diff --git a/advisories/github-reviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json b/advisories/github-reviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json new file mode 100644 index 00000000000..eb680efaee9 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fhr7-8jx4-r9cp", + "modified": "2024-09-16T17:19:18Z", + "published": "2023-12-30T00:30:23Z", + "aliases": [ + "CVE-2023-3628" + ], + "summary": "Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions", + "details": "A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.infinispan:infinispan-server-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.0.Dev01" + }, + { + "fixed": "15.0.0.Dev04" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.infinispan:infinispan-server-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.0.18.Final" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3628" + }, + { + "type": "WEB", + "url": "https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263" + }, + { + "type": "WEB", + "url": "https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:5396" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-3628" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217924" + }, + { + "type": "PACKAGE", + "url": "https://github.com/infinispan/infinispan" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20240125-0004" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-304" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T17:19:18Z", + "nvd_published_at": "2023-12-18T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json b/advisories/github-reviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json new file mode 100644 index 00000000000..79c0688b3a2 --- /dev/null +++ b/advisories/github-reviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json @@ -0,0 +1,104 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4w2-hjmr-36m7", + "modified": "2024-09-16T17:19:37Z", + "published": "2023-12-30T00:30:23Z", + "aliases": [ + "CVE-2023-3629" + ], + "summary": " Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions", + "details": "A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.infinispan:infinispan-server-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "15.0.0.Dev01" + }, + { + "fixed": "15.0.0.Dev04" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.infinispan:infinispan-server-rest" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "14.0.18.Final" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3629" + }, + { + "type": "WEB", + "url": "https://github.com/infinispan/infinispan/commit/11b3cb0f7ba68b73dd32f655ff3f3df842a0c6bd" + }, + { + "type": "WEB", + "url": "https://github.com/infinispan/infinispan/commit/1e3cc542336d2f49743ab8176ed6f1175e034c59" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:5396" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-3629" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217926" + }, + { + "type": "PACKAGE", + "url": "https://github.com/infinispan/infinispan" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20240125-0004" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-304" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T17:19:37Z", + "nvd_published_at": "2023-12-18T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-2326-pfpj-vx3h/GHSA-2326-pfpj-vx3h.json b/advisories/github-reviewed/2024/09/GHSA-2326-pfpj-vx3h/GHSA-2326-pfpj-vx3h.json new file mode 100644 index 00000000000..d42498ee1fa --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-2326-pfpj-vx3h/GHSA-2326-pfpj-vx3h.json @@ -0,0 +1,82 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2326-pfpj-vx3h", + "modified": "2024-09-16T17:19:01Z", + "published": "2024-09-16T17:19:01Z", + "aliases": [ + + ], + "summary": "lexical-core has multiple soundness issues", + "details": "`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "lexical-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/Alexhuszagh/rust-lexical/issues/101" + }, + { + "type": "WEB", + "url": "https://github.com/Alexhuszagh/rust-lexical/issues/102" + }, + { + "type": "WEB", + "url": "https://github.com/Alexhuszagh/rust-lexical/issues/104" + }, + { + "type": "WEB", + "url": "https://github.com/Alexhuszagh/rust-lexical/issues/126" + }, + { + "type": "WEB", + "url": "https://github.com/Alexhuszagh/rust-lexical/issues/95" + }, + { + "type": "PACKAGE", + "url": "https://github.com/Alexhuszagh/rust-lexical" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-c2hm-mjxv-89r4" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2023-0055" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2023-0086.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-09-16T17:19:01Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json b/advisories/unreviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json deleted file mode 100644 index 80c7bcd7ee8..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-fhr7-8jx4-r9cp/GHSA-fhr7-8jx4-r9cp.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fhr7-8jx4-r9cp", - "modified": "2024-09-16T14:37:22Z", - "published": "2023-12-30T00:30:23Z", - "aliases": [ - "CVE-2023-3628" - ], - "details": "A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3628" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2023:5396" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2023-3628" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217924" - }, - { - "type": "WEB", - "url": "https://security.netapp.com/advisory/ntap-20240125-0004" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-304" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-18T14:15:08Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json b/advisories/unreviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json deleted file mode 100644 index 730c90b34f3..00000000000 --- a/advisories/unreviewed/2023/12/GHSA-r4w2-hjmr-36m7/GHSA-r4w2-hjmr-36m7.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-r4w2-hjmr-36m7", - "modified": "2024-09-16T14:37:22Z", - "published": "2023-12-30T00:30:23Z", - "aliases": [ - "CVE-2023-3629" - ], - "details": "A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3629" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2023:5396" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2023-3629" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217926" - }, - { - "type": "WEB", - "url": "https://security.netapp.com/advisory/ntap-20240125-0004" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-304" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-12-18T14:15:08Z" - } -} \ No newline at end of file