From 83dc5e8594d5547caa2c70bfc2be8467204c98cc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 31 Jan 2024 14:56:53 +0000 Subject: [PATCH] Publish Advisories GHSA-c3c6-f2ww-xfr2 GHSA-jgxc-8mwq-9xqw GHSA-mg2x-mggj-6955 GHSA-vm5m-qmrx-fw8w --- .../2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json | 7 +++++-- .../2024/01/GHSA-jgxc-8mwq-9xqw/GHSA-jgxc-8mwq-9xqw.json | 7 +++++-- .../2024/01/GHSA-mg2x-mggj-6955/GHSA-mg2x-mggj-6955.json | 9 ++++++--- .../2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json | 7 +++++-- 4 files changed, 21 insertions(+), 9 deletions(-) diff --git a/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json b/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json index 3332b309e02..0d0e921be03 100644 --- a/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json +++ b/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c3c6-f2ww-xfr2", - "modified": "2024-01-24T20:55:31Z", + "modified": "2024-01-31T14:55:56Z", "published": "2024-01-24T15:30:30Z", "aliases": [ "CVE-2023-50943" @@ -9,7 +9,10 @@ "summary": "Apache Airflow: pickle deserialization vulnerability in XComs", "details": "Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of \"enable_xcom_pickling=False\" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/01/GHSA-jgxc-8mwq-9xqw/GHSA-jgxc-8mwq-9xqw.json b/advisories/github-reviewed/2024/01/GHSA-jgxc-8mwq-9xqw/GHSA-jgxc-8mwq-9xqw.json index fa15601785d..bc8192b428c 100644 --- a/advisories/github-reviewed/2024/01/GHSA-jgxc-8mwq-9xqw/GHSA-jgxc-8mwq-9xqw.json +++ b/advisories/github-reviewed/2024/01/GHSA-jgxc-8mwq-9xqw/GHSA-jgxc-8mwq-9xqw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jgxc-8mwq-9xqw", - "modified": "2024-01-22T21:25:52Z", + "modified": "2024-01-31T14:55:29Z", "published": "2024-01-22T06:30:32Z", "aliases": [ "CVE-2017-20189" @@ -9,7 +9,10 @@ "summary": "Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization", "details": "In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/01/GHSA-mg2x-mggj-6955/GHSA-mg2x-mggj-6955.json b/advisories/github-reviewed/2024/01/GHSA-mg2x-mggj-6955/GHSA-mg2x-mggj-6955.json index 27c43790c1d..9a8bf7797bf 100644 --- a/advisories/github-reviewed/2024/01/GHSA-mg2x-mggj-6955/GHSA-mg2x-mggj-6955.json +++ b/advisories/github-reviewed/2024/01/GHSA-mg2x-mggj-6955/GHSA-mg2x-mggj-6955.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mg2x-mggj-6955", - "modified": "2024-01-24T21:13:06Z", + "modified": "2024-01-31T14:55:45Z", "published": "2024-01-24T15:30:30Z", "aliases": [ "CVE-2023-51702" @@ -9,7 +9,10 @@ "summary": "Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service", "details": "Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.\n\nThis behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ { @@ -85,7 +88,7 @@ "cwe_ids": [ "CWE-312" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-24T21:13:06Z", "nvd_published_at": "2024-01-24T13:15:08Z" diff --git a/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json b/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json index 11dccbd57a3..d3c0d8c483a 100644 --- a/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json +++ b/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vm5m-qmrx-fw8w", - "modified": "2024-01-24T21:01:04Z", + "modified": "2024-01-31T14:55:51Z", "published": "2024-01-24T15:30:30Z", "aliases": [ "CVE-2023-50944" @@ -9,7 +9,10 @@ "summary": "Apache Airflow: Bypass permission verification to read code of other dags", "details": "Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ {