Publish Advisories

GHSA-29g7-9vcg-g9rm
GHSA-8hcr-5x2g-9f7j
GHSA-rcjc-c4pj-xxrp

advisories/unreviewed/2023/11/GHSA-29g7-9vcg-g9rm/GHSA-29g7-9vcg-g9rm.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-29g7-9vcg-g9rm",
+  "modified": "2023-11-20T09:30:30Z",
+  "published": "2023-11-20T09:30:30Z",
+  "aliases": [
+    "CVE-2023-3379"
+  ],
+  "details": "Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker  to change the passwords of other non-admin users and thus to escalate non-root privileges.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3379"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.vde.com/en/advisories/VDE-2023-015/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-20T08:15:44Z"
+  }
+}

advisories/unreviewed/2023/11/GHSA-8hcr-5x2g-9f7j/GHSA-8hcr-5x2g-9f7j.json

@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8hcr-5x2g-9f7j",
+  "modified": "2023-11-20T09:30:31Z",
+  "published": "2023-11-20T09:30:31Z",
+  "aliases": [
+    "CVE-2023-46302"
+  ],
+  "details": "Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml  https://nvd.nist.gov/vuln/detail/CVE-2022-1471 .\n\nApache Submarine uses JAXRS to define REST endpoints.  In order to\nhandle YAML requests (using application/yaml content-type), it defines\na YamlEntityProvider entity provider that will process all incoming\nYAML requests.  In order to unmarshal the request, the readFrom method\nis invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`.\n \nWe have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`.\nThis issue affects Apache Submarine: from 0.7.0 before 0.8.0. Users are recommended to upgrade to version 0.8.0, which fixes this issue.\nIf using the version smaller than 0.8.0  and not want to upgrade, you can try cherry-pick PR  https://github.com/apache/submarine/pull/1054  and rebuild the submart-server image to fix this.\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46302"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/submarine/pull/1054"
+    },
+    {
+      "type": "WEB",
+      "url": "https://issues.apache.org/jira/browse/SUBMARINE-1371"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/zf0wppzh239j4h131hm1dbswfnztxrr5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-20T09:15:07Z"
+  }
+}

advisories/unreviewed/2023/11/GHSA-rcjc-c4pj-xxrp/GHSA-rcjc-c4pj-xxrp.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rcjc-c4pj-xxrp",
+  "modified": "2023-11-20T09:30:31Z",
+  "published": "2023-11-20T09:30:31Z",
+  "aliases": [
+    "CVE-2022-46337"
+  ],
+  "details": "A cleverly devised username might bypass LDAP authentication checks. In \nLDAP-authenticated Derby installations, this could let an attacker fill \nup the disk by creating junk Derby databases. In LDAP-authenticated \nDerby installations, this could also allow the attacker to execute \nmalware which was visible to and executable by the account which booted \nthe Derby server. In LDAP-protected databases which weren't also \nprotected by SQL GRANT/REVOKE authorization, this vulnerability could \nalso let an attacker view and corrupt sensitive data and run sensitive \ndatabase functions and procedures.\n\nMitigation:\n\nUsers should upgrade to Java 21 and Derby 10.17.1.0.\n\nAlternatively, users who wish to remain on older Java versions should \nbuild their own Derby distribution from one of the release families to \nwhich the fix was backported: 10.16, 10.15, and 10.14. Those are the \nreleases which correspond, respectively, with Java LTS versions 17, 11, \nand 8.\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46337"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-11-20T09:15:07Z"
+  }
+}