From a64f46a9111cd6ad02d2480561aed27a1deef6e7 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 24 Oct 2024 21:47:48 +0000 Subject: [PATCH] Publish Advisories GHSA-32x6-qvw6-mxj4 GHSA-6748-36qp-fx6r GHSA-3jm4-c6qf-jrh3 GHSA-3p8v-w8mr-m3x8 GHSA-79jv-5226-783f GHSA-g8v9-c8m3-942v GHSA-j8hp-f2mj-586g GHSA-pw3x-c5vp-mfc3 --- .../GHSA-32x6-qvw6-mxj4.json | 15 ++++++-- .../GHSA-6748-36qp-fx6r.json | 17 +++++++-- .../GHSA-3jm4-c6qf-jrh3.json | 8 +++-- .../GHSA-3p8v-w8mr-m3x8.json | 8 +++-- .../GHSA-79jv-5226-783f.json | 8 +++-- .../GHSA-g8v9-c8m3-942v.json | 35 +++++++++++++++---- .../GHSA-j8hp-f2mj-586g.json | 12 +++++-- .../GHSA-pw3x-c5vp-mfc3.json | 8 +++-- 8 files changed, 90 insertions(+), 21 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json (56%) diff --git a/advisories/github-reviewed/2022/03/GHSA-32x6-qvw6-mxj4/GHSA-32x6-qvw6-mxj4.json b/advisories/github-reviewed/2022/03/GHSA-32x6-qvw6-mxj4/GHSA-32x6-qvw6-mxj4.json index 299a42dd9cf..292e5735491 100644 --- a/advisories/github-reviewed/2022/03/GHSA-32x6-qvw6-mxj4/GHSA-32x6-qvw6-mxj4.json +++ b/advisories/github-reviewed/2022/03/GHSA-32x6-qvw6-mxj4/GHSA-32x6-qvw6-mxj4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-32x6-qvw6-mxj4", - "modified": "2022-03-15T18:05:24Z", + "modified": "2024-10-24T21:46:17Z", "published": "2022-03-01T22:14:57Z", "aliases": [ "CVE-2022-24719" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ @@ -37,7 +41,7 @@ { "package": { "ecosystem": "PyPI", - "name": "request-util" + "name": "pyquest" }, "ranges": [ { @@ -45,6 +49,9 @@ "events": [ { "introduced": "0" + }, + { + "last_affected": "0.0.1" } ] } @@ -76,6 +83,10 @@ "type": "PACKAGE", "url": "https://github.com/fluture-js/fluture-node" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyquest/PYSEC-2022-43051.yaml" + }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/request-util/PYSEC-2022-43052.yaml" diff --git a/advisories/github-reviewed/2022/05/GHSA-6748-36qp-fx6r/GHSA-6748-36qp-fx6r.json b/advisories/github-reviewed/2022/05/GHSA-6748-36qp-fx6r/GHSA-6748-36qp-fx6r.json index a00f07c3e6f..5dccbc07db3 100644 --- a/advisories/github-reviewed/2022/05/GHSA-6748-36qp-fx6r/GHSA-6748-36qp-fx6r.json +++ b/advisories/github-reviewed/2022/05/GHSA-6748-36qp-fx6r/GHSA-6748-36qp-fx6r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6748-36qp-fx6r", - "modified": "2024-02-23T20:57:09Z", + "modified": "2024-10-24T21:47:16Z", "published": "2022-05-17T04:56:46Z", "aliases": [ "CVE-2013-4314" @@ -9,7 +9,14 @@ "summary": "PyOpenSSL Mishandles NUL Byte In Certificate Subject Alternative Name", "details": "The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a `\\0` character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -49,6 +56,10 @@ "type": "PACKAGE", "url": "https://github.com/pyca/pyopenssl" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyopenssl/PYSEC-2013-31.yaml" + }, { "type": "WEB", "url": "https://mail.python.org/pipermail/pyopenssl-users/2013-September/000478.html" @@ -74,7 +85,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-02-23T20:57:09Z", "nvd_published_at": "2013-09-30T21:55:00Z" diff --git a/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json b/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json index bf4e9dfd2ae..d134dadf6a9 100644 --- a/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json +++ b/advisories/github-reviewed/2024/10/GHSA-3jm4-c6qf-jrh3/GHSA-3jm4-c6qf-jrh3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3jm4-c6qf-jrh3", - "modified": "2024-10-24T17:58:53Z", + "modified": "2024-10-24T21:46:00Z", "published": "2024-10-24T17:58:53Z", "aliases": [ "CVE-2024-47879" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-3jm4-c6qf-jrh3" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47879" + }, { "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/commit/090924ca923489b6c94397cf1f5df7f7f78f0126" @@ -57,6 +61,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-10-24T17:58:53Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-24T21:15:12Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-3p8v-w8mr-m3x8/GHSA-3p8v-w8mr-m3x8.json b/advisories/github-reviewed/2024/10/GHSA-3p8v-w8mr-m3x8/GHSA-3p8v-w8mr-m3x8.json index 7413d12a6ce..c024aaef55e 100644 --- a/advisories/github-reviewed/2024/10/GHSA-3p8v-w8mr-m3x8/GHSA-3p8v-w8mr-m3x8.json +++ b/advisories/github-reviewed/2024/10/GHSA-3p8v-w8mr-m3x8/GHSA-3p8v-w8mr-m3x8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3p8v-w8mr-m3x8", - "modified": "2024-10-24T18:16:44Z", + "modified": "2024-10-24T21:46:18Z", "published": "2024-10-24T18:16:43Z", "aliases": [ "CVE-2024-47883" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/OpenRefine/simile-butterfly/security/advisories/GHSA-3p8v-w8mr-m3x8" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47883" + }, { "type": "WEB", "url": "https://github.com/OpenRefine/simile-butterfly/commit/537f64bfa72746f8b21d4bda461fad843435319c" @@ -57,6 +61,6 @@ "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-10-24T18:16:43Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-24T21:15:13Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-79jv-5226-783f/GHSA-79jv-5226-783f.json b/advisories/github-reviewed/2024/10/GHSA-79jv-5226-783f/GHSA-79jv-5226-783f.json index f94dd3c628f..95bf893f58f 100644 --- a/advisories/github-reviewed/2024/10/GHSA-79jv-5226-783f/GHSA-79jv-5226-783f.json +++ b/advisories/github-reviewed/2024/10/GHSA-79jv-5226-783f/GHSA-79jv-5226-783f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-79jv-5226-783f", - "modified": "2024-10-24T18:00:06Z", + "modified": "2024-10-24T21:46:02Z", "published": "2024-10-24T18:00:06Z", "aliases": [ "CVE-2024-47880" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-79jv-5226-783f" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47880" + }, { "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/commit/8060477fa53842ebabf43b63e039745932fa629d" @@ -57,6 +61,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-10-24T18:00:06Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-24T21:15:12Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json b/advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json similarity index 56% rename from advisories/unreviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json rename to advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json index 73d8a951d1b..bfa00e8b297 100644 --- a/advisories/unreviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json +++ b/advisories/github-reviewed/2024/10/GHSA-g8v9-c8m3-942v/GHSA-g8v9-c8m3-942v.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-g8v9-c8m3-942v", - "modified": "2024-10-24T18:30:44Z", + "modified": "2024-10-24T21:45:54Z", "published": "2024-10-24T18:30:44Z", "aliases": [ "CVE-2024-48514" ], + "summary": "Remote code execution in php-heic-to-jpg", "details": "php-heic-to-jpg <= 1.0.5 is vulnerable to remote code execution. An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "maestroerror/php-heic-to-jpg" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.5" + } + ] + } + ] + } ], "references": [ { @@ -20,6 +39,10 @@ }, { "type": "WEB", + "url": "https://github.com/MaestroError/php-heic-to-jpg/pull/34" + }, + { + "type": "PACKAGE", "url": "https://github.com/MaestroError/php-heic-to-jpg" }, { @@ -29,11 +52,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-10-24T21:45:54Z", "nvd_published_at": "2024-10-24T18:15:10Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-j8hp-f2mj-586g/GHSA-j8hp-f2mj-586g.json b/advisories/github-reviewed/2024/10/GHSA-j8hp-f2mj-586g/GHSA-j8hp-f2mj-586g.json index 52fa72ac5c2..762f8686fb1 100644 --- a/advisories/github-reviewed/2024/10/GHSA-j8hp-f2mj-586g/GHSA-j8hp-f2mj-586g.json +++ b/advisories/github-reviewed/2024/10/GHSA-j8hp-f2mj-586g/GHSA-j8hp-f2mj-586g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j8hp-f2mj-586g", - "modified": "2024-10-24T18:13:04Z", + "modified": "2024-10-24T21:46:03Z", "published": "2024-10-24T18:13:04Z", "aliases": [ "CVE-2024-47882" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-j8hp-f2mj-586g" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47882" + }, { "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/commit/85594e75e7b36025f7b6a67dcd3ec253c5dff8c2" @@ -47,6 +51,10 @@ { "type": "PACKAGE", "url": "https://github.com/OpenRefine/OpenRefine" + }, + { + "type": "WEB", + "url": "https://github.com/OpenRefine/OpenRefine/blob/master/main/webapp/modules/core/error.vt#L52-L53" } ], "database_specific": { @@ -57,6 +65,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-10-24T18:13:04Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-24T21:15:13Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-pw3x-c5vp-mfc3/GHSA-pw3x-c5vp-mfc3.json b/advisories/github-reviewed/2024/10/GHSA-pw3x-c5vp-mfc3/GHSA-pw3x-c5vp-mfc3.json index 108b655de49..19c05c5361f 100644 --- a/advisories/github-reviewed/2024/10/GHSA-pw3x-c5vp-mfc3/GHSA-pw3x-c5vp-mfc3.json +++ b/advisories/github-reviewed/2024/10/GHSA-pw3x-c5vp-mfc3/GHSA-pw3x-c5vp-mfc3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pw3x-c5vp-mfc3", - "modified": "2024-10-24T17:54:25Z", + "modified": "2024-10-24T21:45:59Z", "published": "2024-10-24T17:54:25Z", "aliases": [ "CVE-2024-47878" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-pw3x-c5vp-mfc3" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47878" + }, { "type": "WEB", "url": "https://github.com/OpenRefine/OpenRefine/commit/10bf0874d67f1018a58b3732332d76b840192fea" @@ -56,6 +60,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-10-24T17:54:25Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-24T21:15:12Z" } } \ No newline at end of file