From 88cf02adec2a898249a6fee4896e65bc05a084c6 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 15 May 2024 20:46:20 +0000
Subject: [PATCH] Publish Advisories

GHSA-98h9-727m-44qv
GHSA-mh4h-27gq-cxwj
---
 .../GHSA-98h9-727m-44qv.json                  | 99 +++++++++++++++++++
 .../GHSA-mh4h-27gq-cxwj.json                  | 80 +++++++++++++++
 2 files changed, 179 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-98h9-727m-44qv/GHSA-98h9-727m-44qv.json
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-mh4h-27gq-cxwj/GHSA-mh4h-27gq-cxwj.json

diff --git a/advisories/github-reviewed/2024/05/GHSA-98h9-727m-44qv/GHSA-98h9-727m-44qv.json b/advisories/github-reviewed/2024/05/GHSA-98h9-727m-44qv/GHSA-98h9-727m-44qv.json
new file mode 100644
index 00000000000..54497d86f0b
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-98h9-727m-44qv/GHSA-98h9-727m-44qv.json
@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-98h9-727m-44qv",
+  "modified": "2024-05-15T20:45:28Z",
+  "published": "2024-05-15T20:45:28Z",
+  "aliases": [
+
+  ],
+  "summary": "Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar",
+  "details": "The Drupal project uses the third-party library [Archive_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.\n\nThe latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.69"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.7.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.8.0"
+            },
+            {
+              "fixed": "8.8.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-4.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/core"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2019-012"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T20:45:28Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/05/GHSA-mh4h-27gq-cxwj/GHSA-mh4h-27gq-cxwj.json b/advisories/github-reviewed/2024/05/GHSA-mh4h-27gq-cxwj/GHSA-mh4h-27gq-cxwj.json
new file mode 100644
index 00000000000..ee673b663b8
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-mh4h-27gq-cxwj/GHSA-mh4h-27gq-cxwj.json
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mh4h-27gq-cxwj",
+  "modified": "2024-05-15T20:44:16Z",
+  "published": "2024-05-15T20:44:16Z",
+  "aliases": [
+
+  ],
+  "summary": "Drupal core Access bypass",
+  "details": "The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations.\n\nSolution:\nIf you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11.\nIf you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1.\nVersions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.\n\nAlternatively, you may mitigate this vulnerability by unchecking the \"Enable advanced UI\" checkbox on `/admin/config/media/media-library`. (This mitigation is not available in 8.7.x.)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.7.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.8.0"
+            },
+            {
+              "fixed": "8.8.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-3.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/core"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2019-011"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T20:44:16Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file