From 71b86de5cd665ce20a94207f143ff6000412212c Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 30 Jan 2024 23:42:00 +0000
Subject: [PATCH] Publish Advisories

GHSA-j6vv-vv26-rh7c
GHSA-m979-w9wj-qfj9
---
 .../GHSA-j6vv-vv26-rh7c.json                  | 65 +++++++++++++++++
 .../GHSA-m979-w9wj-qfj9.json                  | 69 +++++++++++++++++++
 2 files changed, 134 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/01/GHSA-j6vv-vv26-rh7c/GHSA-j6vv-vv26-rh7c.json
 create mode 100644 advisories/github-reviewed/2024/01/GHSA-m979-w9wj-qfj9/GHSA-m979-w9wj-qfj9.json

diff --git a/advisories/github-reviewed/2024/01/GHSA-j6vv-vv26-rh7c/GHSA-j6vv-vv26-rh7c.json b/advisories/github-reviewed/2024/01/GHSA-j6vv-vv26-rh7c/GHSA-j6vv-vv26-rh7c.json
new file mode 100644
index 00000000000..8ddcb3ee664
--- /dev/null
+++ b/advisories/github-reviewed/2024/01/GHSA-j6vv-vv26-rh7c/GHSA-j6vv-vv26-rh7c.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j6vv-vv26-rh7c",
+  "modified": "2024-01-30T23:40:40Z",
+  "published": "2024-01-30T23:40:40Z",
+  "aliases": [
+    "CVE-2020-10661"
+  ],
+  "summary": "HashiCorp Vault Improper Privilege Management",
+  "details": "HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.11.0"
+            },
+            {
+              "fixed": "1.3.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10661"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.hashicorp.com/blog/category/vault/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T23:40:40Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/01/GHSA-m979-w9wj-qfj9/GHSA-m979-w9wj-qfj9.json b/advisories/github-reviewed/2024/01/GHSA-m979-w9wj-qfj9/GHSA-m979-w9wj-qfj9.json
new file mode 100644
index 00000000000..cbe05f4a6f0
--- /dev/null
+++ b/advisories/github-reviewed/2024/01/GHSA-m979-w9wj-qfj9/GHSA-m979-w9wj-qfj9.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m979-w9wj-qfj9",
+  "modified": "2024-01-30T23:40:43Z",
+  "published": "2024-01-30T23:40:43Z",
+  "aliases": [
+    "CVE-2020-10660"
+  ],
+  "summary": "HashiCorp Vault Improper Privilege Management",
+  "details": "HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.9.0"
+            },
+            {
+              "fixed": "1.3.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10660"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/pull/8606"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.hashicorp.com/blog/category/vault/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T23:40:43Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file