From a8356cf7475cb3ecd52c03b7d163778d4ca77f56 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sun, 17 Nov 2024 12:31:57 +0000 Subject: [PATCH] Publish Advisories GHSA-2ppf-2m6f-6v6f GHSA-3jrv-jgp8-45v3 GHSA-h7wq-jj8r-qm7p GHSA-hvw5-3mgw-7rcf GHSA-r7p2-7qw3-phxg --- .../GHSA-2ppf-2m6f-6v6f.json | 58 +++++++++++++++ .../GHSA-3jrv-jgp8-45v3.json | 70 +++++++++++++++++++ .../GHSA-h7wq-jj8r-qm7p.json | 54 ++++++++++++++ .../GHSA-hvw5-3mgw-7rcf.json | 42 +++++++++++ .../GHSA-r7p2-7qw3-phxg.json | 42 +++++++++++ 5 files changed, 266 insertions(+) create mode 100644 advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json create mode 100644 advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json create mode 100644 advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json create mode 100644 advisories/unreviewed/2024/11/GHSA-r7p2-7qw3-phxg/GHSA-r7p2-7qw3-phxg.json diff --git a/advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json b/advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json new file mode 100644 index 00000000000..9efec6c6a84 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2ppf-2m6f-6v6f/GHSA-2ppf-2m6f-6v6f.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2ppf-2m6f-6v6f", + "modified": "2024-11-17T12:30:29Z", + "published": "2024-11-17T12:30:29Z", + "aliases": [ + "CVE-2023-6110" + ], + "details": "A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6110" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:2737" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:2769" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-6110" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2212960" + }, + { + "type": "WEB", + "url": "https://code.engineering.redhat.com/gerrit/gitweb?p=python-openstackclient.git;a=commit;h=7a7c364bdd7b2cd2b56e73724110710a68d58abf" + }, + { + "type": "WEB", + "url": "https://review.opendev.org/c/openstack/python-openstackclient/+/888697" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-17T11:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json b/advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json new file mode 100644 index 00000000000..c155fd75215 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3jrv-jgp8-45v3/GHSA-3jrv-jgp8-45v3.json @@ -0,0 +1,70 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3jrv-jgp8-45v3", + "modified": "2024-11-17T12:30:29Z", + "published": "2024-11-17T12:30:29Z", + "aliases": [ + "CVE-2023-4639" + ], + "details": "A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4639" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1674" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1675" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1676" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1677" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:2763" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:2764" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:3919" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-4639" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166022" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-444" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-17T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json b/advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json new file mode 100644 index 00000000000..84901a90b97 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-h7wq-jj8r-qm7p/GHSA-h7wq-jj8r-qm7p.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7wq-jj8r-qm7p", + "modified": "2024-11-17T12:30:30Z", + "published": "2024-11-17T12:30:29Z", + "aliases": [ + "CVE-2024-0793" + ], + "details": "A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0793" + }, + { + "type": "WEB", + "url": "https://github.com/openshift/kubernetes/pull/1876" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:0741" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1267" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-0793" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2214402" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-17T11:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json b/advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json new file mode 100644 index 00000000000..f684705adde --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hvw5-3mgw-7rcf/GHSA-hvw5-3mgw-7rcf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hvw5-3mgw-7rcf", + "modified": "2024-11-17T12:30:29Z", + "published": "2024-11-17T12:30:29Z", + "aliases": [ + "CVE-2023-1419" + ], + "details": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1419" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-1419" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2178722" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-233" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-17T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r7p2-7qw3-phxg/GHSA-r7p2-7qw3-phxg.json b/advisories/unreviewed/2024/11/GHSA-r7p2-7qw3-phxg/GHSA-r7p2-7qw3-phxg.json new file mode 100644 index 00000000000..d7cbfbc6448 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r7p2-7qw3-phxg/GHSA-r7p2-7qw3-phxg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r7p2-7qw3-phxg", + "modified": "2024-11-17T12:30:29Z", + "published": "2024-11-17T12:30:29Z", + "aliases": [ + "CVE-2020-25720" + ], + "details": "A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25720" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2020-25720" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305954" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-17T11:15:04Z" + } +} \ No newline at end of file