From 7e828334dabd5b5a0f98212f478f38861fa8f9d6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 8 Feb 2023 18:10:28 +0000 Subject: [PATCH] Publish Advisories GHSA-3xvg-x47j-x75w GHSA-588w-w6mv-3cw5 GHSA-8787-63px-3m23 GHSA-hvxr-2fvv-c3wq --- .../GHSA-3xvg-x47j-x75w.json | 33 +++++-- .../GHSA-588w-w6mv-3cw5.json | 50 ++++++++++- .../GHSA-8787-63px-3m23.json | 47 +++++++++- .../GHSA-hvxr-2fvv-c3wq.json | 90 +++++++++++++++++-- 4 files changed, 202 insertions(+), 18 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json (73%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json (58%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json (65%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json (53%) diff --git a/advisories/unreviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json b/advisories/github-reviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json similarity index 73% rename from advisories/unreviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json rename to advisories/github-reviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json index eaf2750014c..c78bbe700a9 100644 --- a/advisories/unreviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json +++ b/advisories/github-reviewed/2022/05/GHSA-3xvg-x47j-x75w/GHSA-3xvg-x47j-x75w.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-3xvg-x47j-x75w", - "modified": "2022-05-13T01:07:34Z", + "modified": "2023-02-08T18:08:29Z", "published": "2022-05-13T01:07:34Z", "aliases": [ "CVE-2018-10874" ], + "summary": "Ansible Improper Input Validation vulnerability", "details": "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ansible" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.6" + } + ] + } + ] + } ], "references": [ { @@ -65,13 +84,17 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874" }, + { + "type": "PACKAGE", + "url": "https://github.com/ansible/ansible" + }, { "type": "WEB", "url": "https://usn.ubuntu.com/4072-1/" }, { "type": "WEB", - "url": "http://www.securitytracker.com/id/1041396" + "url": "https://web.archive.org/web/20201130165946/http://www.securitytracker.com/id/1041396" } ], "database_specific": { @@ -79,8 +102,8 @@ "CWE-20" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:08:29Z", "nvd_published_at": "2018-07-02T13:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json b/advisories/github-reviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json similarity index 58% rename from advisories/unreviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json rename to advisories/github-reviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json index 2212c2c1039..4fe425ac17d 100644 --- a/advisories/unreviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json +++ b/advisories/github-reviewed/2022/05/GHSA-588w-w6mv-3cw5/GHSA-588w-w6mv-3cw5.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-588w-w6mv-3cw5", - "modified": "2022-05-13T01:06:04Z", + "modified": "2023-02-08T18:09:23Z", "published": "2022-05-13T01:06:04Z", "aliases": [ "CVE-2017-7550" ], + "summary": "Ansible Insertion of Sensitive Information into Log File vulnerability", "details": "A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.", "severity": [ { @@ -14,7 +15,44 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ansible" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.4.1" + } + ] + } + ] + } ], "references": [ { @@ -36,6 +74,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1473645" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ansible/ansible" } ], "database_specific": { @@ -43,8 +85,8 @@ "CWE-532" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:09:23Z", "nvd_published_at": "2017-11-21T17:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json b/advisories/github-reviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json rename to advisories/github-reviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json index b3dce023d6c..edf8d0311aa 100644 --- a/advisories/unreviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json +++ b/advisories/github-reviewed/2022/05/GHSA-8787-63px-3m23/GHSA-8787-63px-3m23.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-8787-63px-3m23", - "modified": "2022-05-13T01:54:14Z", + "modified": "2023-02-08T18:08:11Z", "published": "2022-05-13T01:54:14Z", "aliases": [ "CVE-2018-10931" ], + "summary": "Cobbler has Exposed Dangerous Method or Function", "details": "It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.", "severity": [ { @@ -14,13 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "cobbler" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "3.0.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10931" }, + { + "type": "WEB", + "url": "https://github.com/cobbler/cobbler/issues/1916" + }, + { + "type": "WEB", + "url": "https://github.com/cobbler/cobbler/pull/1921" + }, + { + "type": "WEB", + "url": "https://github.com/cobbler/cobbler/commit/1b91a3d3ac87c31d9dac2307513feb2aa49620a6" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2018:2372" @@ -37,6 +68,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931" }, + { + "type": "PACKAGE", + "url": "https://github.com/cobbler/cobbler" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD/" @@ -52,6 +87,10 @@ { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA/" + }, + { + "type": "WEB", + "url": "https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/" } ], "database_specific": { @@ -59,8 +98,8 @@ "CWE-749" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:08:11Z", "nvd_published_at": "2018-08-09T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json b/advisories/github-reviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json rename to advisories/github-reviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json index 5cf80f44487..2e88538837e 100644 --- a/advisories/unreviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json +++ b/advisories/github-reviewed/2022/05/GHSA-hvxr-2fvv-c3wq/GHSA-hvxr-2fvv-c3wq.json @@ -1,11 +1,12 @@ { "schema_version": "1.3.0", "id": "GHSA-hvxr-2fvv-c3wq", - "modified": "2022-05-13T01:07:31Z", + "modified": "2023-02-08T18:10:02Z", "published": "2022-05-13T01:07:31Z", "aliases": [ "CVE-2017-7543" ], + "summary": "OpenStack Neutron Race Condition vulnerability", "details": "A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.", "severity": [ { @@ -14,7 +15,82 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.2.0-12.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.3.0-11.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0" + }, + { + "fixed": "9.3.1-2.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "neutron" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.0.0" + }, + { + "fixed": "10.0.2-1.1" + } + ] + } + ] + } ], "references": [ { @@ -57,9 +133,13 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543" }, + { + "type": "PACKAGE", + "url": "https://opendev.org/openstack/neutron" + }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/100237" + "url": "https://web.archive.org/web/20200227153412/https://www.securityfocus.com/bid/100237" } ], "database_specific": { @@ -67,8 +147,8 @@ "CWE-362" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-02-08T18:10:02Z", "nvd_published_at": "2018-07-26T14:29:00Z" } } \ No newline at end of file