From ad2984861421c0e15e6f611578ada1d04a0251ee Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 3 May 2024 20:24:05 +0000
Subject: [PATCH] Publish Advisories

GHSA-m4mm-pg93-fv78
GHSA-m5q8-58wh-xxq4
GHSA-wccg-v638-j9q2
---
 .../GHSA-m4mm-pg93-fv78.json                  | 10 +++++-
 .../GHSA-m5q8-58wh-xxq4.json                  |  4 +--
 .../GHSA-wccg-v638-j9q2.json                  | 33 ++++++++++++++++---
 3 files changed, 39 insertions(+), 8 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json (50%)

diff --git a/advisories/github-reviewed/2023/09/GHSA-m4mm-pg93-fv78/GHSA-m4mm-pg93-fv78.json b/advisories/github-reviewed/2023/09/GHSA-m4mm-pg93-fv78/GHSA-m4mm-pg93-fv78.json
index d2070c257d7..fef4452c593 100644
--- a/advisories/github-reviewed/2023/09/GHSA-m4mm-pg93-fv78/GHSA-m4mm-pg93-fv78.json
+++ b/advisories/github-reviewed/2023/09/GHSA-m4mm-pg93-fv78/GHSA-m4mm-pg93-fv78.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m4mm-pg93-fv78",
-  "modified": "2023-09-15T13:37:03Z",
+  "modified": "2024-05-03T20:23:36Z",
   "published": "2023-09-14T15:31:23Z",
   "aliases": [
     "CVE-2023-1108"
@@ -83,6 +83,10 @@
       "type": "PACKAGE",
       "url": "https://github.com/undertow-io/undertow"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-m4mm-pg93-fv78"
+    },
     {
       "type": "WEB",
       "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2174246"
@@ -119,6 +123,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2023:3883"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:2135"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2023:1516"
diff --git a/advisories/github-reviewed/2023/09/GHSA-m5q8-58wh-xxq4/GHSA-m5q8-58wh-xxq4.json b/advisories/github-reviewed/2023/09/GHSA-m5q8-58wh-xxq4/GHSA-m5q8-58wh-xxq4.json
index 705ee9e31f7..437306197ed 100644
--- a/advisories/github-reviewed/2023/09/GHSA-m5q8-58wh-xxq4/GHSA-m5q8-58wh-xxq4.json
+++ b/advisories/github-reviewed/2023/09/GHSA-m5q8-58wh-xxq4/GHSA-m5q8-58wh-xxq4.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m5q8-58wh-xxq4",
-  "modified": "2023-09-12T13:53:19Z",
+  "modified": "2024-05-03T20:22:27Z",
   "published": "2023-09-11T21:30:17Z",
   "aliases": [
     "CVE-2022-1415"
   ],
   "summary": "Drools Core Deserialization of Untrusted Data vulnerability",
-  "details": "A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.",
+  "details": "A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. ",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/unreviewed/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json b/advisories/github-reviewed/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json
similarity index 50%
rename from advisories/unreviewed/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json
rename to advisories/github-reviewed/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json
index 5c54a1f1d37..09f529725a2 100644
--- a/advisories/unreviewed/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json
+++ b/advisories/github-reviewed/2024/05/GHSA-wccg-v638-j9q2/GHSA-wccg-v638-j9q2.json
@@ -1,17 +1,36 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wccg-v638-j9q2",
-  "modified": "2024-05-02T21:30:29Z",
+  "modified": "2024-05-03T20:22:18Z",
   "published": "2024-05-02T21:30:29Z",
   "aliases": [
     "CVE-2024-33396"
   ],
+  "summary": "karmada vulnerable to arbitrary code execution via a crafted command ",
   "details": "An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.",
   "severity": [
 
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/karmada-io/karmada"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.9.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -21,15 +40,19 @@
     {
       "type": "WEB",
       "url": "https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/karmada-io/karmada"
     }
   ],
   "database_specific": {
     "cwe_ids": [
 
     ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-03T20:22:18Z",
     "nvd_published_at": "2024-05-02T19:15:06Z"
   }
 }
\ No newline at end of file