diff --git a/advisories/github-reviewed/2024/09/GHSA-2rmj-mq67-h97g/GHSA-2rmj-mq67-h97g.json b/advisories/github-reviewed/2024/09/GHSA-2rmj-mq67-h97g/GHSA-2rmj-mq67-h97g.json index 4a1e4a64523..e9c405d0e21 100644 --- a/advisories/github-reviewed/2024/09/GHSA-2rmj-mq67-h97g/GHSA-2rmj-mq67-h97g.json +++ b/advisories/github-reviewed/2024/09/GHSA-2rmj-mq67-h97g/GHSA-2rmj-mq67-h97g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2rmj-mq67-h97g", - "modified": "2024-09-24T18:34:43Z", + "modified": "2024-09-27T19:34:19Z", "published": "2024-09-24T18:34:43Z", "aliases": [ "CVE-2024-38809" @@ -9,6 +9,10 @@ "summary": "Spring Framework DoS via conditional HTTP request", "details": "### Description\nApplications that parse ETags from `If-Match` or `If-None-Match` request headers are vulnerable to DoS attack.\n\n### Affected Spring Products and Versions\norg.springframework:spring-web in versions \n\n6.1.0 through 6.1.11\n6.0.0 through 6.0.22\n5.3.0 through 5.3.37\n\nOlder, unsupported versions are also affected\n\n### Mitigation\nUsers of affected versions should upgrade to the corresponding fixed version.\n6.1.x -> 6.1.12\n6.0.x -> 6.0.23\n5.3.x -> 5.3.38\nNo other mitigation steps are necessary.\n\nUsers of older, unsupported versions could enforce a size limit on `If-Match` and `If-None-Match` headers, e.g. through a Filter.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" @@ -74,6 +78,10 @@ } ], "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38809" + }, { "type": "WEB", "url": "https://github.com/spring-projects/spring-framework/issues/33372" @@ -106,6 +114,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-09-24T18:34:43Z", - "nvd_published_at": null + "nvd_published_at": "2024-09-27T17:15:12Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json b/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json index 3dc14652c69..1b255a97ef0 100644 --- a/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json +++ b/advisories/github-reviewed/2024/09/GHSA-q25c-r482-77p9/GHSA-q25c-r482-77p9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q25c-r482-77p9", - "modified": "2024-09-23T16:35:11Z", + "modified": "2024-09-27T19:33:47Z", "published": "2024-09-17T15:31:23Z", "aliases": [ "CVE-2024-47047" @@ -132,7 +132,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-639" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/09/GHSA-xv68-rrmw-9xwf/GHSA-xv68-rrmw-9xwf.json b/advisories/github-reviewed/2024/09/GHSA-xv68-rrmw-9xwf/GHSA-xv68-rrmw-9xwf.json index 03316cd38d2..da1fb327ef4 100644 --- a/advisories/github-reviewed/2024/09/GHSA-xv68-rrmw-9xwf/GHSA-xv68-rrmw-9xwf.json +++ b/advisories/github-reviewed/2024/09/GHSA-xv68-rrmw-9xwf/GHSA-xv68-rrmw-9xwf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xv68-rrmw-9xwf", - "modified": "2024-09-18T22:05:00Z", + "modified": "2024-09-27T19:34:04Z", "published": "2024-09-18T22:05:00Z", "aliases": [ "CVE-2024-47058" @@ -11,7 +11,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L" + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "type": "CVSS_V4", @@ -122,7 +122,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": "LOW", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-09-18T22:05:00Z", "nvd_published_at": "2024-09-18T21:15:13Z"