From a2a49140bda36fdcb116968feb9fe08b16a006fc Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 2 May 2025 19:33:00 +0000
Subject: [PATCH] Publish Advisories

GHSA-f9ch-h8j7-8jwg
GHSA-gcqf-f89c-68hv
---
 .../GHSA-f9ch-h8j7-8jwg.json                  | 33 ++++++++++++++++---
 .../GHSA-gcqf-f89c-68hv.json                  | 33 ++++++++++++++++---
 2 files changed, 58 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json (61%)
 rename advisories/{unreviewed => github-reviewed}/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json (62%)

diff --git a/advisories/unreviewed/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json b/advisories/github-reviewed/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json
similarity index 61%
rename from advisories/unreviewed/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json
rename to advisories/github-reviewed/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json
index 20a09a03c5a..1d354e68abb 100644
--- a/advisories/unreviewed/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json
+++ b/advisories/github-reviewed/2025/05/GHSA-f9ch-h8j7-8jwg/GHSA-f9ch-h8j7-8jwg.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f9ch-h8j7-8jwg",
-  "modified": "2025-05-02T18:31:38Z",
+  "modified": "2025-05-02T19:32:38Z",
   "published": "2025-05-02T18:31:38Z",
   "aliases": [
     "CVE-2025-3879"
   ],
+  "summary": "Hashicorp Vault Community vulnerable to Incorrect Authorization",
   "details": "Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.10.0"
+            },
+            {
+              "fixed": "1.19.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -22,6 +43,10 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/hashicorp/vault"
     }
   ],
   "database_specific": {
@@ -29,8 +54,8 @@
       "CWE-863"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-02T19:32:37Z",
     "nvd_published_at": "2025-05-02T17:15:51Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json b/advisories/github-reviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json
similarity index 62%
rename from advisories/unreviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json
rename to advisories/github-reviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json
index cb471d4ae4d..b4026de17aa 100644
--- a/advisories/unreviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json
+++ b/advisories/github-reviewed/2025/05/GHSA-gcqf-f89c-68hv/GHSA-gcqf-f89c-68hv.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gcqf-f89c-68hv",
-  "modified": "2025-05-02T15:31:49Z",
+  "modified": "2025-05-02T19:31:47Z",
   "published": "2025-05-02T15:31:49Z",
   "aliases": [
     "CVE-2025-4166"
   ],
+  "summary": "Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information",
   "details": "Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20.",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.3.0"
+            },
+            {
+              "fixed": "1.19.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -22,6 +43,10 @@
     {
       "type": "WEB",
       "url": "https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/hashicorp/vault"
     }
   ],
   "database_specific": {
@@ -29,8 +54,8 @@
       "CWE-209"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-02T19:31:47Z",
     "nvd_published_at": "2025-05-02T15:15:50Z"
   }
 }
\ No newline at end of file