From 8dda3e8b7896061ea0d56e6af8220ba453777844 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 1 Mar 2024 21:42:16 +0000
Subject: [PATCH] Publish Advisories

GHSA-qxxx-2pp7-5hmx
GHSA-6xwf-xvf3-v459
---
 .../GHSA-qxxx-2pp7-5hmx.json                  | 46 ++++++++++++-------
 .../GHSA-6xwf-xvf3-v459.json                  | 37 +++++++++++++--
 2 files changed, 61 insertions(+), 22 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json (59%)

diff --git a/advisories/github-reviewed/2018/10/GHSA-qxxx-2pp7-5hmx/GHSA-qxxx-2pp7-5hmx.json b/advisories/github-reviewed/2018/10/GHSA-qxxx-2pp7-5hmx/GHSA-qxxx-2pp7-5hmx.json
index 6f38c96e1e7..88db11a3d38 100644
--- a/advisories/github-reviewed/2018/10/GHSA-qxxx-2pp7-5hmx/GHSA-qxxx-2pp7-5hmx.json
+++ b/advisories/github-reviewed/2018/10/GHSA-qxxx-2pp7-5hmx/GHSA-qxxx-2pp7-5hmx.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qxxx-2pp7-5hmx",
-  "modified": "2023-08-28T10:55:45Z",
+  "modified": "2024-03-01T21:41:47Z",
   "published": "2018-10-16T17:21:35Z",
   "aliases": [
     "CVE-2017-7525"
@@ -92,6 +92,34 @@
       "type": "WEB",
       "url": "https://github.com/FasterXML/jackson-databind/issues/1723"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/3bfbb835e530055c1941ddf87fde0b08d08dcd38"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/60d459cedcf079c6106ae7da2ac562bc32dcabe1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/680d75b011edd67a2d2a2e9980998a968194c2ef"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/6ce32ffd18facac6abdbbf559c817b47fcb622c1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/90042692085deeb05ae75c569c9909f7dba24415"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/fa87c1ddbe803ebb7295f5c2ebfe38e12f6e6162"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FasterXML/jackson-databind/commit/fd8dec2c7fab8b4b4bd60502a0f1d63ec23c24da"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2017:1834"
@@ -315,22 +343,6 @@
     {
       "type": "WEB",
       "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/99623"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securitytracker.com/id/1039744"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securitytracker.com/id/1039947"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securitytracker.com/id/1040360"
     }
   ],
   "database_specific": {
diff --git a/advisories/unreviewed/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json b/advisories/github-reviewed/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json
similarity index 59%
rename from advisories/unreviewed/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json
rename to advisories/github-reviewed/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json
index a30fb07ac15..5e7d843ce1b 100644
--- a/advisories/unreviewed/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json
+++ b/advisories/github-reviewed/2024/03/GHSA-6xwf-xvf3-v459/GHSA-6xwf-xvf3-v459.json
@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6xwf-xvf3-v459",
-  "modified": "2024-03-01T12:30:53Z",
+  "modified": "2024-03-01T21:40:55Z",
   "published": "2024-03-01T12:30:53Z",
   "aliases": [
     "CVE-2024-26280"
   ],
+  "summary": "Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users",
   "details": "Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "apache-airflow"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.8.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -22,6 +41,14 @@
       "type": "WEB",
       "url": "https://github.com/apache/airflow/pull/37501"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-42.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh"
@@ -31,9 +58,9 @@
     "cwe_ids": [
       "CWE-276"
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-01T21:40:55Z",
     "nvd_published_at": "2024-03-01T11:15:08Z"
   }
 }
\ No newline at end of file