From 9afbcad96a7623392ba11b5e6de22ddafebef709 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 13 Feb 2025 00:45:42 +0000
Subject: [PATCH] Publish Advisories

GHSA-248v-346w-9cwc
GHSA-mm6v-68qp-f9fw
---
 .../2024/07/GHSA-248v-346w-9cwc/GHSA-248v-346w-9cwc.json    | 6 +++++-
 .../2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json    | 6 ++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2024/07/GHSA-248v-346w-9cwc/GHSA-248v-346w-9cwc.json b/advisories/github-reviewed/2024/07/GHSA-248v-346w-9cwc/GHSA-248v-346w-9cwc.json
index 347f52c8796..f6091ed3850 100644
--- a/advisories/github-reviewed/2024/07/GHSA-248v-346w-9cwc/GHSA-248v-346w-9cwc.json
+++ b/advisories/github-reviewed/2024/07/GHSA-248v-346w-9cwc/GHSA-248v-346w-9cwc.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-248v-346w-9cwc",
-  "modified": "2025-02-11T22:38:18Z",
+  "modified": "2025-02-13T00:44:19Z",
   "published": "2024-07-05T20:06:40Z",
   "aliases": [
     "CVE-2024-39689"
@@ -47,6 +47,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/certifi/python-certifi"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"
diff --git a/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json b/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
index 1167ca9ae17..576ff620235 100644
--- a/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
+++ b/advisories/github-reviewed/2025/01/GHSA-mm6v-68qp-f9fw/GHSA-mm6v-68qp-f9fw.json
@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mm6v-68qp-f9fw",
-  "modified": "2025-02-12T20:51:44Z",
+  "modified": "2025-02-13T00:44:33Z",
   "published": "2025-01-15T22:04:19Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2025-25286"
+  ],
   "summary": "Crayfish allows Remote Code Execution via Homarus Authorization header",
   "details": "### Impact\n\nRemote code execution may be possible in web-accessible installations of Homarus in certain configurations.\n\n### Patches\n\nThe issue has been patched in `islandora/crayfish:4.1.0`\n\n### Workarounds\n\nThe exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus.\n\nConfigure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.\n\n### References\n\n- XBOW-024-071",
   "severity": [