netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-657p-cj5r-mjrh
GHSA-f2h7-4f84-8qrm
GHSA-g283-88v5-rmq2
GHSA-j6gj-pg62-x8j6
GHSA-mfr3-9cj8-h2qm
GHSA-xcx4-5wq7-g5g7
GHSA-xxvj-8g5m-4qgw
GHSA-f2h7-4f84-8qrm
This commit is contained in:
advisory-database[bot]
2024-04-22 22:21:23 +00:00
parent 4b46d48f8a
commit 792d8b1d8d
8 changed files with 366 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json → advisories/github-reviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json
+67 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-657p-cj5r-mjrh",
"modified": "2022-05-17T00:23:46Z",
"modified": "2024-04-22T22:20:29Z",
"published": "2022-05-17T00:23:46Z",
"aliases": [
"CVE-2017-14696"
],
"summary": "SaltStack Salt Denial of Service via a crafted authentication request",
"details": "SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.",
"severity": [
{
@@ -14,7 +15,63 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2016.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2016.11.0"
},
{
"fixed": "2016.11.8"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2017.7.0"
},
{
"fixed": "2017.7.2"
}
]
}
]
}
],
"references": [
{
@@ -41,6 +98,10 @@
"type": "WEB",
"url": "https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html"
@@ -52,11 +113,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:20:29Z",
"nvd_published_at": "2017-10-24T17:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json
+107
View File
@@ -0,0 +1,107 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f2h7-4f84-8qrm",
"modified": "2024-04-22T22:20:10Z",
"published": "2022-05-17T00:34:42Z",
"aliases": [
"CVE-2017-5192"
],
"summary": "SaltStack Salt Authentication Bypass when using the local_batch client from salt-api",
"details": "When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2015.8.13"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2016.3.0"
},
{
"fixed": "2016.3.5"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2016.11.0"
},
{
"fixed": "2016.11.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5192"
},
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html"
},
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html"
},
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:20:10Z",
"nvd_published_at": "2017-09-26T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json → advisories/github-reviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g283-88v5-rmq2",
"modified": "2022-05-13T01:47:12Z",
"modified": "2024-04-22T22:20:33Z",
"published": "2022-05-13T01:47:12Z",
"aliases": [
"CVE-2017-7893"
],
"summary": "SaltStack Salt allows compromised salt-minions to impersonate the salt-master",
"details": "In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2016.3.6"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:20:33Z",
"nvd_published_at": "2018-04-23T22:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json → advisories/github-reviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json
+65 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j6gj-pg62-x8j6",
"modified": "2022-05-17T00:24:32Z",
"modified": "2024-04-22T22:20:25Z",
"published": "2022-05-17T00:24:32Z",
"aliases": [
"CVE-2017-14695"
],
"summary": "SaltStack Salt Directory traversal vulnerability in minion id validation",
"details": "Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.",
"severity": [
{
@@ -14,7 +15,63 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2016.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2016.11.0"
},
{
"fixed": "2016.11.8"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2017.7.0"
},
{
"fixed": "2017.7.2"
}
]
}
]
}
],
"references": [
{
@@ -41,6 +98,10 @@
"type": "WEB",
"url": "https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html"
@@ -55,8 +116,8 @@
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:20:25Z",
"nvd_published_at": "2017-10-24T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json → advisories/github-reviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json
+27 -4
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mfr3-9cj8-h2qm",
"modified": "2022-05-17T01:24:39Z",
"modified": "2024-04-22T22:19:59Z",
"published": "2022-05-17T01:24:39Z",
"aliases": [
"CVE-2014-3563"
],
"summary": "SaltStack Salt Insecure Temporary File Creation",
"details": "Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2014.1.10"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,10 @@
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95392"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "http://docs.saltstack.com/en/latest/topics/releases/2014.1.10.html"
@@ -40,8 +63,8 @@
"CWE-59"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:19:59Z",
"nvd_published_at": "2014-08-22T17:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json → advisories/github-reviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xcx4-5wq7-g5g7",
"modified": "2022-05-17T02:46:54Z",
"modified": "2024-04-22T22:19:53Z",
"published": "2022-05-17T02:46:54Z",
"aliases": [
"CVE-2017-8109"
],
"summary": "SaltStack Salt Information Exposure",
"details": "The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2016.11"
},
{
"fixed": "2016.11.4"
}
]
}
]
}
],
"references": [
{
@@ -41,6 +60,10 @@
"type": "WEB",
"url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98095"
@@ -51,8 +74,8 @@
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:19:53Z",
"nvd_published_at": "2017-04-25T17:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json → advisories/github-reviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json
+46 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xxvj-8g5m-4qgw",
"modified": "2022-05-17T01:22:50Z",
"modified": "2024-04-22T22:20:05Z",
"published": "2022-05-17T01:22:50Z",
"aliases": [
"CVE-2017-12791"
],
"summary": "SaltStack Salt Directory traversal vulnerability in minion id validation",
"details": "Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.",
"severity": [
{
@@ -14,7 +15,44 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2016.11.7"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2017.7.0"
},
{
"fixed": "2017.7.1"
}
]
}
]
}
],
"references": [
{
@@ -41,6 +79,10 @@
"type": "WEB",
"url": "https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100384"
@@ -51,8 +93,8 @@
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:20:04Z",
"nvd_published_at": "2017-08-23T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f2h7-4f84-8qrm",
"modified": "2022-05-17T00:34:42Z",
"published": "2022-05-17T00:34:42Z",
"aliases": [
"CVE-2017-5192"
],
"details": "When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5192"
},
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html"
},
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html"
},
{
"type": "WEB",
"url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-26T14:29:00Z"
}
}