mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-hfrx-6qgj-fp6c GHSA-w67w-mw4j-8qrv GHSA-3cgw-hfw7-wc7j GHSA-3h57-hmj3-gj3p GHSA-493p-pfq6-5258 GHSA-hjv9-hm2f-rpcj GHSA-vp98-w2p3-mv35 GHSA-6q97-8v3g-rpxw
This commit is contained in:
advisory-database[bot]
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hfrx-6qgj-fp6c",
|
||||
"modified": "2024-04-18T17:14:07Z",
|
||||
"modified": "2025-02-13T18:41:38Z",
|
||||
"published": "2023-02-20T18:30:17Z",
|
||||
"aliases": [
|
||||
"CVE-2023-24998"
|
||||
@@ -232,6 +232,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://tomcat.apache.org/security-10.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20230302-0013"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.gentoo.org/glsa/202305-37"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w67w-mw4j-8qrv",
|
||||
"modified": "2023-03-06T21:59:59Z",
|
||||
"modified": "2025-02-13T18:41:40Z",
|
||||
"published": "2023-02-08T22:27:42Z",
|
||||
"aliases": [
|
||||
"CVE-2022-4203"
|
||||
],
|
||||
"summary": "openssl-src contains Read Buffer Overflow in X.509 Name Constraint",
|
||||
"details": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path to a trusted issuer.\n\nThe read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory.\n\nIn a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.\n",
|
||||
"details": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path to a trusted issuer.\n\nThe read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory.\n\nIn a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3cgw-hfw7-wc7j",
|
||||
"modified": "2023-03-27T22:32:19Z",
|
||||
"modified": "2025-02-13T18:41:49Z",
|
||||
"published": "2023-03-23T09:30:25Z",
|
||||
"withdrawn": "2023-03-23T20:10:27Z",
|
||||
"aliases": [],
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3h57-hmj3-gj3p",
|
||||
"modified": "2024-10-15T23:33:31Z",
|
||||
"modified": "2025-02-13T18:41:56Z",
|
||||
"published": "2023-03-08T17:20:04Z",
|
||||
"aliases": [
|
||||
"CVE-2023-27530"
|
||||
],
|
||||
"summary": "Rack has possible DoS Vulnerability in Multipart MIME parsing",
|
||||
"details": "There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.\n\nVersions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3\n\n# Impact\nThe Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Workarounds\nA proxy can be configured to limit the POST body size which will mitigate this issue.\n",
|
||||
"details": "There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.\n\nVersions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3\n\n# Impact\nThe Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Workarounds\nA proxy can be configured to limit the POST body size which will mitigate this issue.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-493p-pfq6-5258",
|
||||
"modified": "2025-02-06T17:46:31Z",
|
||||
"modified": "2025-02-13T18:41:52Z",
|
||||
"published": "2023-03-23T20:32:03Z",
|
||||
"aliases": [
|
||||
"CVE-2023-1370"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-hjv9-hm2f-rpcj",
|
||||
"modified": "2023-03-09T04:23:52Z",
|
||||
"modified": "2025-02-13T18:41:27Z",
|
||||
"published": "2023-03-01T18:30:59Z",
|
||||
"aliases": [
|
||||
"CVE-2023-0507"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vp98-w2p3-mv35",
|
||||
"modified": "2024-09-27T14:13:00Z",
|
||||
"modified": "2025-02-13T18:41:46Z",
|
||||
"published": "2023-03-10T15:30:43Z",
|
||||
"aliases": [
|
||||
"CVE-2023-26464"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6q97-8v3g-rpxw",
|
||||
"modified": "2024-09-26T21:11:10Z",
|
||||
"modified": "2025-02-13T18:41:54Z",
|
||||
"published": "2024-06-12T15:31:45Z",
|
||||
"aliases": [
|
||||
"CVE-2024-36265"
|
||||
],
|
||||
"summary": "Apache Submarine Server Core Incorrect Authorization vulnerability",
|
||||
"details": "Incorrect Authorization vulnerability in Apache Submarine Server Core.\n\nThis issue affects Apache Submarine Server Core: from 0.8.0.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n",
|
||||
"details": "Incorrect Authorization vulnerability in Apache Submarine Server Core.\n\nThis issue affects Apache Submarine Server Core: from 0.8.0.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -20,18 +20,8 @@
|
||||
"ecosystem": "Maven",
|
||||
"name": "org.apache.submarine:submarine-server-core"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "0.8.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
"versions": [
|
||||
"0.8.0"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -39,15 +29,8 @@
|
||||
"ecosystem": "PyPI",
|
||||
"name": "apache-submarine"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0.8.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
"versions": [
|
||||
"0.8.0"
|
||||
]
|
||||
}
|
||||
],
|
||||
|
||||
Reference in New Issue
Block a user