From abc2239985a35a6a6eebd848ac47db8926f4291f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 5 Jul 2024 18:08:41 +0000 Subject: [PATCH] Publish Advisories GHSA-c2hm-mjxv-89r4 GHSA-98p4-xjmm-8mfh GHSA-8fj2-587w-5whr --- .../09/GHSA-c2hm-mjxv-89r4/GHSA-c2hm-mjxv-89r4.json | 4 ++-- .../04/GHSA-98p4-xjmm-8mfh/GHSA-98p4-xjmm-8mfh.json | 2 +- .../07/GHSA-8fj2-587w-5whr/GHSA-8fj2-587w-5whr.json | 10 +++++++--- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2023/09/GHSA-c2hm-mjxv-89r4/GHSA-c2hm-mjxv-89r4.json b/advisories/github-reviewed/2023/09/GHSA-c2hm-mjxv-89r4/GHSA-c2hm-mjxv-89r4.json index 78486f3ccba..1be09fccf17 100644 --- a/advisories/github-reviewed/2023/09/GHSA-c2hm-mjxv-89r4/GHSA-c2hm-mjxv-89r4.json +++ b/advisories/github-reviewed/2023/09/GHSA-c2hm-mjxv-89r4/GHSA-c2hm-mjxv-89r4.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-c2hm-mjxv-89r4", - "modified": "2023-09-04T17:02:00Z", + "modified": "2024-07-05T18:07:13Z", "published": "2023-09-04T17:02:00Z", "aliases": [ ], "summary": "Multiple soundness issues in lexical", - "details": "`lexical` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n\nThe crate also has some correctness issues and appears to be unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorith by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.\n\nFor quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.\n\nFor formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.\n\nFor working with big numbers consider `num-bigint` and `num-traits`.\n", + "details": "`lexical` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n\nThe crate also has some correctness issues and appears to be unmaintained.\n\n## Alternatives\n\nFor quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorithm by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.\n\nFor quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.\n\nFor formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.\n\nFor working with big numbers consider `num-bigint` and `num-traits`.\n", "severity": [ ], diff --git a/advisories/github-reviewed/2024/04/GHSA-98p4-xjmm-8mfh/GHSA-98p4-xjmm-8mfh.json b/advisories/github-reviewed/2024/04/GHSA-98p4-xjmm-8mfh/GHSA-98p4-xjmm-8mfh.json index 71670bd9e07..d3dba664528 100644 --- a/advisories/github-reviewed/2024/04/GHSA-98p4-xjmm-8mfh/GHSA-98p4-xjmm-8mfh.json +++ b/advisories/github-reviewed/2024/04/GHSA-98p4-xjmm-8mfh/GHSA-98p4-xjmm-8mfh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-98p4-xjmm-8mfh", - "modified": "2024-04-26T18:51:04Z", + "modified": "2024-07-05T18:07:37Z", "published": "2024-04-15T19:33:03Z", "aliases": [ "CVE-2024-32884" diff --git a/advisories/github-reviewed/2024/07/GHSA-8fj2-587w-5whr/GHSA-8fj2-587w-5whr.json b/advisories/github-reviewed/2024/07/GHSA-8fj2-587w-5whr/GHSA-8fj2-587w-5whr.json index 5c34da99cdc..ea10f02e768 100644 --- a/advisories/github-reviewed/2024/07/GHSA-8fj2-587w-5whr/GHSA-8fj2-587w-5whr.json +++ b/advisories/github-reviewed/2024/07/GHSA-8fj2-587w-5whr/GHSA-8fj2-587w-5whr.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8fj2-587w-5whr", - "modified": "2024-07-02T21:21:17Z", + "modified": "2024-07-05T18:08:13Z", "published": "2024-07-02T21:21:17Z", "aliases": [ "CVE-2024-39322" ], "summary": "aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records", - "details": "### Impact\nImproper access control allows editors to remove admin group and locale configuration in Aimeos backend\n", + "details": "Improper access control allows editors to remove admin group and locale configuration in Aimeos backend\n", "severity": [ { "type": "CVSS_V3", @@ -119,6 +119,10 @@ "type": "WEB", "url": "https://github.com/aimeos/ai-admin-jsonadm/security/advisories/GHSA-8fj2-587w-5whr" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39322" + }, { "type": "WEB", "url": "https://github.com/aimeos/ai-admin-jsonadm/commit/02a063fbd616d4e0a5aaf89f1642a856aa5ac5a5" @@ -151,6 +155,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-07-02T21:21:17Z", - "nvd_published_at": null + "nvd_published_at": "2024-07-02T21:15:10Z" } } \ No newline at end of file