Publish Advisories

GHSA-2v6x-frw8-7r7f GHSA-j6c3-3c4w-qv8p GHSA-wp3g-pr4h-q6vv GHSA-x3x8-fjw6-hccx GHSA-j6c3-3c4w-qv8p GHSA-wp3g-pr4h-q6vv GHSA-x3x8-fjw6-hccx
2026-05-22 18:04:22 -07:00 · 2024-01-23 17:51:51 +00:00
parent b914ee92fe
commit a33d2226e0
7 changed files with 451 additions and 164 deletions
@@ -1,13 +1,14 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2v6x-frw8-7r7f",
-  "modified": "2021-05-17T21:04:15Z",
+  "modified": "2024-01-23T17:50:31Z",
  "published": "2021-05-18T15:38:54Z",
+  "withdrawn": "2024-01-23T17:50:31Z",
  "aliases": [
    "CVE-2019-17110"
  ],
-  "summary": "Exposure of Sensitive Information to an Unauthorized Actor in kube-state-metrics",
-  "details": "A security issue was discovered in kube-state-metrics 1.7.x before 1.7.2. An experimental feature was added to v1.7.0 and v1.7.1 that enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.",
+  "summary": "Duplicate Advisory: k8s.io/kube-state-metrics Exposure of Sensitive Information",
+  "details": "# Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-c92w-72c5-9x59. This link is maintained to preserve external references.\n\n# Original Description\n\nA security issue was discovered in kube-state-metrics 1.7.x before 1.7.2. An experimental feature was added to v1.7.0 and v1.7.1 that enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -33,6 +34,25 @@
          ]
        }
      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "k8s.io/kube-state-metrics"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.7.0"
+            },
+            {
+              "fixed": "1.7.2"
+            }
+          ]
+        }
+      ]
    }
  ],
  "references": [
@@ -48,6 +68,10 @@
      "type": "WEB",
      "url": "https://github.com/kubernetes/kube-state-metrics/commit/2a9ab3a9a0f1c4dbecb6a5577185b33bfac86a96"
    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/kubernetes/kube-state-metrics"
+    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2"
@@ -0,0 +1,128 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j6c3-3c4w-qv8p",
+  "modified": "2024-01-23T17:51:27Z",
+  "published": "2022-05-13T01:12:49Z",
+  "aliases": [
+    "CVE-2013-7341"
+  ],
+  "summary": "Moodle cross-site scripting (XSS) vulnerabilities",
+  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.4.9"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.5.0"
+            },
+            {
+              "fixed": "2.5.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.6.0"
+            },
+            {
+              "fixed": "2.6.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7341"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/flowplayer/flash/issues/121"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/98d135fea3006334093efa822205d4b2c3fd8ff9"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/9f2967e301d123d11625f3b6948e1ee538086791"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/c3cd5e1db9de4f1a634492d99990534e30518066"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/d65634044ebaa738f55bdec521beb42844d6916a"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/moodle/moodle"
+    },
+    {
+      "type": "WEB",
+      "url": "https://moodle.org/mod/forum/discuss.php?d=256420"
+    },
+    {
+      "type": "WEB",
+      "url": "http://flash.flowplayer.org/documentation/version-history.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344"
+    },
+    {
+      "type": "WEB",
+      "url": "http://openwall.com/lists/oss-security/2014/03/17/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-23T17:51:27Z",
+    "nvd_published_at": "2014-03-24T14:20:00Z"
+  }
+}
@@ -0,0 +1,140 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wp3g-pr4h-q6vv",
+  "modified": "2024-01-23T17:51:12Z",
+  "published": "2022-05-13T01:12:59Z",
+  "aliases": [
+    "CVE-2013-2082"
+  ],
+  "summary": "Moodle does not enforce capability requirements for reading blog comments",
+  "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.2.10"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "2.3.7"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.4.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2082"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/28772fb9e7e6be01b765fb721af16901bb47e417"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/5fde58a59335bc3109a9eaac4a15d1e9217541c3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/8aa12adcf26ff2f0b61cd6f0288f2886c8c55bf7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/9a909b1a359f72b8d384e18da8e05474604279e1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/cb538f0e539e833edb7cf6fa3d705e8abc5003fd"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/f9e27e8323f31186820d25252ec0d4c6cd65dafc"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/moodle/moodle"
+    },
+    {
+      "type": "WEB",
+      "url": "https://moodle.org/mod/forum/discuss.php?d=228934"
+    },
+    {
+      "type": "WEB",
+      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37245"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://openwall.com/lists/oss-security/2013/05/21/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-23T17:51:12Z",
+    "nvd_published_at": "2013-05-25T03:18:00Z"
+  }
+}
@@ -0,0 +1,156 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x3x8-fjw6-hccx",
+  "modified": "2024-01-23T17:50:52Z",
+  "published": "2022-05-13T01:12:59Z",
+  "aliases": [
+    "CVE-2013-2081"
+  ],
+  "summary": "Moodle does not consider \"don't send\" attributes during hub registration",
+  "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.2.10"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "2.3.7"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.4.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2081"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/1d79b726d762bcc629c1a2a74cfa3eca5a7c5da7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/1fc34e37fdc57b4ec303cb942dc5d5535b953ed7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/4d65904bc132548a2ef4c2a40bf5ba2cffb5f68f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/54a3ce69e9ca751fffd0b3e0eb5be4add50de113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/60c468bcb3b6f867a70f2f30427b52e0362e93d1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/667eaec4d2679a8bc1fcd9f0ff17a1be2babccb0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/669dee58048b18d9034a7b2367b97a50b498b0e0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/a811e8ac56e49a174b68ceade81197c80be4b325"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/be6281e2cbc2fb40b96a48c07c80883fa80cd1b7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/moodle/moodle/commit/fd469033fa2c860647e48f3d543346503a37faa0"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/moodle/moodle"
+    },
+    {
+      "type": "WEB",
+      "url": "https://moodle.org/mod/forum/discuss.php?d=228933"
+    },
+    {
+      "type": "WEB",
+      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://openwall.com/lists/oss-security/2013/05/21/1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-284"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-23T17:50:52Z",
+    "nvd_published_at": "2013-05-25T03:18:00Z"
+  }
+}
@@ -1,51 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-j6c3-3c4w-qv8p",
-  "modified": "2022-05-13T01:12:49Z",
-  "published": "2022-05-13T01:12:49Z",
-  "aliases": [
-    "CVE-2013-7341"
-  ],
-  "details": "Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7341"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/flowplayer/flash/issues/121"
-    },
-    {
-      "type": "WEB",
-      "url": "https://moodle.org/mod/forum/discuss.php?d=256420"
-    },
-    {
-      "type": "WEB",
-      "url": "http://flash.flowplayer.org/documentation/version-history.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344"
-    },
-    {
-      "type": "WEB",
-      "url": "http://openwall.com/lists/oss-security/2014/03/17/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-79"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2014-03-24T14:20:00Z"
-  }
-}
@@ -1,55 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-wp3g-pr4h-q6vv",
-  "modified": "2022-05-13T01:12:59Z",
-  "published": "2022-05-13T01:12:59Z",
-  "aliases": [
-    "CVE-2013-2082"
-  ],
-  "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2082"
-    },
-    {
-      "type": "WEB",
-      "url": "https://moodle.org/mod/forum/discuss.php?d=228934"
-    },
-    {
-      "type": "WEB",
-      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37245"
-    },
-    {
-      "type": "WEB",
-      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://openwall.com/lists/oss-security/2013/05/21/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2013-05-25T03:18:00Z"
-  }
-}
@@ -1,55 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-x3x8-fjw6-hccx",
-  "modified": "2022-05-13T01:12:59Z",
-  "published": "2022-05-13T01:12:59Z",
-  "aliases": [
-    "CVE-2013-2081"
-  ],
-  "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2081"
-    },
-    {
-      "type": "WEB",
-      "url": "https://moodle.org/mod/forum/discuss.php?d=228933"
-    },
-    {
-      "type": "WEB",
-      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822"
-    },
-    {
-      "type": "WEB",
-      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://openwall.com/lists/oss-security/2013/05/21/1"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2013-05-25T03:18:00Z"
-  }
-}