From 9a70c7787b10f1f3cf52c69e7fcf1bc3a38c328f Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 21 May 2024 18:16:47 +0000
Subject: [PATCH] Publish Advisories

GHSA-364c-vvqx-446c
GHSA-ppjh-xp5v-46wc
GHSA-h6mp-mc7g-mg49
---
 .../GHSA-364c-vvqx-446c.json                  | 14 +++-
 .../GHSA-ppjh-xp5v-46wc.json                  | 12 +++-
 .../GHSA-h6mp-mc7g-mg49.json                  | 65 +++++++++++++++++++
 3 files changed, 86 insertions(+), 5 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-h6mp-mc7g-mg49/GHSA-h6mp-mc7g-mg49.json

diff --git a/advisories/github-reviewed/2023/09/GHSA-364c-vvqx-446c/GHSA-364c-vvqx-446c.json b/advisories/github-reviewed/2023/09/GHSA-364c-vvqx-446c/GHSA-364c-vvqx-446c.json
index ecff4b56b50..f49f421103b 100644
--- a/advisories/github-reviewed/2023/09/GHSA-364c-vvqx-446c/GHSA-364c-vvqx-446c.json
+++ b/advisories/github-reviewed/2023/09/GHSA-364c-vvqx-446c/GHSA-364c-vvqx-446c.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-364c-vvqx-446c",
-  "modified": "2023-09-22T19:43:27Z",
+  "modified": "2024-05-21T18:15:12Z",
   "published": "2023-09-20T06:30:50Z",
   "aliases": [
     "CVE-2023-43620"
   ],
   "summary": "Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device",
-  "details": "An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. ",
+  "details": "An issue was discovered in Croc before 9.6.16. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. ",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -28,7 +28,7 @@
               "introduced": "0"
             },
             {
-              "last_affected": "9.6.5"
+              "fixed": "9.6.16"
             }
           ]
         }
@@ -44,6 +44,14 @@
       "type": "WEB",
       "url": "https://github.com/schollz/croc/issues/595"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/schollz/croc/pull/697"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/schollz/croc"
diff --git a/advisories/github-reviewed/2023/09/GHSA-ppjh-xp5v-46wc/GHSA-ppjh-xp5v-46wc.json b/advisories/github-reviewed/2023/09/GHSA-ppjh-xp5v-46wc/GHSA-ppjh-xp5v-46wc.json
index 368bba37726..1b2241e1126 100644
--- a/advisories/github-reviewed/2023/09/GHSA-ppjh-xp5v-46wc/GHSA-ppjh-xp5v-46wc.json
+++ b/advisories/github-reviewed/2023/09/GHSA-ppjh-xp5v-46wc/GHSA-ppjh-xp5v-46wc.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ppjh-xp5v-46wc",
-  "modified": "2023-09-22T19:40:39Z",
+  "modified": "2024-05-21T18:16:24Z",
   "published": "2023-09-20T06:30:50Z",
   "aliases": [
     "CVE-2023-43619"
@@ -28,7 +28,7 @@
               "introduced": "0"
             },
             {
-              "last_affected": "9.6.5"
+              "fixed": "9.6.16"
             }
           ]
         }
@@ -44,6 +44,14 @@
       "type": "WEB",
       "url": "https://github.com/schollz/croc/issues/593"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/schollz/croc/pull/697"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/schollz/croc"
diff --git a/advisories/github-reviewed/2024/05/GHSA-h6mp-mc7g-mg49/GHSA-h6mp-mc7g-mg49.json b/advisories/github-reviewed/2024/05/GHSA-h6mp-mc7g-mg49/GHSA-h6mp-mc7g-mg49.json
new file mode 100644
index 00000000000..bf69a10f9fb
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-h6mp-mc7g-mg49/GHSA-h6mp-mc7g-mg49.json
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h6mp-mc7g-mg49",
+  "modified": "2024-05-21T18:16:24Z",
+  "published": "2024-05-21T18:16:24Z",
+  "aliases": [
+
+  ],
+  "summary": "scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token",
+  "details": "Before version 3.7 the bundle is vulnerable to a [security issue in JWT](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/), which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "scheb/two-factor-bundle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.7.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/scheb/two-factor-bundle/issues/143"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/scheb/two-factor-bundle/commit/8890c1e47ae89e0ac6f8a40fd4bb4b91c2081aa7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/scheb/two-factor-bundle/2018-07-08.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/scheb/two-factor-bundle"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-287"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-21T18:16:24Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file