diff --git a/advisories/github-reviewed/2024/10/GHSA-xhr3-wf7j-h255/GHSA-xhr3-wf7j-h255.json b/advisories/github-reviewed/2024/10/GHSA-xhr3-wf7j-h255/GHSA-xhr3-wf7j-h255.json index 0043af1d57d..f1d906c9045 100644 --- a/advisories/github-reviewed/2024/10/GHSA-xhr3-wf7j-h255/GHSA-xhr3-wf7j-h255.json +++ b/advisories/github-reviewed/2024/10/GHSA-xhr3-wf7j-h255/GHSA-xhr3-wf7j-h255.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xhr3-wf7j-h255", - "modified": "2024-10-16T14:09:50Z", + "modified": "2024-11-14T22:45:10Z", "published": "2024-10-15T21:30:39Z", "aliases": [ "CVE-2024-44337" @@ -9,6 +9,10 @@ "summary": "Infinite loop in github.com/gomarkdown/markdown", "details": "The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" diff --git a/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json b/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json index d30d1977858..c71d1fdd232 100644 --- a/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json +++ b/advisories/github-reviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8886-8v27-85j8", - "modified": "2024-11-14T15:37:04Z", + "modified": "2024-11-14T22:45:12Z", "published": "2024-11-13T21:30:38Z", "aliases": [ "CVE-2024-52552" @@ -9,7 +9,10 @@ "summary": "Stored XSS vulnerability in Jenkins Authorize Project Plugin ", "details": "Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Authorize Project Plugin 1.8.0 no longer evaluates a string containing the job name with JavaScript on the Authorization view.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json b/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json index 9ea892bf924..9560c2221fb 100644 --- a/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json +++ b/advisories/github-reviewed/2024/11/GHSA-hff8-hjwv-j9q7/GHSA-hff8-hjwv-j9q7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hff8-hjwv-j9q7", - "modified": "2024-11-14T17:38:14Z", + "modified": "2024-11-14T22:45:16Z", "published": "2024-11-14T17:38:14Z", "aliases": [ "CVE-2024-49362" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49362" + }, { "type": "PACKAGE", "url": "https://github.com/laurent22/joplin" @@ -55,6 +59,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-11-14T17:38:14Z", - "nvd_published_at": null + "nvd_published_at": "2024-11-14T18:15:19Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json b/advisories/github-reviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json index 023ae2f1aa7..f2b72c1d178 100644 --- a/advisories/github-reviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json +++ b/advisories/github-reviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json @@ -51,6 +51,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-276", "CWE-285" ], "severity": "HIGH", diff --git a/advisories/github-reviewed/2024/11/GHSA-pjwm-cr36-mwv3/GHSA-pjwm-cr36-mwv3.json b/advisories/github-reviewed/2024/11/GHSA-pjwm-cr36-mwv3/GHSA-pjwm-cr36-mwv3.json new file mode 100644 index 00000000000..030aa40e9a1 --- /dev/null +++ b/advisories/github-reviewed/2024/11/GHSA-pjwm-cr36-mwv3/GHSA-pjwm-cr36-mwv3.json @@ -0,0 +1,68 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pjwm-cr36-mwv3", + "modified": "2024-11-14T22:44:36Z", + "published": "2024-11-14T22:44:36Z", + "aliases": [ + "CVE-2024-52524" + ], + "summary": "ReDoS in giskard's transformation.py (GHSL-2024-324)", + "details": "# ReDoS in Giskard text perturbation detector\n\nA Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the [GitHub Security Lab](https://securitylab.github.com) team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation times, potentially leading to denial of service.\n\n## Details\n\nThe vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection. A regex used to detect URLs and links was vulnerable to catastrophic backtracking that could be triggered by specific patterns in the text.\n\n## Affected version\n\nGiskard versions prior to 2.15.5 are affected. Users should upgrade to version 2.15.5 or later, which includes a fix for this vulnerability.\n\n## Impact\n\nThis vulnerability can cause extended computation times or crashes in Giskard when processing text containing certain patterns.\n\n## Credit\n\nThis issue was discovered and reported by GHSL team member [@kevinbackhouse (Kevin Backhouse)](https://github.com/kevinbackhouse).", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "giskard" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.15.5" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.15.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Giskard-AI/giskard/security/advisories/GHSA-pjwm-cr36-mwv3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52524" + }, + { + "type": "WEB", + "url": "https://github.com/Giskard-AI/giskard/commit/48ce81f5c626171767188d6f0669498fb613b4d3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Giskard-AI/giskard" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-11-14T22:44:36Z", + "nvd_published_at": "2024-11-14T18:15:26Z" + } +} \ No newline at end of file