diff --git a/advisories/github-reviewed/2022/03/GHSA-62m3-fc7f-jpp8/GHSA-62m3-fc7f-jpp8.json b/advisories/github-reviewed/2022/03/GHSA-62m3-fc7f-jpp8/GHSA-62m3-fc7f-jpp8.json index 3bc71f1a020..a98579f5dfe 100644 --- a/advisories/github-reviewed/2022/03/GHSA-62m3-fc7f-jpp8/GHSA-62m3-fc7f-jpp8.json +++ b/advisories/github-reviewed/2022/03/GHSA-62m3-fc7f-jpp8/GHSA-62m3-fc7f-jpp8.json @@ -36,6 +36,10 @@ } ], "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10905" + }, { "type": "WEB", "url": "https://github.com/erusev/parsedown/issues/699" @@ -47,6 +51,10 @@ { "type": "PACKAGE", "url": "https://github.com/erusev/parsedown" + }, + { + "type": "WEB", + "url": "https://github.com/erusev/parsedown/releases/tag/1.7.2" } ], "database_specific": { diff --git a/advisories/github-reviewed/2022/03/GHSA-qgpv-86r3-87fh/GHSA-qgpv-86r3-87fh.json b/advisories/github-reviewed/2022/03/GHSA-qgpv-86r3-87fh/GHSA-qgpv-86r3-87fh.json index 448f9e051d3..d550c20b3b5 100644 --- a/advisories/github-reviewed/2022/03/GHSA-qgpv-86r3-87fh/GHSA-qgpv-86r3-87fh.json +++ b/advisories/github-reviewed/2022/03/GHSA-qgpv-86r3-87fh/GHSA-qgpv-86r3-87fh.json @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/erusev/parsedown/pull/495" }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/erusev/parsedown/CVE-2018-1000162.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/erusev/parsedown" diff --git a/advisories/github-reviewed/2022/09/GHSA-6hrg-qmvc-2xh8/GHSA-6hrg-qmvc-2xh8.json b/advisories/github-reviewed/2022/09/GHSA-6hrg-qmvc-2xh8/GHSA-6hrg-qmvc-2xh8.json index 14f0951b669..50854c3400f 100644 --- a/advisories/github-reviewed/2022/09/GHSA-6hrg-qmvc-2xh8/GHSA-6hrg-qmvc-2xh8.json +++ b/advisories/github-reviewed/2022/09/GHSA-6hrg-qmvc-2xh8/GHSA-6hrg-qmvc-2xh8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6hrg-qmvc-2xh8", - "modified": "2023-04-21T20:06:28Z", + "modified": "2023-07-06T19:33:37Z", "published": "2022-09-27T00:00:22Z", "aliases": [ "CVE-2022-21797" ], "summary": "joblib vulnerable to arbitrary code execution", - "details": "The package joblib from 0 and before 1.1.1 and 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.", + "details": "The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the `pre_dispatch` flag in `Parallel()` class due to the `eval()` statement.", "severity": [ { "type": "CVSS_V3", @@ -28,7 +28,7 @@ "introduced": "0" }, { - "fixed": "1.1.1" + "fixed": "1.2.0" } ] } @@ -68,6 +68,10 @@ "type": "PACKAGE", "url": "https://github.com/joblib/joblib" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/joblib/PYSEC-2022-288.yaml" + }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00020.html"