From 9affb155bb0e538f89629cb338b73a6e177e03fc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 6 Feb 2024 20:27:01 +0000 Subject: [PATCH] Publish Advisories GHSA-f3h9-8phc-6gvh GHSA-h24r-m9qc-pvpg GHSA-h24r-m9qc-pvpg --- .../GHSA-f3h9-8phc-6gvh.json | 31 ++++- .../GHSA-h24r-m9qc-pvpg.json | 123 ++++++++++++++++++ .../GHSA-h24r-m9qc-pvpg.json | 46 ------- 3 files changed, 150 insertions(+), 50 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json (61%) create mode 100644 advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json delete mode 100644 advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json diff --git a/advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json b/advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json similarity index 61% rename from advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json rename to advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json index 2bdadd2c853..3620a66eef1 100644 --- a/advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json +++ b/advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-f3h9-8phc-6gvh", - "modified": "2024-02-06T00:30:28Z", + "modified": "2024-02-06T20:25:41Z", "published": "2024-02-06T00:30:28Z", "aliases": [ "CVE-2024-0964" ], + "summary": "Gradio Path Traversal vulnerability", "details": "A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "gradio" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.9.0" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70" }, + { + "type": "PACKAGE", + "url": "https://github.com/gradio-app/gradio" + }, { "type": "WEB", "url": "https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741" @@ -35,8 +58,8 @@ "CWE-22" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-06T20:25:41Z", "nvd_published_at": "2024-02-05T23:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json b/advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json new file mode 100644 index 00000000000..d153d67457f --- /dev/null +++ b/advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json @@ -0,0 +1,123 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h24r-m9qc-pvpg", + "modified": "2024-02-06T20:26:17Z", + "published": "2024-02-06T12:30:31Z", + "aliases": [ + "CVE-2024-0690" + ], + "summary": "Ansible-core information disclosure flaw", + "details": "An information disclosure flaw was found in ansible-core due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.16.0b1" + }, + { + "fixed": "2.16.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.15.0b1" + }, + { + "fixed": "2.15.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ansible-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.14.14" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0690" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/pull/82565" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/6935c8e303440addd3871ecf8e04bde61080b032" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/78db3a3de6b40fb52d216685ae7cb903c609c3e1" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/b9a03bbf5a63459468baf8895ff74a62e9be4532" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-0690" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259013" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ansible/ansible" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-117" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-06T20:26:17Z", + "nvd_published_at": "2024-02-06T12:15:55Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json b/advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json deleted file mode 100644 index 7fb1cb94c81..00000000000 --- a/advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h24r-m9qc-pvpg", - "modified": "2024-02-06T12:30:31Z", - "published": "2024-02-06T12:30:31Z", - "aliases": [ - "CVE-2024-0690" - ], - "details": "An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0690" - }, - { - "type": "WEB", - "url": "https://github.com/ansible/ansible/pull/82565" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2024-0690" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259013" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-117" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-02-06T12:15:55Z" - } -} \ No newline at end of file