diff --git a/advisories/unreviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json b/advisories/github-reviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json similarity index 56% rename from advisories/unreviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json rename to advisories/github-reviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json index dc65a63f6a7..42fcd03c15a 100644 --- a/advisories/unreviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json +++ b/advisories/github-reviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qqc8-rv37-79q5", - "modified": "2024-12-13T18:31:55Z", + "modified": "2024-12-13T20:37:40Z", "published": "2024-03-15T09:30:37Z", "aliases": [ "CVE-2024-28053" ], + "summary": "Mattermost Server Resource Exhaustion", "details": "Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.\n\n", "severity": [ { @@ -13,12 +14,36 @@ "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost/server/v8" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20240209181221-674f549daf0e" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28053" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -30,8 +55,8 @@ "CWE-770" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:37:40Z", "nvd_published_at": "2024-03-15T09:15:07Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json b/advisories/github-reviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json similarity index 69% rename from advisories/unreviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json rename to advisories/github-reviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json index d2e35803718..e74077eba5e 100644 --- a/advisories/unreviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json +++ b/advisories/github-reviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g2r4-phv7-5fgv", - "modified": "2024-12-13T06:30:58Z", + "modified": "2024-12-13T20:37:35Z", "published": "2024-12-13T06:30:58Z", "aliases": [ "CVE-2024-21544" ], + "summary": "Browsershot Local File Inclusion", "details": "Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method.\nAn attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.", "severity": [ { @@ -14,10 +15,30 @@ }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "spatie/browsershot" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.0.1" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -27,6 +48,10 @@ "type": "WEB", "url": "https://github.com/spatie/browsershot/commit/fae8396641b961f62bd756920b14f01a4391296e" }, + { + "type": "PACKAGE", + "url": "https://github.com/spatie/browsershot" + }, { "type": "WEB", "url": "https://github.com/spatie/browsershot/blob/1e212b596c104138550ed4ef1b9977d8df570c67/src/Browsershot.php%23L258-L269" @@ -41,8 +66,8 @@ "CWE-20" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:37:35Z", "nvd_published_at": "2024-12-13T05:15:07Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json b/advisories/github-reviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json similarity index 71% rename from advisories/unreviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json rename to advisories/github-reviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json index 8e4801bcbe1..46977e02623 100644 --- a/advisories/unreviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json +++ b/advisories/github-reviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-v49p-m6gh-747c", - "modified": "2024-12-13T06:30:58Z", + "modified": "2024-12-13T20:37:27Z", "published": "2024-12-13T06:30:58Z", "aliases": [ "CVE-2024-21543" ], + "summary": "djoser Authentication Bypass", "details": "Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.", "severity": [ { @@ -14,10 +15,30 @@ }, { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "djoser" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.0" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -35,6 +56,10 @@ "type": "WEB", "url": "https://github.com/sunscrapers/djoser/commit/d33c3993c0c735f23cbedc60fa59fce69354f19d" }, + { + "type": "PACKAGE", + "url": "https://github.com/sunscrapers/djoser" + }, { "type": "WEB", "url": "https://github.com/sunscrapers/djoser/releases/tag/2.3.0" @@ -48,9 +73,9 @@ "cwe_ids": [ "CWE-287" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:37:27Z", "nvd_published_at": "2024-12-13T05:15:07Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json b/advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json similarity index 64% rename from advisories/unreviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json rename to advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json index d4fb2c87ae3..e05121512ba 100644 --- a/advisories/unreviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json +++ b/advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xx83-cxmq-x89m", - "modified": "2024-12-13T00:30:50Z", + "modified": "2024-12-13T20:37:17Z", "published": "2024-12-13T00:30:50Z", "aliases": [ "CVE-2024-12289" ], + "summary": "Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service", "details": "Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.\n\nThis vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/boundary" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.18.2" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,10 @@ { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service" + }, + { + "type": "PACKAGE", + "url": "https://github.com/hashicorp/boundary" } ], "database_specific": { @@ -29,8 +54,8 @@ "CWE-460" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:37:17Z", "nvd_published_at": "2024-12-12T23:15:10Z" } } \ No newline at end of file