diff --git a/advisories/github-reviewed/2020/08/GHSA-7wgr-7666-7pwj/GHSA-7wgr-7666-7pwj.json b/advisories/github-reviewed/2020/08/GHSA-7wgr-7666-7pwj/GHSA-7wgr-7666-7pwj.json index 8c7899cd018..455bea6ea9a 100644 --- a/advisories/github-reviewed/2020/08/GHSA-7wgr-7666-7pwj/GHSA-7wgr-7666-7pwj.json +++ b/advisories/github-reviewed/2020/08/GHSA-7wgr-7666-7pwj/GHSA-7wgr-7666-7pwj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7wgr-7666-7pwj", - "modified": "2021-01-07T23:41:29Z", + "modified": "2024-10-07T16:46:45Z", "published": "2020-08-20T14:38:13Z", "aliases": [ "CVE-2020-15141" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N" } ], "affected": [ @@ -48,6 +52,14 @@ "type": "WEB", "url": "https://github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746" }, + { + "type": "PACKAGE", + "url": "https://github.com/openapi-generators/openapi-python-client" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-70.yaml" + }, { "type": "WEB", "url": "https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13" diff --git a/advisories/github-reviewed/2020/08/GHSA-9x4c-63pf-525f/GHSA-9x4c-63pf-525f.json b/advisories/github-reviewed/2020/08/GHSA-9x4c-63pf-525f/GHSA-9x4c-63pf-525f.json index 990a038321c..6246bd5b693 100644 --- a/advisories/github-reviewed/2020/08/GHSA-9x4c-63pf-525f/GHSA-9x4c-63pf-525f.json +++ b/advisories/github-reviewed/2020/08/GHSA-9x4c-63pf-525f/GHSA-9x4c-63pf-525f.json @@ -1,17 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-9x4c-63pf-525f", - "modified": "2022-06-01T21:58:48Z", + "modified": "2024-10-07T16:47:52Z", "published": "2020-08-20T14:38:24Z", "aliases": [ "CVE-2020-15142" ], - "summary": "Arbitrary Code Generation", + "summary": "openapi-python-client Arbitrary Code Generation vulnerability", "details": "### Impact\nClients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.\n\nGiving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .\n\n### Patches\nFix will be included in version 0.5.3\n\n### Workarounds\nInspect OpenAPI documents before generating, or inspect generated code before executing.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)\n* Email us at [danthony@triaxtec.com](mailto:danthony@triaxtec.com)", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" } ], "affected": [ @@ -60,6 +64,10 @@ "type": "WEB", "url": "https://github.com/openapi-generators/openapi-python-client/releases/tag/v.0.5.3" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/openapi-python-client/PYSEC-2020-71.yaml" + }, { "type": "WEB", "url": "https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13" diff --git a/advisories/github-reviewed/2023/10/GHSA-fwfg-vprh-97ph/GHSA-fwfg-vprh-97ph.json b/advisories/github-reviewed/2023/10/GHSA-fwfg-vprh-97ph/GHSA-fwfg-vprh-97ph.json index 0547ff404dd..116cab578bf 100644 --- a/advisories/github-reviewed/2023/10/GHSA-fwfg-vprh-97ph/GHSA-fwfg-vprh-97ph.json +++ b/advisories/github-reviewed/2023/10/GHSA-fwfg-vprh-97ph/GHSA-fwfg-vprh-97ph.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fwfg-vprh-97ph", - "modified": "2023-10-13T21:49:52Z", + "modified": "2024-10-07T16:46:03Z", "published": "2023-10-10T21:21:12Z", "aliases": [ "CVE-2023-41047" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -65,7 +69,7 @@ "cwe_ids": [ "CWE-1336" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-10-10T21:21:12Z", "nvd_published_at": "2023-10-09T16:15:10Z"