From 9821b41a364a651b2b968b8638f0b8e82dc66b57 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 16 Sep 2024 20:21:19 +0000 Subject: [PATCH] Publish Advisories GHSA-3xq2-w6j4-c99r GHSA-5777-rcjj-9p22 GHSA-3xq2-w6j4-c99r --- .../GHSA-3xq2-w6j4-c99r.json | 87 +++++++++++++++++++ .../GHSA-5777-rcjj-9p22.json | 35 +++++++- .../GHSA-3xq2-w6j4-c99r.json | 35 -------- 3 files changed, 118 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json rename advisories/{unreviewed => github-reviewed}/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json (52%) delete mode 100644 advisories/unreviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json diff --git a/advisories/github-reviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json b/advisories/github-reviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json new file mode 100644 index 00000000000..aeeceeb3b9e --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json @@ -0,0 +1,87 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3xq2-w6j4-c99r", + "modified": "2024-09-16T20:19:35Z", + "published": "2024-09-16T14:37:28Z", + "aliases": [ + "CVE-2024-22399" + ], + "summary": "Apache Seata Deserialization of Untrusted Data vulnerability", + "details": "Deserialization of Untrusted Data vulnerability in Apache Seata. \n\nWhen developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol.\n\nThis issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0.\n\nUsers are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.seata:seata-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.1.0" + } + ] + } + ], + "versions": [ + "2.0.0" + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.seata:seata-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.8.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22399" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/incubator-seata" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/91nzzlxyj4nmks85gbzwkkjtbmnmlkc4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T20:18:41Z", + "nvd_published_at": "2024-09-16T12:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json b/advisories/github-reviewed/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json similarity index 52% rename from advisories/unreviewed/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json rename to advisories/github-reviewed/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json index 05eb2eb9e5d..1aa8295774e 100644 --- a/advisories/unreviewed/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json +++ b/advisories/github-reviewed/2024/09/GHSA-5777-rcjj-9p22/GHSA-5777-rcjj-9p22.json @@ -1,26 +1,53 @@ { "schema_version": "1.4.0", "id": "GHSA-5777-rcjj-9p22", - "modified": "2024-09-16T15:32:46Z", + "modified": "2024-09-16T20:20:49Z", "published": "2024-09-16T15:32:46Z", "aliases": [ "CVE-2024-39772" ], + "summary": "Mattermost Desktop App fails to safeguard screen capture functionality", "details": "Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "mattermost-desktop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.9.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39772" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/desktop" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-284" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T20:20:49Z", "nvd_published_at": "2024-09-16T15:15:16Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json b/advisories/unreviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json deleted file mode 100644 index a4f939d346d..00000000000 --- a/advisories/unreviewed/2024/09/GHSA-3xq2-w6j4-c99r/GHSA-3xq2-w6j4-c99r.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3xq2-w6j4-c99r", - "modified": "2024-09-16T14:37:28Z", - "published": "2024-09-16T14:37:28Z", - "aliases": [ - "CVE-2024-22399" - ], - "details": "Deserialization of Untrusted Data vulnerability in Apache Seata. \n\nWhen developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol.\n\nThis issue affects Apache Seata: 2.0.0, from 1.0.0 through 1.8.0.\n\nUsers are recommended to upgrade to version 2.1.0/1.8.1, which fixes the issue.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22399" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/91nzzlxyj4nmks85gbzwkkjtbmnmlkc4" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-09-16T12:15:02Z" - } -} \ No newline at end of file