Publish Advisories

GHSA-xhr3-wf7j-h255 GHSA-8886-8v27-85j8 GHSA-hff8-hjwv-j9q7 GHSA-p2qq-c693-q53w GHSA-pjwm-cr36-mwv3
2026-05-22 18:04:22 -07:00 · 2024-11-14 22:46:04 +00:00
parent c3e7c35f6b
commit 713edabacb
5 changed files with 85 additions and 5 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xhr3-wf7j-h255",
-  "modified": "2024-10-16T14:09:50Z",
+  "modified": "2024-11-14T22:45:10Z",
  "published": "2024-10-15T21:30:39Z",
  "aliases": [
    "CVE-2024-44337"
@@ -9,6 +9,10 @@
  "summary": "Infinite loop in github.com/gomarkdown/markdown",
  "details": "The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8886-8v27-85j8",
-  "modified": "2024-11-14T15:37:04Z",
+  "modified": "2024-11-14T22:45:12Z",
  "published": "2024-11-13T21:30:38Z",
  "aliases": [
    "CVE-2024-52552"
@@ -9,7 +9,10 @@
  "summary": "Stored XSS vulnerability in Jenkins Authorize Project Plugin ",
  "details": "Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Authorize Project Plugin 1.8.0 no longer evaluates a string containing the job name with JavaScript on the Authorization view.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hff8-hjwv-j9q7",
-  "modified": "2024-11-14T17:38:14Z",
+  "modified": "2024-11-14T22:45:16Z",
  "published": "2024-11-14T17:38:14Z",
  "aliases": [
    "CVE-2024-49362"
@@ -43,6 +43,10 @@
      "type": "WEB",
      "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49362"
+    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/laurent22/joplin"
@@ -55,6 +59,6 @@
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-14T17:38:14Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-11-14T18:15:19Z"
  }
 }
@@ -51,6 +51,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-276",
      "CWE-285"
    ],
    "severity": "HIGH",
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pjwm-cr36-mwv3",
+  "modified": "2024-11-14T22:44:36Z",
+  "published": "2024-11-14T22:44:36Z",
+  "aliases": [
+    "CVE-2024-52524"
+  ],
+  "summary": "ReDoS in giskard's transformation.py (GHSL-2024-324)",
+  "details": "# ReDoS in Giskard text perturbation detector\n\nA Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the [GitHub Security Lab](https://securitylab.github.com) team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service.\n\n## Details\n\nThe vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection. A regex used to detect URLs and links was vulnerable to catastrophic backtracking that could be triggered by specific patterns in the text.\n\n## Affected version\n\nGiskard versions prior to 2.15.5 are affected. Users should upgrade to version 2.15.5 or later, which includes a fix for this vulnerability.\n\n## Impact\n\nThis vulnerability can cause extended computation times or crashes in Giskard when processing text containing certain patterns.\n\n## Credit\n\nThis issue was discovered and reported by GHSL team member [@kevinbackhouse (Kevin Backhouse)](https://github.com/kevinbackhouse).",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "giskard"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.15.5"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.15.4"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/Giskard-AI/giskard/security/advisories/GHSA-pjwm-cr36-mwv3"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52524"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Giskard-AI/giskard/commit/48ce81f5c626171767188d6f0669498fb613b4d3"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/Giskard-AI/giskard"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1333"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-14T22:44:36Z",
+    "nvd_published_at": "2024-11-14T18:15:26Z"
+  }
+}