diff --git a/advisories/unreviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json b/advisories/github-reviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json rename to advisories/github-reviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json index bfb783f05d2..7c6a90ab7ff 100644 --- a/advisories/unreviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json +++ b/advisories/github-reviewed/2022/05/GHSA-657p-cj5r-mjrh/GHSA-657p-cj5r-mjrh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-657p-cj5r-mjrh", - "modified": "2022-05-17T00:23:46Z", + "modified": "2024-04-22T22:20:29Z", "published": "2022-05-17T00:23:46Z", "aliases": [ "CVE-2017-14696" ], + "summary": "SaltStack Salt Denial of Service via a crafted authentication request", "details": "SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.", "severity": [ { @@ -14,7 +15,63 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2016.3.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2016.11.0" + }, + { + "fixed": "2016.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2017.7.0" + }, + { + "fixed": "2017.7.2" + } + ] + } + ] + } ], "references": [ { @@ -41,6 +98,10 @@ "type": "WEB", "url": "https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html" @@ -52,11 +113,12 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-400" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:20:29Z", "nvd_published_at": "2017-10-24T17:29:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json b/advisories/github-reviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json new file mode 100644 index 00000000000..70e170d60c7 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f2h7-4f84-8qrm", + "modified": "2024-04-22T22:20:10Z", + "published": "2022-05-17T00:34:42Z", + "aliases": [ + "CVE-2017-5192" + ], + "summary": "SaltStack Salt Authentication Bypass when using the local_batch client from salt-api", + "details": "When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2015.8.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2016.3.0" + }, + { + "fixed": "2016.3.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2016.11.0" + }, + { + "fixed": "2016.11.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5192" + }, + { + "type": "WEB", + "url": "https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html" + }, + { + "type": "WEB", + "url": "https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html" + }, + { + "type": "WEB", + "url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:20:10Z", + "nvd_published_at": "2017-09-26T14:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json b/advisories/github-reviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json rename to advisories/github-reviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json index 6fee0bc3f39..b4a499a78c3 100644 --- a/advisories/unreviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json +++ b/advisories/github-reviewed/2022/05/GHSA-g283-88v5-rmq2/GHSA-g283-88v5-rmq2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g283-88v5-rmq2", - "modified": "2022-05-13T01:47:12Z", + "modified": "2024-04-22T22:20:33Z", "published": "2022-05-13T01:47:12Z", "aliases": [ "CVE-2017-7893" ], + "summary": "SaltStack Salt allows compromised salt-minions to impersonate the salt-master", "details": "In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2016.3.6" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://docs.saltstack.com/en/2017.7/topics/releases/2016.3.6.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" } ], "database_specific": { @@ -31,8 +54,8 @@ ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:20:33Z", "nvd_published_at": "2018-04-23T22:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json b/advisories/github-reviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json rename to advisories/github-reviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json index b9d39f99155..86adbcae64f 100644 --- a/advisories/unreviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json +++ b/advisories/github-reviewed/2022/05/GHSA-j6gj-pg62-x8j6/GHSA-j6gj-pg62-x8j6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j6gj-pg62-x8j6", - "modified": "2022-05-17T00:24:32Z", + "modified": "2024-04-22T22:20:25Z", "published": "2022-05-17T00:24:32Z", "aliases": [ "CVE-2017-14695" ], + "summary": "SaltStack Salt Directory traversal vulnerability in minion id validation", "details": "Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.", "severity": [ { @@ -14,7 +15,63 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2016.3.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2016.11.0" + }, + { + "fixed": "2016.11.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2017.7.0" + }, + { + "fixed": "2017.7.2" + } + ] + } + ] + } ], "references": [ { @@ -41,6 +98,10 @@ "type": "WEB", "url": "https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2017-10/msg00073.html" @@ -55,8 +116,8 @@ "CWE-22" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:20:25Z", "nvd_published_at": "2017-10-24T17:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json b/advisories/github-reviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json rename to advisories/github-reviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json index 0cd649a33fb..4baf2580b56 100644 --- a/advisories/unreviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json +++ b/advisories/github-reviewed/2022/05/GHSA-mfr3-9cj8-h2qm/GHSA-mfr3-9cj8-h2qm.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-mfr3-9cj8-h2qm", - "modified": "2022-05-17T01:24:39Z", + "modified": "2024-04-22T22:19:59Z", "published": "2022-05-17T01:24:39Z", "aliases": [ "CVE-2014-3563" ], + "summary": "SaltStack Salt Insecure Temporary File Creation", "details": "Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2014.1.10" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95392" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "http://docs.saltstack.com/en/latest/topics/releases/2014.1.10.html" @@ -40,8 +63,8 @@ "CWE-59" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:19:59Z", "nvd_published_at": "2014-08-22T17:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json b/advisories/github-reviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json similarity index 70% rename from advisories/unreviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json rename to advisories/github-reviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json index dae3665c745..b3482357e9a 100644 --- a/advisories/unreviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json +++ b/advisories/github-reviewed/2022/05/GHSA-xcx4-5wq7-g5g7/GHSA-xcx4-5wq7-g5g7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xcx4-5wq7-g5g7", - "modified": "2022-05-17T02:46:54Z", + "modified": "2024-04-22T22:19:53Z", "published": "2022-05-17T02:46:54Z", "aliases": [ "CVE-2017-8109" ], + "summary": "SaltStack Salt Information Exposure", "details": "The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients).", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2016.11" + }, + { + "fixed": "2016.11.4" + } + ] + } + ] + } ], "references": [ { @@ -41,6 +60,10 @@ "type": "WEB", "url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/98095" @@ -51,8 +74,8 @@ "CWE-200" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:19:53Z", "nvd_published_at": "2017-04-25T17:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json b/advisories/github-reviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json rename to advisories/github-reviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json index e31ea6a8a35..5b948375974 100644 --- a/advisories/unreviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json +++ b/advisories/github-reviewed/2022/05/GHSA-xxvj-8g5m-4qgw/GHSA-xxvj-8g5m-4qgw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xxvj-8g5m-4qgw", - "modified": "2022-05-17T01:22:50Z", + "modified": "2024-04-22T22:20:05Z", "published": "2022-05-17T01:22:50Z", "aliases": [ "CVE-2017-12791" ], + "summary": "SaltStack Salt Directory traversal vulnerability in minion id validation", "details": "Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.", "severity": [ { @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2016.11.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2017.7.0" + }, + { + "fixed": "2017.7.1" + } + ] + } + ] + } ], "references": [ { @@ -41,6 +79,10 @@ "type": "WEB", "url": "https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/100384" @@ -51,8 +93,8 @@ "CWE-22" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:20:04Z", "nvd_published_at": "2017-08-23T14:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json b/advisories/unreviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json deleted file mode 100644 index 23a771d13fb..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f2h7-4f84-8qrm/GHSA-f2h7-4f84-8qrm.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f2h7-4f84-8qrm", - "modified": "2022-05-17T00:34:42Z", - "published": "2022-05-17T00:34:42Z", - "aliases": [ - "CVE-2017-5192" - ], - "details": "When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5192" - }, - { - "type": "WEB", - "url": "https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html" - }, - { - "type": "WEB", - "url": "https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html" - }, - { - "type": "WEB", - "url": "https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-287" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-09-26T14:29:00Z" - } -} \ No newline at end of file