Publish Advisories

GHSA-c2hm-mjxv-89r4
GHSA-98p4-xjmm-8mfh
GHSA-8fj2-587w-5whr

advisories/github-reviewed/2023/09/GHSA-c2hm-mjxv-89r4/GHSA-c2hm-mjxv-89r4.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c2hm-mjxv-89r4",
-  "modified": "2023-09-04T17:02:00Z",
+  "modified": "2024-07-05T18:07:13Z",
   "published": "2023-09-04T17:02:00Z",
   "aliases": [
 
   ],
   "summary": "Multiple soundness issues in lexical",
-  "details": "`lexical` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n\nThe crate also has some correctness issues and appears to be unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorith by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.\n\nFor quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.\n\nFor formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.\n\nFor working with big numbers consider `num-bigint` and `num-traits`.\n",
+  "details": "`lexical` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n\nThe crate also has some correctness issues and appears to be unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.\n\nFor quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.\n\nFor formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.\n\nFor working with big numbers consider `num-bigint` and `num-traits`.\n",
   "severity": [
 
   ],

advisories/github-reviewed/2024/04/GHSA-98p4-xjmm-8mfh/GHSA-98p4-xjmm-8mfh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-98p4-xjmm-8mfh",
-  "modified": "2024-04-26T18:51:04Z",
+  "modified": "2024-07-05T18:07:37Z",
   "published": "2024-04-15T19:33:03Z",
   "aliases": [
     "CVE-2024-32884"

advisories/github-reviewed/2024/07/GHSA-8fj2-587w-5whr/GHSA-8fj2-587w-5whr.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8fj2-587w-5whr",
-  "modified": "2024-07-02T21:21:17Z",
+  "modified": "2024-07-05T18:08:13Z",
   "published": "2024-07-02T21:21:17Z",
   "aliases": [
     "CVE-2024-39322"
   ],
   "summary": "aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records",
-  "details": "### Impact\nImproper access control allows editors to remove admin group and locale configuration in Aimeos backend\n",
+  "details": "Improper access control allows editors to remove admin group and locale configuration in Aimeos backend\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -119,6 +119,10 @@
       "type": "WEB",
       "url": "https://github.com/aimeos/ai-admin-jsonadm/security/advisories/GHSA-8fj2-587w-5whr"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39322"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/aimeos/ai-admin-jsonadm/commit/02a063fbd616d4e0a5aaf89f1642a856aa5ac5a5"
@@ -151,6 +155,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-07-02T21:21:17Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-07-02T21:15:10Z"
   }
 }