From 93ad82c81f7908bcdbe6ac399e5d9c5bfa340077 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Mar 2024 19:38:18 +0000 Subject: [PATCH] Publish Advisories GHSA-246p-xmg8-wmcq GHSA-38jr-29fh-w9vm GHSA-592j-995h-p23j GHSA-87qp-7cw8-8q9c GHSA-g4v6-69p6-q3p4 GHSA-jwrc-3v3f-5cq5 GHSA-v5h6-c2hv-hv3r GHSA-jwrc-3v3f-5cq5 --- .../GHSA-246p-xmg8-wmcq.json | 84 ++++++++++ .../GHSA-38jr-29fh-w9vm.json | 100 ++++++++++++ .../GHSA-592j-995h-p23j.json | 147 ++++++++++++++++++ .../GHSA-87qp-7cw8-8q9c.json | 31 +++- .../GHSA-g4v6-69p6-q3p4.json | 64 ++++++++ .../GHSA-jwrc-3v3f-5cq5.json | 69 ++++++++ .../GHSA-v5h6-c2hv-hv3r.json | 66 ++++++++ .../GHSA-jwrc-3v3f-5cq5.json | 38 ----- 8 files changed, 557 insertions(+), 42 deletions(-) create mode 100644 advisories/github-reviewed/2024/03/GHSA-246p-xmg8-wmcq/GHSA-246p-xmg8-wmcq.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-38jr-29fh-w9vm/GHSA-38jr-29fh-w9vm.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-592j-995h-p23j/GHSA-592j-995h-p23j.json rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json (66%) create mode 100644 advisories/github-reviewed/2024/03/GHSA-g4v6-69p6-q3p4/GHSA-g4v6-69p6-q3p4.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json create mode 100644 advisories/github-reviewed/2024/03/GHSA-v5h6-c2hv-hv3r/GHSA-v5h6-c2hv-hv3r.json delete mode 100644 advisories/unreviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json diff --git a/advisories/github-reviewed/2024/03/GHSA-246p-xmg8-wmcq/GHSA-246p-xmg8-wmcq.json b/advisories/github-reviewed/2024/03/GHSA-246p-xmg8-wmcq/GHSA-246p-xmg8-wmcq.json new file mode 100644 index 00000000000..1025b367d9f --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-246p-xmg8-wmcq/GHSA-246p-xmg8-wmcq.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-246p-xmg8-wmcq", + "modified": "2024-03-25T19:37:27Z", + "published": "2024-03-25T19:37:27Z", + "aliases": [ + "CVE-2024-29194" + ], + "summary": "OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation", + "details": "## Summary\nA security vulnerability exists in oneuptime's local storage handling, where a regular user can escalate privileges by modifying the `is_master_admin` key to `true`. This allows unauthorized access to administrative functionalities.\n\n## Details\nThe vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the `is_master_admin` key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. \n\n## POC\n(I am using Firefox Developer to demonstrate this vulnerability)\nLog in as a normal user. Open developer tools (hit F12), click Storage, then Local Storage. Modify the `is_master_admin` key from `false` to `true`.\n\n## Impact\nThis vulnerability represents a high security risk as it allows any authenticated user to gain administrative privileges through client-side manipulation. Most of the admin previlages were disabled except the user list. Where an attacker could see all the list of users who signed up to OneUptome. \n\n\n## Patch\nThis has been patched in 7.0.1815", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@oneuptime/model" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.1815" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "@oneuptime/common-server" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.1815" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-246p-xmg8-wmcq" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29194" + }, + { + "type": "WEB", + "url": "https://github.com/OneUptime/oneuptime/commit/14016d23d834038dd65d3a96cf71af04b556a32c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OneUptime/oneuptime" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:37:27Z", + "nvd_published_at": "2024-03-24T19:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-38jr-29fh-w9vm/GHSA-38jr-29fh-w9vm.json b/advisories/github-reviewed/2024/03/GHSA-38jr-29fh-w9vm/GHSA-38jr-29fh-w9vm.json new file mode 100644 index 00000000000..e19c0d80bc0 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-38jr-29fh-w9vm/GHSA-38jr-29fh-w9vm.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-38jr-29fh-w9vm", + "modified": "2024-03-25T19:37:46Z", + "published": "2024-03-25T19:37:46Z", + "aliases": [ + "CVE-2024-29189" + ], + "summary": "ansys-geometry-core OS Command Injection vulnerability", + "details": "subprocess call with shell=True identified, security issue.\n\n#### Code\n\nOn file [src/ansys/geometry/core/connection/product_instance.py](https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428):\n\n```\n403 def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:\n404 \"\"\"\n405 Start the program where the path is the first item of the ``args`` array argument.\n406\n407 Parameters\n408 ----------\n409 args : List[str]\n410 List of arguments to be passed to the program. The first list's item shall\n411 be the program path.\n412 local_env : Dict[str,str]\n413 Environment variables to be passed to the program.\n414\n415 Returns\n416 -------\n417 subprocess.Popen\n418 The subprocess object.\n419 \"\"\"\n420 return subprocess.Popen(\n421 args,\n422 shell=os.name != \"nt\",\n423 stdin=subprocess.DEVNULL,\n424 stdout=subprocess.DEVNULL,\n425 stderr=subprocess.DEVNULL,\n426 env=local_env,\n427 )\n428 \n429 \n\n```\n\nUpon calling this method ``_start_program`` directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. With this resolution made through #1076 and #1077, we make sure that this method is only called from within the library and we are no longer enabling the ``shell=True`` option.\n\n#### CWE - 78\n\nFor more information see https://cwe.mitre.org/data/definitions/78.html\n\n#### More information\n\nVisit https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html to find out more information.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ansys-geometry-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.3.0" + }, + { + "fixed": "0.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansys-geometry-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.4.0" + }, + { + "fixed": "0.4.12" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ansys/pyansys-geometry/security/advisories/GHSA-38jr-29fh-w9vm" + }, + { + "type": "WEB", + "url": "https://github.com/ansys/pyansys-geometry/pull/1076" + }, + { + "type": "WEB", + "url": "https://github.com/ansys/pyansys-geometry/pull/1077" + }, + { + "type": "WEB", + "url": "https://github.com/ansys/pyansys-geometry/commit/902071701c4f3a8258cbaa46c28dc0a65442d1bc" + }, + { + "type": "WEB", + "url": "https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f" + }, + { + "type": "WEB", + "url": "https://bandit.readthedocs.io/en/1.7.8/plugins/b602_subprocess_popen_with_shell_equals_true.html" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ansys/pyansys-geometry" + }, + { + "type": "WEB", + "url": "https://github.com/ansys/pyansys-geometry/blob/52cba1737a8a7812e5430099f715fa2160ec007b/src/ansys/geometry/core/connection/product_instance.py#L403-L428" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:37:46Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-592j-995h-p23j/GHSA-592j-995h-p23j.json b/advisories/github-reviewed/2024/03/GHSA-592j-995h-p23j/GHSA-592j-995h-p23j.json new file mode 100644 index 00000000000..434d0ddd450 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-592j-995h-p23j/GHSA-592j-995h-p23j.json @@ -0,0 +1,147 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-592j-995h-p23j", + "modified": "2024-03-25T19:37:00Z", + "published": "2024-03-25T19:36:59Z", + "aliases": [ + "CVE-2024-27281" + ], + "summary": "RDoc RCE vulnerability with .rdoc_options", + "details": "An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.\n\nWhen parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.\n\nWhen loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.\n\nWe recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.0 users: Update to `rdoc` 6.3.4.1\n* For Ruby 3.1 users: Update to `rdoc` 6.4.1.1\n* For Ruby 3.2 users: Update to `rdoc` 6.5.1.1\n\nYou can use `gem update rdoc` to update it. If you are using bundler, please add `gem \"rdoc\", \">= 6.6.3.1\"` to your `Gemfile`.\n\nNote: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "rdoc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.3.0" + }, + { + "fixed": "6.3.4.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "rdoc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.4.0" + }, + { + "fixed": "6.4.1.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "rdoc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.5.0" + }, + { + "fixed": "6.5.1.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "RubyGems", + "name": "rdoc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.6.0" + }, + { + "fixed": "6.6.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/1254b0066f312ddbf7fae7a195e66ce5b3bc6656" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/48617985e9fbc2825219d55f04e3e0e98d2923be" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/811f125a4a0cc968e3eb18e16ea6c1a3b49a11bf" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/a5de13bf0f0c26f8e764e82b5bf4bf8bffc7198e" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/d22ba930f1f611dda531dba04cd3d2531bb3f8a5" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/rdoc/commit/e4a0e71e6f1032f8b4e5e58b4ef60d702c22ce17" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ruby/rdoc" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2024-27281.yml" + }, + { + "type": "WEB", + "url": "https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:36:59Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json b/advisories/github-reviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json similarity index 66% rename from advisories/unreviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json rename to advisories/github-reviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json index dc07d00b45c..a3017df393f 100644 --- a/advisories/unreviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json +++ b/advisories/github-reviewed/2024/03/GHSA-87qp-7cw8-8q9c/GHSA-87qp-7cw8-8q9c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-87qp-7cw8-8q9c", - "modified": "2024-03-25T06:30:24Z", + "modified": "2024-03-25T19:36:43Z", "published": "2024-03-25T06:30:24Z", "aliases": [ "CVE-2024-21505" ], + "summary": "web3-utils Prototype Pollution vulnerability", "details": "Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.\nAn attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "web3-utils" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.2.1" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/web3/web3.js/commit/8ed041c6635d807b3da8960ad49e125e3d1b0e80" }, + { + "type": "PACKAGE", + "url": "https://github.com/web3/web3.js" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-WEB3UTILS-6229337" @@ -35,8 +58,8 @@ "CWE-1321" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:36:43Z", "nvd_published_at": "2024-03-25T05:15:50Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-g4v6-69p6-q3p4/GHSA-g4v6-69p6-q3p4.json b/advisories/github-reviewed/2024/03/GHSA-g4v6-69p6-q3p4/GHSA-g4v6-69p6-q3p4.json new file mode 100644 index 00000000000..bd6a97dee71 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-g4v6-69p6-q3p4/GHSA-g4v6-69p6-q3p4.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g4v6-69p6-q3p4", + "modified": "2024-03-25T19:36:25Z", + "published": "2024-03-25T19:36:25Z", + "aliases": [ + + ], + "summary": "WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM ", + "details": "# Summary\n\nBurn uses an unprotected C:\\Windows\\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users.\n\n# Details\n\nWhen a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\\Windows\\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges.\n\n```\nicacls c:\\windows\\temp\n\nBUILTIN\\Users:(CI)(S,WD,AD,X)\nBUILTIN\\Administrators:(F)\nBUILTIN\\Administrators:(OI)(CI)(IO)(F)\nNT AUTHORITY\\SYSTEM:(F)\nNT AUTHORITY\\SYSTEM:(OI)(CI)(IO)(F)\nCREATOR OWNER:(OI)(CI)(IO)(F)\n```\n\nBuilt in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel\n \n# PoC\n\nPoC works against the against visual studio enterprise with update 3 installer\n\n## Reproduction steps\n\nAs a standard user, run the poc.\nMount the iso and run visual studio [installer ](https://myvs.download.prss.microsoft.com/dbazure/en_visual_studio_enterprise_2015_with_update_3_x86_x64_dvd_8923288.iso?t=8132cd54-4b83-4478-8b73-fd9eb93437bf&P1=1709239640&P2=601&P3=2&P4=iorgKPv%2bG8n2NANTPUVoB92rr8t3W4XM594%2f9BtQQJrYrr8SwxGDxV%2fj%2f2F6Ulto0bXrIaFoZUr4yV37YAsOZVpM29IMtQEO0673AbDVuTe93qDb6wb7xdlpZSse0LZURUwwIFw5cwHQS2ZtvkunXE0osgXtEBT2IzVbPwVH39%2fum854xb4e2Dp61wgNrMZcOLLluBbeA3KX1sP3mm7WAWXBvlFiQWEnTfR5XH5mlLyPy2qfqCXWCjl84jNX7uY%2bpLR1IbfeD2JlcIQNeW2QrvmmqRrRbGvvaCA97IaSjM16XcDqVjvAEGW3sWXUc7y%2fEf68WZIyT7iilaEDUvaqqA%3d%3d&su=1)as local system account.\nThe PoC should hijack the the binaries dropped by vs installer and a child process \"notepad.exe\" will be running.\n\n# Impact\n\nThis is an Elevation of Privilege Vulnerability where a low privileged user can hijack binaries in an unprotected path C:\\Windows\\Temp to elevate to the SYSTEM user privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "PanelSwWix4.Sdk" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.0-psw-wix.0265-49" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 5.0.0-psw-wix.0262-48" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/nirbar/wix4/security/advisories/GHSA-g4v6-69p6-q3p4" + }, + { + "type": "WEB", + "url": "https://github.com/nirbar/wix4/commit/0410df93a5f29e4235b4b78b90a1384ffafd062b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/nirbar/wix4" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:36:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json b/advisories/github-reviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json new file mode 100644 index 00000000000..e62ed809e34 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jwrc-3v3f-5cq5", + "modified": "2024-03-25T19:37:34Z", + "published": "2024-03-23T21:30:39Z", + "aliases": [ + "CVE-2024-1603" + ], + "summary": "PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file", + "details": "paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "paddlepaddle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1603" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PaddlePaddle/Paddle" + }, + { + "type": "WEB", + "url": "https://github.com/PaddlePaddle/Paddle/blob/release/2.6/python/paddle/vision/ops.py#L1262" + }, + { + "type": "WEB", + "url": "https://github.com/PaddlePaddle/Paddle/blob/release/2.6/python/paddle/vision/ops.py#L1295-L1334" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-73" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:37:34Z", + "nvd_published_at": "2024-03-23T19:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/03/GHSA-v5h6-c2hv-hv3r/GHSA-v5h6-c2hv-hv3r.json b/advisories/github-reviewed/2024/03/GHSA-v5h6-c2hv-hv3r/GHSA-v5h6-c2hv-hv3r.json new file mode 100644 index 00000000000..2bd3f991264 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-v5h6-c2hv-hv3r/GHSA-v5h6-c2hv-hv3r.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v5h6-c2hv-hv3r", + "modified": "2024-03-25T19:36:52Z", + "published": "2024-03-25T19:36:52Z", + "aliases": [ + "CVE-2024-27280" + ], + "summary": "StringIO buffer overread vulnerability", + "details": "An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.\n\nThe `ungetbyte` and `ungetc` methods on a StringIO can read past the end of a string, and a subsequent call to `StringIO.gets` may return the memory value.\n\nThis vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.\n\nWe recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:\n\n* For Ruby 3.0 users: Update to `stringio` 3.0.1.1\n* For Ruby 3.1 users: Update to `stringio` 3.1.0.2\n\nYou can use `gem update stringio` to update it. If you are using bundler, please add `gem \"stringio\", \">= 3.0.1.2\"` to your `Gemfile`.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "stringio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ruby/stringio/commit/0e596524097706263d10900ca180898e4a8f5233" + }, + { + "type": "WEB", + "url": "https://github.com/ruby/stringio/commit/c58c5f54f1eab99665ea6a161d29ff6a7490afc8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ruby/stringio" + }, + { + "type": "WEB", + "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stringio/CVE-2024-27280.yml" + }, + { + "type": "WEB", + "url": "https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-126" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-03-25T19:36:52Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json b/advisories/unreviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json deleted file mode 100644 index d13bec2ca7b..00000000000 --- a/advisories/unreviewed/2024/03/GHSA-jwrc-3v3f-5cq5/GHSA-jwrc-3v3f-5cq5.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jwrc-3v3f-5cq5", - "modified": "2024-03-23T21:30:39Z", - "published": "2024-03-23T21:30:39Z", - "aliases": [ - "CVE-2024-1603" - ], - "details": "confirmed", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1603" - }, - { - "type": "WEB", - "url": "https://huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-73" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-03-23T19:15:07Z" - } -} \ No newline at end of file