:31:58Z",
"aliases": [
"CVE-2024-37358"
],
"summary": "Apache James vulnerable to denial of service through the use of IMAP literals",
"details": "Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations\n\nVersion 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.james.protocols:protocols-imap"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.james.protocols:protocols-imap"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.8.0"
},
{
"fixed": "3.8.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37358"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-project/commit/6dd3ad9ea1f6a9bc887d2c7af3f5aa30a60ec769"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-project/commit/b2f3c06edfd37b409121bf04c56a6f026048a77e"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/james-project"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T19:01:59Z",
"nvd_published_at": "2025-02-06T12:15:26Z"
}
}
advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-57m2-h3fw-rxhw",
"modified": "2025-02-06T19:02:30Z",
"published": "2025-02-06T12:31:58Z",
"aliases": [
"CVE-2024-45626"
],
"summary": "Apache James vulnerable to denial of service through JMAP HTML to text conversion",
"details": "Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.\n\nUsers are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.james:james-server-jmap-draft"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.8.0"
},
{
"fixed": "3.8.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.james:james-server-jmap-draft"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45626"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-project/pull/1422"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-project/commit/372f1f83b6825fb0f92147803a9bf215b8ff690d"
},
{
"type": "WEB",
"url": "https://github.com/apache/james-project/commit/537ae380f9837f74c075f0ed2b625affa9b20122"
},
{
"type": "PACKAGE",
"url": "https://github.com/linagora/james-project"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/05/7"
}
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T19:02:30Z",
"nvd_published_at": "2025-02-06T12:15:27Z"
}
}
advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json → advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json
+39 -7
View File
@@ -1,14 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pq2g-wx69-c263",
"modified": "2025-02-06T06:31:26Z",
"modified": "2025-02-06T19:01:17Z",
"published": "2025-02-06T06:31:26Z",
"aliases": [
"CVE-2024-57699"
],
"summary": "Netplex Json-smart Uncontrolled Recursion vulnerability",
"details": "A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.minidev:json-smart"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"last_affected": "2.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -18,16 +44,22 @@
"type": "WEB",
"url": "https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699"
},
{
"type": "PACKAGE",
"url": "https://github.com/netplex/json-smart-v2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-1370"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"cwe_ids": [
"CWE-674"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T19:01:17Z",
"nvd_published_at": "2025-02-05T22:15:33Z"
}
}
advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-56jp-w6vw-j3jw",
"modified": "2025-02-06T12:31:58Z",
"published": "2025-02-06T12:31:58Z",
"aliases": [
"CVE-2024-37358"
],
"details": "Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations\n\nVersion 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37358"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T12:15:26Z"
}
}
advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json
-40
View File
@@ -1,40 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-57m2-h3fw-rxhw",
"modified": "2025-02-06T12:31:58Z",
"published": "2025-02-06T12:31:58Z",
"aliases": [
"CVE-2024-45626"
],
"details": "Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.\n\nUsers are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45626"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/05/7"
}
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T12:15:27Z"
}
}