From 82caa285ce81829d4ba652f637a2248727648918 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Mar 2025 19:32:36 +0000 Subject: [PATCH] Publish Advisories GHSA-7qq7-pvm9-x8rf GHSA-hhm6-jjf4-6pm3 GHSA-jvhm-gjrh-3h93 GHSA-7qq7-pvm9-x8rf --- .../GHSA-7qq7-pvm9-x8rf.json | 84 +++++++++++++++++++ .../GHSA-hhm6-jjf4-6pm3.json | 6 +- .../GHSA-jvhm-gjrh-3h93.json | 8 +- .../GHSA-7qq7-pvm9-x8rf.json | 36 -------- 4 files changed, 95 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json diff --git a/advisories/github-reviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json b/advisories/github-reviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json new file mode 100644 index 00000000000..6c4318490a2 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7qq7-pvm9-x8rf", + "modified": "2025-03-20T19:31:56Z", + "published": "2025-03-20T12:32:39Z", + "aliases": [ + "CVE-2024-10550" + ], + "summary": "H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint", + "details": "A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "h2o" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.30.0.7" + }, + { + "last_affected": "3.46.0.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "ai.h2o:h2o-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.30.0.7" + }, + { + "last_affected": "3.46.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10550" + }, + { + "type": "PACKAGE", + "url": "https://github.com/h2oai/h2o-3" + }, + { + "type": "WEB", + "url": "https://github.com/h2oai/h2o-3/blob/51c25940ded8b7d0acc8f3f72329fd9dedbb3a34/h2o-core/src/main/java/water/api/ParseSetupHandler.java#L121" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-20T19:31:56Z", + "nvd_published_at": "2025-03-20T10:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-hhm6-jjf4-6pm3/GHSA-hhm6-jjf4-6pm3.json b/advisories/github-reviewed/2025/03/GHSA-hhm6-jjf4-6pm3/GHSA-hhm6-jjf4-6pm3.json index 85b7c872b54..c4818a40982 100644 --- a/advisories/github-reviewed/2025/03/GHSA-hhm6-jjf4-6pm3/GHSA-hhm6-jjf4-6pm3.json +++ b/advisories/github-reviewed/2025/03/GHSA-hhm6-jjf4-6pm3/GHSA-hhm6-jjf4-6pm3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hhm6-jjf4-6pm3", - "modified": "2025-03-19T15:48:17Z", + "modified": "2025-03-20T19:31:18Z", "published": "2025-03-19T09:30:27Z", "aliases": [ "CVE-2025-27018" @@ -55,6 +55,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/m8ohgkwz4mq9njohf66sjwqjdy28gvzf" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/03/19/4" } ], "database_specific": { diff --git a/advisories/github-reviewed/2025/03/GHSA-jvhm-gjrh-3h93/GHSA-jvhm-gjrh-3h93.json b/advisories/github-reviewed/2025/03/GHSA-jvhm-gjrh-3h93/GHSA-jvhm-gjrh-3h93.json index 7339dfb2bd4..185cdd379b2 100644 --- a/advisories/github-reviewed/2025/03/GHSA-jvhm-gjrh-3h93/GHSA-jvhm-gjrh-3h93.json +++ b/advisories/github-reviewed/2025/03/GHSA-jvhm-gjrh-3h93/GHSA-jvhm-gjrh-3h93.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jvhm-gjrh-3h93", - "modified": "2025-03-19T19:54:25Z", + "modified": "2025-03-20T19:31:04Z", "published": "2025-03-19T19:54:25Z", "aliases": [ "CVE-2025-27415" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-jvhm-gjrh-3h93" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27415" + }, { "type": "PACKAGE", "url": "https://github.com/nuxt/nuxt" @@ -52,6 +56,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2025-03-19T19:54:25Z", - "nvd_published_at": null + "nvd_published_at": "2025-03-19T19:15:47Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json b/advisories/unreviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json deleted file mode 100644 index 388247a4404..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-7qq7-pvm9-x8rf/GHSA-7qq7-pvm9-x8rf.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7qq7-pvm9-x8rf", - "modified": "2025-03-20T12:32:39Z", - "published": "2025-03-20T12:32:39Z", - "aliases": [ - "CVE-2024-10550" - ], - "details": "A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10550" - }, - { - "type": "WEB", - "url": "https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-1333" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-20T10:15:17Z" - } -} \ No newline at end of file