From a9a7c2fce7092180291742c28b3469930e0f3af8 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 28 Oct 2024 14:41:51 +0000 Subject: [PATCH] Publish Advisories GHSA-7c4h-w765-6pwg GHSA-hfg2-wf6j-x53p GHSA-w455-mfq9-hf74 --- .../GHSA-7c4h-w765-6pwg.json | 10 +++++- .../GHSA-hfg2-wf6j-x53p.json | 21 +++++++---- .../GHSA-w455-mfq9-hf74.json | 35 +++++++++++++++---- 3 files changed, 52 insertions(+), 14 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json (59%) diff --git a/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json b/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json index 2932fd06ff4..db5bb1f9ac1 100644 --- a/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json +++ b/advisories/github-reviewed/2022/05/GHSA-7c4h-w765-6pwg/GHSA-7c4h-w765-6pwg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7c4h-w765-6pwg", - "modified": "2024-02-23T20:56:20Z", + "modified": "2024-10-28T14:41:27Z", "published": "2022-05-14T03:22:02Z", "aliases": [ "CVE-2018-1000167" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -55,6 +59,10 @@ "type": "PACKAGE", "url": "https://github.com/OISF/suricata-update" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/suricata-update/PYSEC-2018-75.yaml" + }, { "type": "WEB", "url": "https://redmine.openinfosecfoundation.org/issues/2359" diff --git a/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json b/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json index f08b1ec2bc0..0190f52c1ff 100644 --- a/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json +++ b/advisories/github-reviewed/2022/05/GHSA-hfg2-wf6j-x53p/GHSA-hfg2-wf6j-x53p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hfg2-wf6j-x53p", - "modified": "2024-04-30T08:33:05Z", + "modified": "2024-10-28T14:40:40Z", "published": "2022-05-14T03:49:27Z", "aliases": [ "CVE-2012-0805" @@ -9,7 +9,14 @@ "summary": "SQLAlchemy vulnerable to SQL injection", "details": "Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -49,6 +56,10 @@ "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73756" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2012-9.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/sqlalchemy/sqlalchemy" @@ -73,10 +84,6 @@ "type": "WEB", "url": "http://www.debian.org/security/2012/dsa-2449" }, - { - "type": "WEB", - "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:059" - }, { "type": "WEB", "url": "http://www.sqlalchemy.org/changelog/CHANGES_0_7_0" @@ -90,7 +97,7 @@ "cwe_ids": [ "CWE-89" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-04-30T08:33:05Z", "nvd_published_at": "2012-06-05T22:55:00Z" diff --git a/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json b/advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json similarity index 59% rename from advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json rename to advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json index 4b8c98a1cc1..2bf60afde4f 100644 --- a/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json +++ b/advisories/github-reviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json @@ -1,20 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-w455-mfq9-hf74", - "modified": "2024-10-26T21:30:46Z", + "modified": "2024-10-28T14:40:03Z", "published": "2024-10-26T21:30:46Z", "aliases": [ "CVE-2020-26303" ], + "summary": "insane vulnerable to Regular Expression Denial of Service", "details": "insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", "severity": [ { "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green" } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "insane" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.6.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/bevacqua/insane/issues/19" }, + { + "type": "PACKAGE", + "url": "https://github.com/bevacqua/insane" + }, { "type": "ADVISORY", "url": "https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane" @@ -34,9 +57,9 @@ "cwe_ids": [ "CWE-1333" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T14:40:03Z", "nvd_published_at": "2024-10-26T21:15:13Z" } } \ No newline at end of file