netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3xvg-x47j-x75w
GHSA-588w-w6mv-3cw5
GHSA-8787-63px-3m23
GHSA-hvxr-2fvv-c3wq
This commit is contained in:
advisory-database[bot]
2023-02-08 18:10:28 +00:00
parent 464bc343a0
commit 7e828334da
4 changed files with 202 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json → advisories/github-reviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json
+28 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.3.0",
"id": "GHSA-3xvg-x47j-x75w",
"modified": "2022-05-13T01:07:34Z",
"modified": "2023-02-08T18:08:29Z",
"published": "2022-05-13T01:07:34Z",
"aliases": [
"CVE-2018-10874"
],
"summary": "Ansible Improper Input Validation vulnerability",
"details": "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.6"
}
]
}
]
}
],
"references": [
{
@@ -65,13 +84,17 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4072-1/"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041396"
"url": "https://web.archive.org/web/20201130165946/http://www.securitytracker.com/id/1041396"
}
],
"database_specific": {
@@ -79,8 +102,8 @@
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:08:29Z",
"nvd_published_at": "2018-07-02T13:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json → advisories/github-reviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json
+46 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.3.0",
"id": "GHSA-588w-w6mv-3cw5",
"modified": "2022-05-13T01:06:04Z",
"modified": "2023-02-08T18:09:23Z",
"published": "2022-05-13T01:06:04Z",
"aliases": [
"CVE-2017-7550"
],
"summary": "Ansible Insertion of Sensitive Information into Log File vulnerability",
"details": "A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.",
"severity": [
{
@@ -14,7 +15,44 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.3"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.1"
}
]
}
]
}
],
"references": [
{
@@ -36,6 +74,10 @@
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1473645"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
}
],
"database_specific": {
@@ -43,8 +85,8 @@
"CWE-532"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:09:23Z",
"nvd_published_at": "2017-11-21T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json → advisories/github-reviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json
+43 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.3.0",
"id": "GHSA-8787-63px-3m23",
"modified": "2022-05-13T01:54:14Z",
"modified": "2023-02-08T18:08:11Z",
"published": "2022-05-13T01:54:14Z",
"aliases": [
"CVE-2018-10931"
],
"summary": "Cobbler has Exposed Dangerous Method or Function",
"details": "It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.",
"severity": [
{
@@ -14,13 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cobbler"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "3.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10931"
},
{
"type": "WEB",
"url": "https://github.com/cobbler/cobbler/issues/1916"
},
{
"type": "WEB",
"url": "https://github.com/cobbler/cobbler/pull/1921"
},
{
"type": "WEB",
"url": "https://github.com/cobbler/cobbler/commit/1b91a3d3ac87c31d9dac2307513feb2aa49620a6"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2372"
@@ -37,6 +68,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931"
},
{
"type": "PACKAGE",
"url": "https://github.com/cobbler/cobbler"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD/"
@@ -52,6 +87,10 @@
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA/"
},
{
"type": "WEB",
"url": "https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/"
}
],
"database_specific": {
@@ -59,8 +98,8 @@
"CWE-749"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:08:11Z",
"nvd_published_at": "2018-08-09T20:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json → advisories/github-reviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json
+85 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.3.0",
"id": "GHSA-hvxr-2fvv-c3wq",
"modified": "2022-05-13T01:07:31Z",
"modified": "2023-02-08T18:10:02Z",
"published": "2022-05-13T01:07:31Z",
"aliases": [
"CVE-2017-7543"
],
"summary": "OpenStack Neutron Race Condition vulnerability",
"details": "A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.",
"severity": [
{
@@ -14,7 +15,82 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "neutron"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.2.0-12.1"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "neutron"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.3.0-11.1"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "neutron"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.3.1-2.1"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "neutron"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.2-1.1"
}
]
}
]
}
],
"references": [
{
@@ -57,9 +133,13 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543"
},
{
"type": "PACKAGE",
"url": "https://opendev.org/openstack/neutron"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100237"
"url": "https://web.archive.org/web/20200227153412/https://www.securityfocus.com/bid/100237"
}
],
"database_specific": {
@@ -67,8 +147,8 @@
"CWE-362"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T18:10:02Z",
"nvd_published_at": "2018-07-26T14:29:00Z"
}
}