From 74d976840e3efb7bbcbec198c3dab939723de8e0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 21 Nov 2024 22:20:40 +0000 Subject: [PATCH] Publish Advisories GHSA-74xw-gwfm-7pv7 GHSA-8c7c-2c8j-3xfp GHSA-xx4j-rvcc-2vhr GHSA-74xw-gwfm-7pv7 --- .../GHSA-74xw-gwfm-7pv7.json | 65 +++++++++++++++++++ .../GHSA-8c7c-2c8j-3xfp.json | 39 +++++++++-- .../GHSA-xx4j-rvcc-2vhr.json | 35 ++++++++-- .../GHSA-74xw-gwfm-7pv7.json | 35 ---------- 4 files changed, 131 insertions(+), 43 deletions(-) create mode 100644 advisories/github-reviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json (50%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json (55%) delete mode 100644 advisories/unreviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json diff --git a/advisories/github-reviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json b/advisories/github-reviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json new file mode 100644 index 00000000000..f23b12e6ef9 --- /dev/null +++ b/advisories/github-reviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-74xw-gwfm-7pv7", + "modified": "2024-11-21T22:18:17Z", + "published": "2021-12-18T00:00:40Z", + "aliases": [ + "CVE-2021-41497" + ], + "summary": "bounter Null pointer reference", + "details": "Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Denial of Service attacks by inputting a huge width of hash bucket.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "bounter" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.2.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41497" + }, + { + "type": "WEB", + "url": "https://github.com/RaRe-Technologies/bounter/issues/47" + }, + { + "type": "PACKAGE", + "url": "https://github.com/RaRe-Technologies/bounter" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/bounter/PYSEC-2021-880.yaml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-11-21T22:18:17Z", + "nvd_published_at": "2021-12-17T21:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json b/advisories/github-reviewed/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json rename to advisories/github-reviewed/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json index 54dfb9737b9..a66f732d198 100644 --- a/advisories/unreviewed/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json +++ b/advisories/github-reviewed/2022/05/GHSA-8c7c-2c8j-3xfp/GHSA-8c7c-2c8j-3xfp.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-8c7c-2c8j-3xfp", - "modified": "2022-05-24T17:35:03Z", + "modified": "2024-11-21T22:19:07Z", "published": "2022-05-24T17:35:03Z", "aliases": [ "CVE-2020-29367" ], + "summary": "blosc2 heap-based buffer overflow", "details": "blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "blosc2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.1.7" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,18 @@ { "type": "WEB", "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26442" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Blosc/python-blosc2" + }, + { + "type": "WEB", + "url": "https://github.com/Blosc/python-blosc2/releases/tag/v0.1.7" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/blosc2/PYSEC-2020-343.yaml" } ], "database_specific": { @@ -32,8 +63,8 @@ "CWE-787" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-21T22:19:07Z", "nvd_published_at": "2020-11-27T20:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json b/advisories/github-reviewed/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json similarity index 55% rename from advisories/unreviewed/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json rename to advisories/github-reviewed/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json index 46325aee47f..b9cdc9270f9 100644 --- a/advisories/unreviewed/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json +++ b/advisories/github-reviewed/2022/05/GHSA-xx4j-rvcc-2vhr/GHSA-xx4j-rvcc-2vhr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xx4j-rvcc-2vhr", - "modified": "2024-04-04T00:39:29Z", + "modified": "2024-11-21T22:19:31Z", "published": "2022-05-24T16:45:42Z", "aliases": [ "CVE-2016-7151" ], + "summary": "Capstone SEGV caused by a read memory access", "details": "Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "capstone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0" + } + ] + } + ] + } ], "references": [ { @@ -28,6 +47,14 @@ { "type": "WEB", "url": "https://github.com/aquynh/capstone/commit/87a25bb543c8e4c09b48d4b4a6c7db31ce58df06" + }, + { + "type": "PACKAGE", + "url": "https://github.com/capstone-engine/capstone" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/capstone/PYSEC-2019-242.yaml" } ], "database_specific": { @@ -35,8 +62,8 @@ "CWE-125" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-21T22:19:31Z", "nvd_published_at": "2019-05-15T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json b/advisories/unreviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json deleted file mode 100644 index 6924149250c..00000000000 --- a/advisories/unreviewed/2021/12/GHSA-74xw-gwfm-7pv7/GHSA-74xw-gwfm-7pv7.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-74xw-gwfm-7pv7", - "modified": "2021-12-28T00:01:27Z", - "published": "2021-12-18T00:00:40Z", - "aliases": [ - "CVE-2021-41497" - ], - "details": "Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Denial of Service attacks by inputting a huge width of hash bucket.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41497" - }, - { - "type": "WEB", - "url": "https://github.com/RaRe-Technologies/bounter/issues/47" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-476" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-12-17T21:15:00Z" - } -} \ No newline at end of file