diff --git a/advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json b/advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json new file mode 100644 index 00000000000..5a4f0ac3751 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json @@ -0,0 +1,89 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-56jp-w6vw-j3jw", + "modified": "2025-02-06T19:01:59Z", + "published": "2025-02-06T12:31:58Z", + "aliases": [ + "CVE-2024-37358" + ], + "summary": "Apache James vulnerable to denial of service through the use of IMAP literals", + "details": "Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations\n\nVersion 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james.protocols:protocols-imap" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james.protocols:protocols-imap" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37358" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/6dd3ad9ea1f6a9bc887d2c7af3f5aa30a60ec769" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/b2f3c06edfd37b409121bf04c56a6f026048a77e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/james-project" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T19:01:59Z", + "nvd_published_at": "2025-02-06T12:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json b/advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json new file mode 100644 index 00000000000..2a3fee27572 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-57m2-h3fw-rxhw", + "modified": "2025-02-06T19:02:30Z", + "published": "2025-02-06T12:31:58Z", + "aliases": [ + "CVE-2024-45626" + ], + "summary": "Apache James vulnerable to denial of service through JMAP HTML to text conversion", + "details": "Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.\n\nUsers are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james:james-server-jmap-draft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james:james-server-jmap-draft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45626" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/pull/1422" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/372f1f83b6825fb0f92147803a9bf215b8ff690d" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/537ae380f9837f74c075f0ed2b625affa9b20122" + }, + { + "type": "PACKAGE", + "url": "https://github.com/linagora/james-project" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/02/05/7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T19:02:30Z", + "nvd_published_at": "2025-02-06T12:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json b/advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json similarity index 51% rename from advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json rename to advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json index bf325018e36..82f570d2d27 100644 --- a/advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json +++ b/advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-pq2g-wx69-c263", - "modified": "2025-02-06T06:31:26Z", + "modified": "2025-02-06T19:01:17Z", "published": "2025-02-06T06:31:26Z", "aliases": [ "CVE-2024-57699" ], + "summary": "Netplex Json-smart Uncontrolled Recursion vulnerability", "details": "A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "net.minidev:json-smart" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "last_affected": "2.5.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,16 +44,22 @@ "type": "WEB", "url": "https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699" }, + { + "type": "PACKAGE", + "url": "https://github.com/netplex/json-smart-v2" + }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/cve-2023-1370" } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-674" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T19:01:17Z", "nvd_published_at": "2025-02-05T22:15:33Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json b/advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json deleted file mode 100644 index 0400b4dc670..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-56jp-w6vw-j3jw", - "modified": "2025-02-06T12:31:58Z", - "published": "2025-02-06T12:31:58Z", - "aliases": [ - "CVE-2024-37358" - ], - "details": "Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations\n\nVersion 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37358" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-06T12:15:26Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json b/advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json deleted file mode 100644 index 29875302ddb..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-57m2-h3fw-rxhw", - "modified": "2025-02-06T12:31:58Z", - "published": "2025-02-06T12:31:58Z", - "aliases": [ - "CVE-2024-45626" - ], - "details": "Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.\n\nUsers are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45626" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/02/05/7" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-06T12:15:27Z" - } -} \ No newline at end of file