Publish Advisories

GHSA-pmj6-9f8c-8g2m
GHSA-q53j-p6r2-g2v4

advisories/github-reviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pmj6-9f8c-8g2m",
-  "modified": "2022-10-25T19:00:23Z",
+  "modified": "2024-04-22T22:26:04Z",
   "published": "2022-05-24T17:43:35Z",
   "aliases": [
     "CVE-2021-25315"
   ],
+  "summary": "Saltstack Salt Unauthenticated Arbitrary Code Execution",
   "details": "A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "salt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3002.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -24,6 +43,10 @@
     {
       "type": "WEB",
       "url": "https://bugzilla.suse.com/show_bug.cgi?id=1182382"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/saltstack/salt"
     }
   ],
   "database_specific": {
@@ -32,8 +55,8 @@
       "CWE-303"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-22T22:26:04Z",
     "nvd_published_at": "2021-03-03T10:15:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json

@@ -1,12 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q53j-p6r2-g2v4",
-  "modified": "2023-01-31T21:30:18Z",
+  "modified": "2024-04-22T22:25:25Z",
   "published": "2022-05-24T17:06:52Z",
   "aliases": [
     "CVE-2019-17361"
   ],
-  "details": "In SaltStack Salt through 2019.2.0, the salt-api NEST API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.",
+  "summary": "SaltStack Salt is vulnerable to command injection",
+  "details": "In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "salt"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2019.2.3"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +44,10 @@
       "type": "WEB",
       "url": "https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/saltstack/salt"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/saltstack/salt/commits/master"
@@ -46,9 +69,9 @@
     "cwe_ids": [
       "CWE-77"
     ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-22T22:25:25Z",
     "nvd_published_at": "2020-01-17T02:15:00Z"
   }
 }