From 70e5abbb1c4184d8841a9c7e46740542c9c143f1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 6 Feb 2025 19:02:55 +0000 Subject: [PATCH] Publish Advisories GHSA-56jp-w6vw-j3jw GHSA-57m2-h3fw-rxhw GHSA-pq2g-wx69-c263 GHSA-56jp-w6vw-j3jw GHSA-57m2-h3fw-rxhw --- .../GHSA-56jp-w6vw-j3jw.json | 89 +++++++++++++++++ .../GHSA-57m2-h3fw-rxhw.json | 96 +++++++++++++++++++ .../GHSA-pq2g-wx69-c263.json | 46 +++++++-- .../GHSA-56jp-w6vw-j3jw.json | 36 ------- .../GHSA-57m2-h3fw-rxhw.json | 40 -------- 5 files changed, 224 insertions(+), 83 deletions(-) create mode 100644 advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json create mode 100644 advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json rename advisories/{unreviewed => github-reviewed}/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json (51%) delete mode 100644 advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json delete mode 100644 advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json diff --git a/advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json b/advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json new file mode 100644 index 00000000000..5a4f0ac3751 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json @@ -0,0 +1,89 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-56jp-w6vw-j3jw", + "modified": "2025-02-06T19:01:59Z", + "published": "2025-02-06T12:31:58Z", + "aliases": [ + "CVE-2024-37358" + ], + "summary": "Apache James vulnerable to denial of service through the use of IMAP literals", + "details": "Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations\n\nVersion 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james.protocols:protocols-imap" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james.protocols:protocols-imap" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37358" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/6dd3ad9ea1f6a9bc887d2c7af3f5aa30a60ec769" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/b2f3c06edfd37b409121bf04c56a6f026048a77e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/james-project" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T19:01:59Z", + "nvd_published_at": "2025-02-06T12:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json b/advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json new file mode 100644 index 00000000000..2a3fee27572 --- /dev/null +++ b/advisories/github-reviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-57m2-h3fw-rxhw", + "modified": "2025-02-06T19:02:30Z", + "published": "2025-02-06T12:31:58Z", + "aliases": [ + "CVE-2024-45626" + ], + "summary": "Apache James vulnerable to denial of service through JMAP HTML to text conversion", + "details": "Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.\n\nUsers are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james:james-server-jmap-draft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.james:james-server-jmap-draft" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.7.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45626" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/pull/1422" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/372f1f83b6825fb0f92147803a9bf215b8ff690d" + }, + { + "type": "WEB", + "url": "https://github.com/apache/james-project/commit/537ae380f9837f74c075f0ed2b625affa9b20122" + }, + { + "type": "PACKAGE", + "url": "https://github.com/linagora/james-project" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/02/05/7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T19:02:30Z", + "nvd_published_at": "2025-02-06T12:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json b/advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json similarity index 51% rename from advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json rename to advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json index bf325018e36..82f570d2d27 100644 --- a/advisories/unreviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json +++ b/advisories/github-reviewed/2025/02/GHSA-pq2g-wx69-c263/GHSA-pq2g-wx69-c263.json @@ -1,14 +1,40 @@ { "schema_version": "1.4.0", "id": "GHSA-pq2g-wx69-c263", - "modified": "2025-02-06T06:31:26Z", + "modified": "2025-02-06T19:01:17Z", "published": "2025-02-06T06:31:26Z", "aliases": [ "CVE-2024-57699" ], + "summary": "Netplex Json-smart Uncontrolled Recursion vulnerability", "details": "A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "net.minidev:json-smart" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "last_affected": "2.5.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -18,16 +44,22 @@ "type": "WEB", "url": "https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699" }, + { + "type": "PACKAGE", + "url": "https://github.com/netplex/json-smart-v2" + }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/cve-2023-1370" } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-674" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-02-06T19:01:17Z", "nvd_published_at": "2025-02-05T22:15:33Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json b/advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json deleted file mode 100644 index 0400b4dc670..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-56jp-w6vw-j3jw/GHSA-56jp-w6vw-j3jw.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-56jp-w6vw-j3jw", - "modified": "2025-02-06T12:31:58Z", - "published": "2025-02-06T12:31:58Z", - "aliases": [ - "CVE-2024-37358" - ], - "details": "Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations\n\nVersion 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37358" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/1pxsh11v5s3fkvhnqvkmlqwt3fgpcrqc" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-06T12:15:26Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json b/advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json deleted file mode 100644 index 29875302ddb..00000000000 --- a/advisories/unreviewed/2025/02/GHSA-57m2-h3fw-rxhw/GHSA-57m2-h3fw-rxhw.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-57m2-h3fw-rxhw", - "modified": "2025-02-06T12:31:58Z", - "published": "2025-02-06T12:31:58Z", - "aliases": [ - "CVE-2024-45626" - ], - "details": "Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.\n\nUsers are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45626" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/02/05/7" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-02-06T12:15:27Z" - } -} \ No newline at end of file