Publish Advisories

GHSA-3wc5-fcw2-2329
GHSA-48vw-jpf8-hwqh
GHSA-5jpm-x58v-624v
GHSA-64fm-8hw2-v72w
GHSA-cvr6-37gx-v8wc
GHSA-f98w-7cxr-ff2h
GHSA-hm8r-95g3-5hj9

advisories/github-reviewed/2024/03/GHSA-3wc5-fcw2-2329/GHSA-3wc5-fcw2-2329.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3wc5-fcw2-2329",
-  "modified": "2024-03-25T19:38:37Z",
+  "modified": "2024-03-25T22:32:09Z",
   "published": "2024-03-25T19:38:37Z",
   "aliases": [
     "CVE-2024-28246"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28246"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de"
@@ -56,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:38:37Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T20:15:08Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-48vw-jpf8-hwqh/GHSA-48vw-jpf8-hwqh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-48vw-jpf8-hwqh",
-  "modified": "2024-03-25T19:45:24Z",
+  "modified": "2024-03-25T22:31:35Z",
   "published": "2024-03-25T19:45:23Z",
   "aliases": [
     "CVE-2024-28108"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-48vw-jpf8-hwqh"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28108"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/thorsten/phpMyFAQ/commit/4fed1d9602f0635260f789fe85995789d94d6634"
@@ -60,6 +64,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:45:23Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T19:15:58Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-5jpm-x58v-624v/GHSA-5jpm-x58v-624v.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5jpm-x58v-624v",
-  "modified": "2024-03-25T19:40:50Z",
+  "modified": "2024-03-25T22:31:40Z",
   "published": "2024-03-25T19:40:50Z",
   "aliases": [
     "CVE-2024-29025"
@@ -9,7 +9,10 @@
   "summary": "Netty's HttpPostRequestDecoder can OOM",
   "details": "### Summary\nThe `HttpPostRequestDecoder` can be tricked to accumulate data. I have spotted currently two attack vectors \n\n### Details\n1. While the decoder can store items on the disk if configured so, there are no limits to the number of fields the form can have, an attacher can send a chunked post consisting of many small fields that will be accumulated in the `bodyListHttpData` list.\n2. The decoder cumulates bytes in the `undecodedChunk` buffer until it can decode a field, this field can cumulate data without limits\n\n### PoC\n\nHere is a Netty branch that provides a fix + tests : https://github.com/vietj/netty/tree/post-request-decoder\n\n\nHere is a reproducer with Vert.x (which uses this decoder) https://gist.github.com/vietj/f558b8ea81ec6505f1e9a6ca283c9ae3\n\n### Impact\nAny Netty based HTTP server that uses the `HttpPostRequestDecoder` to decode a form.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
   ],
   "affected": [
     {
@@ -37,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29025"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/netty/netty/commit/0d0c6ed782d13d423586ad0c71737b2c7d02058c"
@@ -61,6 +68,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:40:50Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T20:15:08Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-64fm-8hw2-v72w/GHSA-64fm-8hw2-v72w.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-64fm-8hw2-v72w",
-  "modified": "2024-03-25T19:38:18Z",
+  "modified": "2024-03-25T22:31:55Z",
   "published": "2024-03-25T19:38:18Z",
   "aliases": [
     "CVE-2024-28243"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28243"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34"
@@ -51,11 +55,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-606"
+      "CWE-606",
+      "CWE-674"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:38:18Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T20:15:07Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-cvr6-37gx-v8wc/GHSA-cvr6-37gx-v8wc.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cvr6-37gx-v8wc",
-  "modified": "2024-03-25T19:38:29Z",
+  "modified": "2024-03-25T22:32:01Z",
   "published": "2024-03-25T19:38:29Z",
   "aliases": [
     "CVE-2024-28244"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28244"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2"
@@ -51,11 +55,12 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-606"
+      "CWE-606",
+      "CWE-674"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:38:29Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T20:15:08Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-f98w-7cxr-ff2h/GHSA-f98w-7cxr-ff2h.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f98w-7cxr-ff2h",
-  "modified": "2024-03-25T19:38:34Z",
+  "modified": "2024-03-25T22:32:05Z",
   "published": "2024-03-25T19:38:34Z",
   "aliases": [
     "CVE-2024-28245"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28245"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770"
@@ -56,6 +60,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:38:34Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T20:15:08Z"
   }
 }

advisories/github-reviewed/2024/03/GHSA-hm8r-95g3-5hj9/GHSA-hm8r-95g3-5hj9.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hm8r-95g3-5hj9",
-  "modified": "2024-03-25T19:45:12Z",
+  "modified": "2024-03-25T22:31:44Z",
   "published": "2024-03-25T19:45:12Z",
   "aliases": [
     "CVE-2024-29179"
@@ -43,6 +43,10 @@
       "type": "WEB",
       "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hm8r-95g3-5hj9"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29179"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/thorsten/phpMyFAQ"
@@ -55,6 +59,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-03-25T19:45:12Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-03-25T21:15:47Z"
   }
 }