Publish Advisories

GHSA-7wgr-7666-7pwj
GHSA-9x4c-63pf-525f
GHSA-fwfg-vprh-97ph

advisories/github-reviewed/2020/08/GHSA-7wgr-7666-7pwj/GHSA-7wgr-7666-7pwj.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7wgr-7666-7pwj",
-  "modified": "2021-01-07T23:41:29Z",
+  "modified": "2024-10-07T16:46:45Z",
   "published": "2020-08-20T14:38:13Z",
   "aliases": [
     "CVE-2020-15141"
@@ -12,6 +12,10 @@
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
     }
   ],
   "affected": [
@@ -48,6 +52,14 @@
       "type": "WEB",
       "url": "https://github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/openapi-generators/openapi-python-client"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-70.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13"

advisories/github-reviewed/2020/08/GHSA-9x4c-63pf-525f/GHSA-9x4c-63pf-525f.json

@@ -1,17 +1,21 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9x4c-63pf-525f",
-  "modified": "2022-06-01T21:58:48Z",
+  "modified": "2024-10-07T16:47:52Z",
   "published": "2020-08-20T14:38:24Z",
   "aliases": [
     "CVE-2020-15142"
   ],
-  "summary": "Arbitrary Code Generation",
+  "summary": "openapi-python-client Arbitrary Code Generation vulnerability",
   "details": "### Impact\nClients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.\n\nGiving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .\n\n### Patches\nFix will be included in version 0.5.3\n\n### Workarounds\nInspect OpenAPI documents before generating, or inspect generated code before executing.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)\n* Email us at [danthony@triaxtec.com](mailto:danthony@triaxtec.com)",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
     }
   ],
   "affected": [
@@ -60,6 +64,10 @@
       "type": "WEB",
       "url": "https://github.com/openapi-generators/openapi-python-client/releases/tag/v.0.5.3"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-71.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13"

advisories/github-reviewed/2023/10/GHSA-fwfg-vprh-97ph/GHSA-fwfg-vprh-97ph.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fwfg-vprh-97ph",
-  "modified": "2023-10-13T21:49:52Z",
+  "modified": "2024-10-07T16:46:03Z",
   "published": "2023-10-10T21:21:12Z",
   "aliases": [
     "CVE-2023-41047"
@@ -12,6 +12,10 @@
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
@@ -65,7 +69,7 @@
     "cwe_ids": [
       "CWE-1336"
     ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2023-10-10T21:21:12Z",
     "nvd_published_at": "2023-10-09T16:15:10Z"