diff --git a/advisories/github-reviewed/2023/06/GHSA-66gv-5m8q-rrjc/GHSA-66gv-5m8q-rrjc.json b/advisories/github-reviewed/2023/06/GHSA-66gv-5m8q-rrjc/GHSA-66gv-5m8q-rrjc.json index ca187dbe408..ff1f2f1b328 100644 --- a/advisories/github-reviewed/2023/06/GHSA-66gv-5m8q-rrjc/GHSA-66gv-5m8q-rrjc.json +++ b/advisories/github-reviewed/2023/06/GHSA-66gv-5m8q-rrjc/GHSA-66gv-5m8q-rrjc.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-66gv-5m8q-rrjc", - "modified": "2023-06-27T20:18:52Z", + "modified": "2025-01-06T22:14:24Z", "published": "2023-06-14T15:30:38Z", "aliases": [ "CVE-2023-34614" ], "summary": "jsonij vulnerable to stack exhaustion", - "details": "An issue was discovered jmarsden/jsonij through 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.", + "details": "An issue was discovered jmarsden/jsonij through 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/06/GHSA-jv4x-j47q-6qvp/GHSA-jv4x-j47q-6qvp.json b/advisories/github-reviewed/2023/06/GHSA-jv4x-j47q-6qvp/GHSA-jv4x-j47q-6qvp.json index 61f16bafe82..e39c7b9282c 100644 --- a/advisories/github-reviewed/2023/06/GHSA-jv4x-j47q-6qvp/GHSA-jv4x-j47q-6qvp.json +++ b/advisories/github-reviewed/2023/06/GHSA-jv4x-j47q-6qvp/GHSA-jv4x-j47q-6qvp.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-jv4x-j47q-6qvp", - "modified": "2024-06-14T20:13:51Z", + "modified": "2025-01-06T22:14:46Z", "published": "2023-06-14T15:30:38Z", "aliases": [ "CVE-2023-34624" ], "summary": "htmlcleaner vulnerable to stack exhaustion", - "details": "An issue was discovered htmlcleaner through version 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.", + "details": "An issue was discovered htmlcleaner through version 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2025/01/GHSA-237r-r8m4-4q88/GHSA-237r-r8m4-4q88.json b/advisories/github-reviewed/2025/01/GHSA-237r-r8m4-4q88/GHSA-237r-r8m4-4q88.json index 20c0a545377..5cd8d89ae59 100644 --- a/advisories/github-reviewed/2025/01/GHSA-237r-r8m4-4q88/GHSA-237r-r8m4-4q88.json +++ b/advisories/github-reviewed/2025/01/GHSA-237r-r8m4-4q88/GHSA-237r-r8m4-4q88.json @@ -1,14 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-237r-r8m4-4q88", - "modified": "2025-01-06T19:23:26Z", + "modified": "2025-01-06T22:15:06Z", "published": "2025-01-06T19:23:26Z", "aliases": [ "CVE-2025-21617" ], "summary": "Guzzle OAuth Subscriber has insufficient nonce entropy", "details": "### Impact\n\nNonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source (https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192). This can leave servers vulnerable to replay attacks when TLS is not used.\n\n### Patches\n\nUpgrade to version 0.8.1 or higher.\n\n### Workarounds\n\nNo.\n\n### References\n\nIssue is similar to https://nvd.nist.gov/vuln/detail/CVE-2025-22376.\n", - "severity": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], "affected": [ { "package": { @@ -35,6 +40,10 @@ "type": "WEB", "url": "https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21617" + }, { "type": "WEB", "url": "https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53" @@ -56,9 +65,9 @@ "cwe_ids": [ "CWE-338" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-06T19:23:26Z", - "nvd_published_at": null + "nvd_published_at": "2025-01-06T20:15:39Z" } } \ No newline at end of file