From 9f475b86e77d36518236848059ce8f4f8bf992a8 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 3 Jan 2024 22:04:01 +0000 Subject: [PATCH] Publish Advisories GHSA-275c-w5mq-v5m2 GHSA-3cr5-2446-8pg3 GHSA-9xg9-hh45-xcm6 GHSA-crwj-2r3c-gx2g GHSA-qppw-c37g-xwcc --- .../GHSA-275c-w5mq-v5m2.json | 35 ++++++++++++-- .../GHSA-3cr5-2446-8pg3.json | 35 ++++++++++++-- .../GHSA-9xg9-hh45-xcm6.json | 46 ++++++++++++++++--- .../GHSA-crwj-2r3c-gx2g.json | 46 ++++++++++++++++--- .../GHSA-qppw-c37g-xwcc.json | 35 ++++++++++++-- 5 files changed, 173 insertions(+), 24 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json (52%) rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json (54%) rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json (50%) rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json (50%) rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json (53%) diff --git a/advisories/unreviewed/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json b/advisories/github-reviewed/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json similarity index 52% rename from advisories/unreviewed/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json rename to advisories/github-reviewed/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json index fbdb1d8800d..747fc5f7b05 100644 --- a/advisories/unreviewed/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json +++ b/advisories/github-reviewed/2024/01/GHSA-275c-w5mq-v5m2/GHSA-275c-w5mq-v5m2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-275c-w5mq-v5m2", - "modified": "2024-01-03T09:30:33Z", + "modified": "2024-01-03T22:02:51Z", "published": "2024-01-03T09:30:33Z", "aliases": [ "CVE-2023-52313" ], + "summary": "PaddlePaddle floating point exception in paddle.argmin and paddle.argmax", "details": "FPE in paddle.argmin and paddle.argmax in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.\n\n\n\n", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "PaddlePaddle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52313" }, + { + "type": "WEB", + "url": "https://github.com/PaddlePaddle/Paddle/commit/6ef71779197ad6faf51ac295022ab5008d81372f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PaddlePaddle/Paddle" + }, { "type": "WEB", "url": "https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-022.md" @@ -31,8 +58,8 @@ "CWE-369" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T22:02:51Z", "nvd_published_at": "2024-01-03T09:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json b/advisories/github-reviewed/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json similarity index 54% rename from advisories/unreviewed/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json rename to advisories/github-reviewed/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json index 426f188a5ff..1ab9ecd600c 100644 --- a/advisories/unreviewed/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json +++ b/advisories/github-reviewed/2024/01/GHSA-3cr5-2446-8pg3/GHSA-3cr5-2446-8pg3.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3cr5-2446-8pg3", - "modified": "2024-01-03T09:30:33Z", + "modified": "2024-01-03T22:03:02Z", "published": "2024-01-03T09:30:33Z", "aliases": [ "CVE-2023-52314" ], + "summary": "PaddlePaddle command injection in convert_shape_compare", "details": "PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.\n\n\n\n\n\n\n\n", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "PaddlePaddle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52314" }, + { + "type": "WEB", + "url": "https://github.com/PaddlePaddle/Paddle/commit/5ed9478fdef96a06eeec9093f9e768c97b094af3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PaddlePaddle/Paddle" + }, { "type": "WEB", "url": "https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-023.md" @@ -31,8 +58,8 @@ "CWE-78" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T22:03:02Z", "nvd_published_at": "2024-01-03T09:15:11Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json b/advisories/github-reviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json similarity index 50% rename from advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json rename to advisories/github-reviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json index f349d8e43df..5f7868a2b66 100644 --- a/advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json +++ b/advisories/github-reviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json @@ -1,23 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-9xg9-hh45-xcm6", - "modified": "2024-01-03T12:30:21Z", + "modified": "2024-01-03T22:03:13Z", "published": "2024-01-03T12:30:21Z", "aliases": [ "CVE-2023-51784" ], + "summary": "Apache InLong Manager Remote Code Execution vulnerability", "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/9329 \n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.inlong:manager-pojo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.5.0" + }, + { + "fixed": "1.10.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51784" }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/pull/9329" + }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/commit/1607837be28438c0ccae8da15afb653f2afed090" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/inlong" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/4nxbyl6mh5jgh0plk0qposbxwn6w9h8j" @@ -31,9 +65,9 @@ "cwe_ids": [ "CWE-94" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T22:03:13Z", "nvd_published_at": "2024-01-03T10:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json b/advisories/github-reviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json similarity index 50% rename from advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json rename to advisories/github-reviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json index 86834985786..133b48ebeb4 100644 --- a/advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json +++ b/advisories/github-reviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json @@ -1,23 +1,57 @@ { "schema_version": "1.4.0", "id": "GHSA-crwj-2r3c-gx2g", - "modified": "2024-01-03T12:30:21Z", + "modified": "2024-01-03T22:03:27Z", "published": "2024-01-03T12:30:21Z", "aliases": [ "CVE-2023-51785" ], + "summary": "Apache InLong Manager Arbitrary File Read Vulnerability", "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9331 \n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.inlong:manager-pojo" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.5.0" + }, + { + "fixed": "1.10.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51785" }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/pull/9331" + }, + { + "type": "WEB", + "url": "https://github.com/apache/inlong/commit/d674bfe28416aff728eabafc1f6b8bb9ba5a5b8e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/inlong" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/g0yjmtjqvp8bnf1j0tdsk0nhfozjdjno" @@ -31,9 +65,9 @@ "cwe_ids": [ "CWE-502" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T22:03:27Z", "nvd_published_at": "2024-01-03T10:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json b/advisories/github-reviewed/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json similarity index 53% rename from advisories/unreviewed/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json rename to advisories/github-reviewed/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json index 6a1b40df63c..4780e12b1d7 100644 --- a/advisories/unreviewed/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json +++ b/advisories/github-reviewed/2024/01/GHSA-qppw-c37g-xwcc/GHSA-qppw-c37g-xwcc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qppw-c37g-xwcc", - "modified": "2024-01-03T09:30:33Z", + "modified": "2024-01-03T22:02:40Z", "published": "2024-01-03T09:30:33Z", "aliases": [ "CVE-2023-52312" ], + "summary": "PaddlePaddle nullptr dereference in paddle.crop", "details": "Nullptr dereference in paddle.crop in PaddlePaddle before 2.6.0. This flaw can cause a runtime crash and a denial of service.\n\n\n\n", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "PaddlePaddle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.6.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52312" }, + { + "type": "WEB", + "url": "https://github.com/PaddlePaddle/Paddle/commit/488a0ddc322b24659b6b0067fea3030d2f013cf4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/PaddlePaddle/Paddle" + }, { "type": "WEB", "url": "https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2023-021.md" @@ -31,8 +58,8 @@ "CWE-476" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-03T22:02:40Z", "nvd_published_at": "2024-01-03T09:15:10Z" } } \ No newline at end of file