From ace3d9c1f9800dc6e70be06cb8d4059f7022160e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 13 Feb 2025 18:42:52 +0000 Subject: [PATCH] Publish Advisories GHSA-hfrx-6qgj-fp6c GHSA-w67w-mw4j-8qrv GHSA-3cgw-hfw7-wc7j GHSA-3h57-hmj3-gj3p GHSA-493p-pfq6-5258 GHSA-hjv9-hm2f-rpcj GHSA-vp98-w2p3-mv35 GHSA-6q97-8v3g-rpxw --- .../GHSA-hfrx-6qgj-fp6c.json | 6 +++- .../GHSA-w67w-mw4j-8qrv.json | 4 +-- .../GHSA-3cgw-hfw7-wc7j.json | 2 +- .../GHSA-3h57-hmj3-gj3p.json | 4 +-- .../GHSA-493p-pfq6-5258.json | 2 +- .../GHSA-hjv9-hm2f-rpcj.json | 2 +- .../GHSA-vp98-w2p3-mv35.json | 2 +- .../GHSA-6q97-8v3g-rpxw.json | 29 ++++--------------- 8 files changed, 19 insertions(+), 32 deletions(-) diff --git a/advisories/github-reviewed/2023/02/GHSA-hfrx-6qgj-fp6c/GHSA-hfrx-6qgj-fp6c.json b/advisories/github-reviewed/2023/02/GHSA-hfrx-6qgj-fp6c/GHSA-hfrx-6qgj-fp6c.json index 070a0346f2f..9db04665942 100644 --- a/advisories/github-reviewed/2023/02/GHSA-hfrx-6qgj-fp6c/GHSA-hfrx-6qgj-fp6c.json +++ b/advisories/github-reviewed/2023/02/GHSA-hfrx-6qgj-fp6c/GHSA-hfrx-6qgj-fp6c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hfrx-6qgj-fp6c", - "modified": "2024-04-18T17:14:07Z", + "modified": "2025-02-13T18:41:38Z", "published": "2023-02-20T18:30:17Z", "aliases": [ "CVE-2023-24998" @@ -232,6 +232,10 @@ "type": "WEB", "url": "https://tomcat.apache.org/security-10.html" }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20230302-0013" + }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202305-37" diff --git a/advisories/github-reviewed/2023/02/GHSA-w67w-mw4j-8qrv/GHSA-w67w-mw4j-8qrv.json b/advisories/github-reviewed/2023/02/GHSA-w67w-mw4j-8qrv/GHSA-w67w-mw4j-8qrv.json index 4e65fac0e6f..f6684eb99b9 100644 --- a/advisories/github-reviewed/2023/02/GHSA-w67w-mw4j-8qrv/GHSA-w67w-mw4j-8qrv.json +++ b/advisories/github-reviewed/2023/02/GHSA-w67w-mw4j-8qrv/GHSA-w67w-mw4j-8qrv.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-w67w-mw4j-8qrv", - "modified": "2023-03-06T21:59:59Z", + "modified": "2025-02-13T18:41:40Z", "published": "2023-02-08T22:27:42Z", "aliases": [ "CVE-2022-4203" ], "summary": "openssl-src contains Read Buffer Overflow in X.509 Name Constraint", - "details": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path to a trusted issuer.\n\nThe read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory.\n\nIn a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.\n", + "details": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path to a trusted issuer.\n\nThe read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory.\n\nIn a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/03/GHSA-3cgw-hfw7-wc7j/GHSA-3cgw-hfw7-wc7j.json b/advisories/github-reviewed/2023/03/GHSA-3cgw-hfw7-wc7j/GHSA-3cgw-hfw7-wc7j.json index 605303ddf57..2b89d47a8f5 100644 --- a/advisories/github-reviewed/2023/03/GHSA-3cgw-hfw7-wc7j/GHSA-3cgw-hfw7-wc7j.json +++ b/advisories/github-reviewed/2023/03/GHSA-3cgw-hfw7-wc7j/GHSA-3cgw-hfw7-wc7j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3cgw-hfw7-wc7j", - "modified": "2023-03-27T22:32:19Z", + "modified": "2025-02-13T18:41:49Z", "published": "2023-03-23T09:30:25Z", "withdrawn": "2023-03-23T20:10:27Z", "aliases": [], diff --git a/advisories/github-reviewed/2023/03/GHSA-3h57-hmj3-gj3p/GHSA-3h57-hmj3-gj3p.json b/advisories/github-reviewed/2023/03/GHSA-3h57-hmj3-gj3p/GHSA-3h57-hmj3-gj3p.json index 339ffb1c72d..fd5a6248553 100644 --- a/advisories/github-reviewed/2023/03/GHSA-3h57-hmj3-gj3p/GHSA-3h57-hmj3-gj3p.json +++ b/advisories/github-reviewed/2023/03/GHSA-3h57-hmj3-gj3p/GHSA-3h57-hmj3-gj3p.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-3h57-hmj3-gj3p", - "modified": "2024-10-15T23:33:31Z", + "modified": "2025-02-13T18:41:56Z", "published": "2023-03-08T17:20:04Z", "aliases": [ "CVE-2023-27530" ], "summary": "Rack has possible DoS Vulnerability in Multipart MIME parsing", - "details": "There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.\n\nVersions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3\n\n# Impact\nThe Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Workarounds\nA proxy can be configured to limit the POST body size which will mitigate this issue.\n", + "details": "There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.\n\nVersions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3\n\n# Impact\nThe Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Workarounds\nA proxy can be configured to limit the POST body size which will mitigate this issue.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2023/03/GHSA-493p-pfq6-5258/GHSA-493p-pfq6-5258.json b/advisories/github-reviewed/2023/03/GHSA-493p-pfq6-5258/GHSA-493p-pfq6-5258.json index 54449f9dc9b..a3309516be4 100644 --- a/advisories/github-reviewed/2023/03/GHSA-493p-pfq6-5258/GHSA-493p-pfq6-5258.json +++ b/advisories/github-reviewed/2023/03/GHSA-493p-pfq6-5258/GHSA-493p-pfq6-5258.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-493p-pfq6-5258", - "modified": "2025-02-06T17:46:31Z", + "modified": "2025-02-13T18:41:52Z", "published": "2023-03-23T20:32:03Z", "aliases": [ "CVE-2023-1370" diff --git a/advisories/github-reviewed/2023/03/GHSA-hjv9-hm2f-rpcj/GHSA-hjv9-hm2f-rpcj.json b/advisories/github-reviewed/2023/03/GHSA-hjv9-hm2f-rpcj/GHSA-hjv9-hm2f-rpcj.json index 3a930f9f6c1..c197145a79b 100644 --- a/advisories/github-reviewed/2023/03/GHSA-hjv9-hm2f-rpcj/GHSA-hjv9-hm2f-rpcj.json +++ b/advisories/github-reviewed/2023/03/GHSA-hjv9-hm2f-rpcj/GHSA-hjv9-hm2f-rpcj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hjv9-hm2f-rpcj", - "modified": "2023-03-09T04:23:52Z", + "modified": "2025-02-13T18:41:27Z", "published": "2023-03-01T18:30:59Z", "aliases": [ "CVE-2023-0507" diff --git a/advisories/github-reviewed/2023/03/GHSA-vp98-w2p3-mv35/GHSA-vp98-w2p3-mv35.json b/advisories/github-reviewed/2023/03/GHSA-vp98-w2p3-mv35/GHSA-vp98-w2p3-mv35.json index 4781465ef4d..e1ea7f08430 100644 --- a/advisories/github-reviewed/2023/03/GHSA-vp98-w2p3-mv35/GHSA-vp98-w2p3-mv35.json +++ b/advisories/github-reviewed/2023/03/GHSA-vp98-w2p3-mv35/GHSA-vp98-w2p3-mv35.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vp98-w2p3-mv35", - "modified": "2024-09-27T14:13:00Z", + "modified": "2025-02-13T18:41:46Z", "published": "2023-03-10T15:30:43Z", "aliases": [ "CVE-2023-26464" diff --git a/advisories/github-reviewed/2024/06/GHSA-6q97-8v3g-rpxw/GHSA-6q97-8v3g-rpxw.json b/advisories/github-reviewed/2024/06/GHSA-6q97-8v3g-rpxw/GHSA-6q97-8v3g-rpxw.json index 6ce11fa4aa5..74e7fce47ae 100644 --- a/advisories/github-reviewed/2024/06/GHSA-6q97-8v3g-rpxw/GHSA-6q97-8v3g-rpxw.json +++ b/advisories/github-reviewed/2024/06/GHSA-6q97-8v3g-rpxw/GHSA-6q97-8v3g-rpxw.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6q97-8v3g-rpxw", - "modified": "2024-09-26T21:11:10Z", + "modified": "2025-02-13T18:41:54Z", "published": "2024-06-12T15:31:45Z", "aliases": [ "CVE-2024-36265" ], "summary": "Apache Submarine Server Core Incorrect Authorization vulnerability", - "details": "Incorrect Authorization vulnerability in Apache Submarine Server Core.\n\nThis issue affects Apache Submarine Server Core: from 0.8.0.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n", + "details": "Incorrect Authorization vulnerability in Apache Submarine Server Core.\n\nThis issue affects Apache Submarine Server Core: from 0.8.0.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "severity": [ { "type": "CVSS_V3", @@ -20,18 +20,8 @@ "ecosystem": "Maven", "name": "org.apache.submarine:submarine-server-core" }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0" - }, - { - "last_affected": "0.8.0" - } - ] - } + "versions": [ + "0.8.0" ] }, { @@ -39,15 +29,8 @@ "ecosystem": "PyPI", "name": "apache-submarine" }, - "ranges": [ - { - "type": "ECOSYSTEM", - "events": [ - { - "introduced": "0.8.0" - } - ] - } + "versions": [ + "0.8.0" ] } ],