diff --git a/advisories/unreviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json b/advisories/github-reviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json rename to advisories/github-reviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json index c78aa54bd26..f7ca1f87b33 100644 --- a/advisories/unreviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json +++ b/advisories/github-reviewed/2022/05/GHSA-pmj6-9f8c-8g2m/GHSA-pmj6-9f8c-8g2m.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pmj6-9f8c-8g2m", - "modified": "2022-10-25T19:00:23Z", + "modified": "2024-04-22T22:26:04Z", "published": "2022-05-24T17:43:35Z", "aliases": [ "CVE-2021-25315" ], + "summary": "Saltstack Salt Unauthenticated Arbitrary Code Execution", "details": "A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3002.2" + } + ] + } + ] + } ], "references": [ { @@ -24,6 +43,10 @@ { "type": "WEB", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1182382" + }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" } ], "database_specific": { @@ -32,8 +55,8 @@ "CWE-303" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:26:04Z", "nvd_published_at": "2021-03-03T10:15:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json b/advisories/github-reviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json rename to advisories/github-reviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json index 6b1f2b36537..ac97a0f174a 100644 --- a/advisories/unreviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json +++ b/advisories/github-reviewed/2022/05/GHSA-q53j-p6r2-g2v4/GHSA-q53j-p6r2-g2v4.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-q53j-p6r2-g2v4", - "modified": "2023-01-31T21:30:18Z", + "modified": "2024-04-22T22:25:25Z", "published": "2022-05-24T17:06:52Z", "aliases": [ "CVE-2019-17361" ], - "details": "In SaltStack Salt through 2019.2.0, the salt-api NEST API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.", + "summary": "SaltStack Salt is vulnerable to command injection", + "details": "In SaltStack Salt before 2019.2.3, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "salt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2019.2.3" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html#security-fix" }, + { + "type": "PACKAGE", + "url": "https://github.com/saltstack/salt" + }, { "type": "WEB", "url": "https://github.com/saltstack/salt/commits/master" @@ -46,9 +69,9 @@ "cwe_ids": [ "CWE-77" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T22:25:25Z", "nvd_published_at": "2020-01-17T02:15:00Z" } } \ No newline at end of file