From a168cb99f19572d90c0887113686431de2a8989c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 13 Feb 2025 19:33:50 +0000 Subject: [PATCH] Publish Advisories GHSA-3vvc-v8c2-43r7 GHSA-9xc9-xq7w-vpcr GHSA-c3c6-f2ww-xfr2 GHSA-f4qf-m5gf-8jm8 GHSA-r4q3-7g4q-x89m GHSA-r8xp-52mq-rmm8 GHSA-vm5m-qmrx-fw8w --- .../2024/01/GHSA-3vvc-v8c2-43r7/GHSA-3vvc-v8c2-43r7.json | 2 +- .../2024/01/GHSA-9xc9-xq7w-vpcr/GHSA-9xc9-xq7w-vpcr.json | 4 ++-- .../2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json | 4 ++-- .../2024/01/GHSA-f4qf-m5gf-8jm8/GHSA-f4qf-m5gf-8jm8.json | 4 ++-- .../2024/01/GHSA-r4q3-7g4q-x89m/GHSA-r4q3-7g4q-x89m.json | 4 ++-- .../2024/01/GHSA-r8xp-52mq-rmm8/GHSA-r8xp-52mq-rmm8.json | 4 ++-- .../2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json | 4 ++-- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/advisories/github-reviewed/2024/01/GHSA-3vvc-v8c2-43r7/GHSA-3vvc-v8c2-43r7.json b/advisories/github-reviewed/2024/01/GHSA-3vvc-v8c2-43r7/GHSA-3vvc-v8c2-43r7.json index 484a38020a4..24771825f35 100644 --- a/advisories/github-reviewed/2024/01/GHSA-3vvc-v8c2-43r7/GHSA-3vvc-v8c2-43r7.json +++ b/advisories/github-reviewed/2024/01/GHSA-3vvc-v8c2-43r7/GHSA-3vvc-v8c2-43r7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3vvc-v8c2-43r7", - "modified": "2024-02-02T15:59:47Z", + "modified": "2025-02-13T19:33:17Z", "published": "2024-01-29T15:30:25Z", "aliases": [ "CVE-2023-29055" diff --git a/advisories/github-reviewed/2024/01/GHSA-9xc9-xq7w-vpcr/GHSA-9xc9-xq7w-vpcr.json b/advisories/github-reviewed/2024/01/GHSA-9xc9-xq7w-vpcr/GHSA-9xc9-xq7w-vpcr.json index 63ac3aa7ce3..afe156e0757 100644 --- a/advisories/github-reviewed/2024/01/GHSA-9xc9-xq7w-vpcr/GHSA-9xc9-xq7w-vpcr.json +++ b/advisories/github-reviewed/2024/01/GHSA-9xc9-xq7w-vpcr/GHSA-9xc9-xq7w-vpcr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-9xc9-xq7w-vpcr", - "modified": "2024-07-08T20:08:14Z", + "modified": "2025-02-13T19:32:39Z", "published": "2024-01-31T09:30:18Z", "aliases": [ "CVE-2023-44313" ], "summary": "Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability", - "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially crafted requests.This issue affects Apache ServiceComb before 2.1.0 (included). Users are recommended to upgrade to version 2.2.0, which fixes the issue.\n\n", + "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially crafted requests.This issue affects Apache ServiceComb before 2.1.0 (included). Users are recommended to upgrade to version 2.2.0, which fixes the issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json b/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json index cf9f8f030bc..3a86a00ad0e 100644 --- a/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json +++ b/advisories/github-reviewed/2024/01/GHSA-c3c6-f2ww-xfr2/GHSA-c3c6-f2ww-xfr2.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-c3c6-f2ww-xfr2", - "modified": "2024-09-12T19:15:10Z", + "modified": "2025-02-13T19:33:15Z", "published": "2024-01-24T15:30:30Z", "aliases": [ "CVE-2023-50943" ], "summary": "Apache Airflow: pickle deserialization vulnerability in XComs", - "details": "Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of \"enable_xcom_pickling=False\" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.\n", + "details": "Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of \"enable_xcom_pickling=False\" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/01/GHSA-f4qf-m5gf-8jm8/GHSA-f4qf-m5gf-8jm8.json b/advisories/github-reviewed/2024/01/GHSA-f4qf-m5gf-8jm8/GHSA-f4qf-m5gf-8jm8.json index 7a825030b17..cfdb5e7dd86 100644 --- a/advisories/github-reviewed/2024/01/GHSA-f4qf-m5gf-8jm8/GHSA-f4qf-m5gf-8jm8.json +++ b/advisories/github-reviewed/2024/01/GHSA-f4qf-m5gf-8jm8/GHSA-f4qf-m5gf-8jm8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-f4qf-m5gf-8jm8", - "modified": "2024-04-23T21:54:44Z", + "modified": "2025-02-13T19:33:09Z", "published": "2024-01-19T12:30:18Z", "aliases": [ "CVE-2024-21733" ], "summary": "Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information", - "details": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.\n\n", + "details": "Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.\n\nUsers are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/01/GHSA-r4q3-7g4q-x89m/GHSA-r4q3-7g4q-x89m.json b/advisories/github-reviewed/2024/01/GHSA-r4q3-7g4q-x89m/GHSA-r4q3-7g4q-x89m.json index f169da1b6bc..ac5c2a72442 100644 --- a/advisories/github-reviewed/2024/01/GHSA-r4q3-7g4q-x89m/GHSA-r4q3-7g4q-x89m.json +++ b/advisories/github-reviewed/2024/01/GHSA-r4q3-7g4q-x89m/GHSA-r4q3-7g4q-x89m.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-r4q3-7g4q-x89m", - "modified": "2024-06-17T17:18:05Z", + "modified": "2025-02-13T19:33:11Z", "published": "2024-01-22T15:30:23Z", "aliases": [ "CVE-2024-22233" ], "summary": "Spring Framework server Web DoS Vulnerability", - "details": "In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n * the application uses Spring MVC\n * Spring Security 6.1.6+ or 6.2.1+ is on the classpath\n\n\nTypically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.\n\n\n", + "details": "In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\n * the application uses Spring MVC\n * Spring Security 6.1.6+ or 6.2.1+ is on the classpath\n\n\nTypically, Spring Boot applications need the org.springframework.boot:spring-boot-starter-web and org.springframework.boot:spring-boot-starter-security dependencies to meet all conditions.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/01/GHSA-r8xp-52mq-rmm8/GHSA-r8xp-52mq-rmm8.json b/advisories/github-reviewed/2024/01/GHSA-r8xp-52mq-rmm8/GHSA-r8xp-52mq-rmm8.json index 094a0519ba2..b395963b419 100644 --- a/advisories/github-reviewed/2024/01/GHSA-r8xp-52mq-rmm8/GHSA-r8xp-52mq-rmm8.json +++ b/advisories/github-reviewed/2024/01/GHSA-r8xp-52mq-rmm8/GHSA-r8xp-52mq-rmm8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-r8xp-52mq-rmm8", - "modified": "2024-07-08T20:10:09Z", + "modified": "2025-02-13T19:32:35Z", "published": "2024-01-31T09:30:18Z", "aliases": [ "CVE-2023-44312" ], "summary": "Apache ServiceComb Service-Center Exposure of Sensitive Information to an Unauthorized Actor vulnerability", - "details": "Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center. This issue affects Apache ServiceComb Service-Center before 2.1.0 (included). Users are recommended to upgrade to version 2.2.0, which fixes the issue.\n\n", + "details": "Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center. This issue affects Apache ServiceComb Service-Center before 2.1.0 (included). Users are recommended to upgrade to version 2.2.0, which fixes the issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json b/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json index 2a355adc067..ea9b3f11108 100644 --- a/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json +++ b/advisories/github-reviewed/2024/01/GHSA-vm5m-qmrx-fw8w/GHSA-vm5m-qmrx-fw8w.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-vm5m-qmrx-fw8w", - "modified": "2024-11-18T16:26:35Z", + "modified": "2025-02-13T19:33:14Z", "published": "2024-01-24T15:30:30Z", "aliases": [ "CVE-2023-50944" ], "summary": "Apache Airflow: Bypass permission verification to read code of other dags", - "details": "Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.\n", + "details": "Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.", "severity": [ { "type": "CVSS_V3",