diff --git a/advisories/github-reviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json b/advisories/github-reviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json new file mode 100644 index 00000000000..6a0c4c8aad1 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j6vx-r77h-44wc", + "modified": "2024-08-02T15:16:08Z", + "published": "2024-08-02T12:31:43Z", + "aliases": [ + "CVE-2024-27182" + ], + "summary": "Apache Linkis arbitrary file deletion vulnerability", + "details": "In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on a user with an administrator account could delete any file accessible by the Linkis system user. Users are recommended to upgrade to version 1.6.0, which fixes this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.linkis:linkis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27182" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/linkis" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-552" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-02T15:16:07Z", + "nvd_published_at": "2024-08-02T10:16:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json b/advisories/github-reviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json new file mode 100644 index 00000000000..b05f06cc93c --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qff2-8qw7-hcvw", + "modified": "2024-08-02T15:16:26Z", + "published": "2024-08-02T12:31:43Z", + "aliases": [ + "CVE-2024-36268" + ], + "summary": "Apache Inlong Code Injection vulnerability", + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/10251", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.inlong:tubemq-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.10.0" + }, + { + "fixed": "1.13.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36268" + }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/pull/10251" + }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/commit/85fc8b02e69badc5103fadb77559a921c788537a" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-08-02T15:16:26Z", + "nvd_published_at": "2024-08-02T10:16:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json b/advisories/github-reviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json new file mode 100644 index 00000000000..156180ecf94 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v352-rg37-5q5m", + "modified": "2024-08-02T15:16:43Z", + "published": "2024-08-02T12:31:43Z", + "aliases": [ + "CVE-2024-27181" + ], + "summary": "Apache Linkis vulnerable to privilege escalation", + "details": "In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.linkis:linkis" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.6.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27181" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/linkis" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-02T15:16:43Z", + "nvd_published_at": "2024-08-02T10:15:59Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json b/advisories/unreviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json deleted file mode 100644 index 54ae69e13a0..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-j6vx-r77h-44wc", - "modified": "2024-08-02T12:31:43Z", - "published": "2024-08-02T12:31:43Z", - "aliases": [ - "CVE-2024-27182" - ], - "details": "In Apache Linkis <= 1.5.0,\n\nArbitrary file deletion in Basic management services on \n\nA user with an administrator account could delete any file accessible by the Linkis system user\n\n.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27182" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-552" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-02T10:16:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json b/advisories/unreviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json deleted file mode 100644 index 448046b0ea2..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qff2-8qw7-hcvw", - "modified": "2024-08-02T12:31:43Z", - "published": "2024-08-02T12:31:43Z", - "aliases": [ - "CVE-2024-36268" - ], - "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/10251", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36268" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-02T10:16:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json b/advisories/unreviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json deleted file mode 100644 index 8e659c2db07..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v352-rg37-5q5m", - "modified": "2024-08-02T12:31:43Z", - "published": "2024-08-02T12:31:43Z", - "aliases": [ - "CVE-2024-27181" - ], - "details": "In Apache Linkis <= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27181" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-269" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-02T10:15:59Z" - } -} \ No newline at end of file