From 9c2311d392814616d74dbab20cb49014b59ee87d Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 22 Jul 2024 14:46:47 +0000
Subject: [PATCH] Publish Advisories

GHSA-f8hx-f4xw-c646
GHSA-f8hx-f4xw-c646
---
 .../GHSA-f8hx-f4xw-c646.json                  | 73 +++++++++++++++++++
 .../GHSA-f8hx-f4xw-c646.json                  | 38 ----------
 2 files changed, 73 insertions(+), 38 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json
 delete mode 100644 advisories/unreviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json

diff --git a/advisories/github-reviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json b/advisories/github-reviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json
new file mode 100644
index 00000000000..dab6413c462
--- /dev/null
+++ b/advisories/github-reviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f8hx-f4xw-c646",
+  "modified": "2024-07-22T14:44:52Z",
+  "published": "2024-07-21T12:30:48Z",
+  "aliases": [
+    "CVE-2024-6961"
+  ],
+  "summary": "Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference",
+  "details": "RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "guardrails-ai"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.5.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6961"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/guardrails-ai/guardrails/pull/922"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/guardrails-ai/guardrails/commit/f3d806afee31e2e3f97af682d16c3c1bc0d3c380"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "type": "WEB",
+      "url": "https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-611"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-07-22T14:44:52Z",
+    "nvd_published_at": "2024-07-21T11:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json b/advisories/unreviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json
deleted file mode 100644
index 95347bc8f4b..00000000000
--- a/advisories/unreviewed/2024/07/GHSA-f8hx-f4xw-c646/GHSA-f8hx-f4xw-c646.json
+++ /dev/null
@@ -1,38 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-f8hx-f4xw-c646",
-  "modified": "2024-07-21T12:30:48Z",
-  "published": "2024-07-21T12:30:48Z",
-  "aliases": [
-    "CVE-2024-6961"
-  ],
-  "details": "RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6961"
-    },
-    {
-      "type": "WEB",
-      "url": "https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-07-21T11:15:03Z"
-  }
-}
\ No newline at end of file