diff --git a/advisories/unreviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json b/advisories/github-reviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json similarity index 56% rename from advisories/unreviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json rename to advisories/github-reviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json index d46ecb781fe..7ef1c8b6e37 100644 --- a/advisories/unreviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json +++ b/advisories/github-reviewed/2023/12/GHSA-5938-79hg-xh3q/GHSA-5938-79hg-xh3q.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-5938-79hg-xh3q", - "modified": "2023-12-21T12:30:28Z", + "modified": "2023-12-21T18:13:42Z", "published": "2023-12-21T12:30:28Z", "aliases": [ "CVE-2023-50783" ], - "details": "Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.\nThis flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.\nUsers are recommended to upgrade to 2.8.0, which fixes this issue", + "summary": "Apache Airflow Improper Access Control vulnerability", + "details": "Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.\nThis flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.\nUsers are recommended to upgrade to 2.8.0, which fixes this issue.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/33932" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/0e1c106d7cd0703125528a691088e42e17c99929" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn" @@ -35,9 +62,9 @@ "cwe_ids": [ "CWE-284" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-21T18:13:42Z", "nvd_published_at": "2023-12-21T10:15:36Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json b/advisories/github-reviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json similarity index 60% rename from advisories/unreviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json rename to advisories/github-reviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json index fe539a35779..8541a926853 100644 --- a/advisories/unreviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json +++ b/advisories/github-reviewed/2023/12/GHSA-6m9r-7wrx-xmr6/GHSA-6m9r-7wrx-xmr6.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-6m9r-7wrx-xmr6", - "modified": "2023-12-21T15:30:31Z", + "modified": "2023-12-21T18:13:50Z", "published": "2023-12-21T12:30:28Z", "aliases": [ "CVE-2023-49920" ], + "summary": "Apache Airflow Cross-Site Request Forgery vulnerability", "details": "Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent.\nUsers are advised to upgrade to version 2.8.0 or later which is not affected", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7.0" + }, + { + "fixed": "2.8.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/36026" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/f5d802791fa5f6b13b635f06a1ea2eccc22a9ba7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq" @@ -35,9 +62,9 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-21T18:13:50Z", "nvd_published_at": "2023-12-21T10:15:36Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json b/advisories/github-reviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json similarity index 62% rename from advisories/unreviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json rename to advisories/github-reviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json index eec5ca1158c..87742804eb0 100644 --- a/advisories/unreviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json +++ b/advisories/github-reviewed/2023/12/GHSA-8f57-wcmg-4jmh/GHSA-8f57-wcmg-4jmh.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-8f57-wcmg-4jmh", - "modified": "2023-12-21T15:30:31Z", + "modified": "2023-12-21T18:13:58Z", "published": "2023-12-21T12:30:27Z", "aliases": [ "CVE-2023-48291" ], + "summary": "Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere", "details": "Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.\n\nThis is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 \n\nUsers of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/34366" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/4f1b500c47813c54349b7d3e48df0a444fb4826c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3" @@ -35,9 +62,9 @@ "cwe_ids": [ "CWE-668" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-21T18:13:58Z", "nvd_published_at": "2023-12-21T10:15:36Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json b/advisories/github-reviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json similarity index 60% rename from advisories/unreviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json rename to advisories/github-reviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json index 03dc45f8707..e1be0d8bfd8 100644 --- a/advisories/unreviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json +++ b/advisories/github-reviewed/2023/12/GHSA-pxch-wr7m-rwxj/GHSA-pxch-wr7m-rwxj.json @@ -1,17 +1,42 @@ { "schema_version": "1.4.0", "id": "GHSA-pxch-wr7m-rwxj", - "modified": "2023-12-21T15:30:31Z", + "modified": "2023-12-21T18:14:16Z", "published": "2023-12-21T12:30:27Z", "aliases": [ "CVE-2023-47265" ], + "summary": "Apache Airflow has a stored cross-site scripting vulnerability", "details": "Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the browser sandbox. While this issue does not allow to exit the browser sandbox or manipulation of the server-side data - more than the DAG author already has, it allows to modify what the user looking at the DAG details sees in the browser - which opens up all kinds of possibilities of misleading other users.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.8.0b1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.7.3" + } + } ], "references": [ { @@ -22,6 +47,14 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/35460" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/0b995602e6e5894ee31625a4dd0e6aa255d2a651" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/128f3zl375vb1qv93k82zhnwkpl233pr" @@ -35,9 +68,9 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-21T18:14:16Z", "nvd_published_at": "2023-12-21T10:15:35Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-r24f-hg58-vfrw/GHSA-r24f-hg58-vfrw.json b/advisories/github-reviewed/2023/12/GHSA-r24f-hg58-vfrw/GHSA-r24f-hg58-vfrw.json new file mode 100644 index 00000000000..e06734f2c7e --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-r24f-hg58-vfrw/GHSA-r24f-hg58-vfrw.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r24f-hg58-vfrw", + "modified": "2023-12-21T18:14:34Z", + "published": "2023-12-21T18:14:34Z", + "aliases": [ + + ], + "summary": "unsafe-libyaml unaligned write of u64 on 32-bit and 16-bit platforms", + "details": "Affected versions allocate memory using the alignment of `usize` and write data to it of type `u64`, without using `core::ptr::write_unaligned`. In platforms with sub-64bit alignment for `usize` (including wasm32 and x86) these writes are insufficiently aligned some of the time.\n\nIf using an ordinary optimized standard library, the bug exhibits Undefined Behavior so may or may not behave in any sensible way, depending on optimization settings and hardware and other things. If using a Rust standard library built with debug assertions enabled, the bug manifests deterministically in a crash (non-unwinding panic) saying _\"ptr::write requires that the pointer argument is aligned and non-null\"_.\n\nNo 64-bit platform is impacted by the bug.\n\nThe flaw was corrected by allocating with adequately high alignment on all\nplatforms.\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "unsafe-libyaml" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.2.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/dtolnay/unsafe-libyaml/issues/21" + }, + { + "type": "WEB", + "url": "https://github.com/dtolnay/unsafe-libyaml/commit/7755559145c9cf5573639bfecc557893d4a46b0d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/dtolnay/unsafe-libyaml" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2023-0075.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-12-21T18:14:34Z", + "nvd_published_at": null + } +} \ No newline at end of file