diff --git a/advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json b/advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json similarity index 61% rename from advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json rename to advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json index 2bdadd2c853..3620a66eef1 100644 --- a/advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json +++ b/advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-f3h9-8phc-6gvh", - "modified": "2024-02-06T00:30:28Z", + "modified": "2024-02-06T20:25:41Z", "published": "2024-02-06T00:30:28Z", "aliases": [ "CVE-2024-0964" ], + "summary": "Gradio Path Traversal vulnerability", "details": "A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "gradio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.9.0" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70" }, + { + "type": "PACKAGE", + "url": "https://github.com/gradio-app/gradio" + }, { "type": "WEB", "url": "https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741" @@ -35,8 +58,8 @@ "CWE-22" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-06T20:25:41Z", "nvd_published_at": "2024-02-05T23:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json b/advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json new file mode 100644 index 00000000000..d153d67457f --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json @@ -0,0 +1,123 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h24r-m9qc-pvpg", + "modified": "2024-02-06T20:26:17Z", + "published": "2024-02-06T12:30:31Z", + "aliases": [ + "CVE-2024-0690" + ], + "summary": "Ansible-core information disclosure flaw", + "details": "An information disclosure flaw was found in ansible-core due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.16.0b1" + }, + { + "fixed": "2.16.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.15.0b1" + }, + { + "fixed": "2.15.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.14.14" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0690" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/pull/82565" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/6935c8e303440addd3871ecf8e04bde61080b032" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/78db3a3de6b40fb52d216685ae7cb903c609c3e1" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/b9a03bbf5a63459468baf8895ff74a62e9be4532" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-0690" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259013" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ansible/ansible" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-117" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-06T20:26:17Z", + "nvd_published_at": "2024-02-06T12:15:55Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json b/advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json deleted file mode 100644 index 7fb1cb94c81..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h24r-m9qc-pvpg", - "modified": "2024-02-06T12:30:31Z", - "published": "2024-02-06T12:30:31Z", - "aliases": [ - "CVE-2024-0690" - ], - "details": "An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0690" - }, - { - "type": "WEB", - "url": "https://github.com/ansible/ansible/pull/82565" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2024-0690" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259013" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-117" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-06T12:15:55Z" - } -} \ No newline at end of file