diff --git a/advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json b/advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json new file mode 100644 index 00000000000..f7c486b519f --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json @@ -0,0 +1,115 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fh5r-crhr-qrrq", + "modified": "2025-01-21T20:15:57Z", + "published": "2025-01-21T12:30:47Z", + "aliases": [ + "CVE-2025-23184" + ], + "summary": "Apache CXF: Denial of Service vulnerability with temporary files", + "details": "A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0" + }, + { + "fixed": "3.6.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23184" + }, + { + "type": "WEB", + "url": "https://github.com/apache/cxf/pull/2048" + }, + { + "type": "WEB", + "url": "https://github.com/apache/cxf/pull/2111" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/cxf" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/CXF-7396" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/01/20/3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-21T20:15:57Z", + "nvd_published_at": "2025-01-21T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json b/advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json new file mode 100644 index 00000000000..83e989f67e1 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jgx4-7v3v-vwfm", + "modified": "2025-01-21T20:17:05Z", + "published": "2025-01-21T12:30:47Z", + "aliases": [ + "CVE-2024-43709" + ], + "summary": "Elasticsearch allocation of resources without limits or throttling leads to crash", + "details": "An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.elasticsearch:elasticsearch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.17.21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.elasticsearch:elasticsearch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.13.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43709" + }, + { + "type": "WEB", + "url": "https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442" + }, + { + "type": "PACKAGE", + "url": "https://github.com/elastic/elasticsearch" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-21T20:17:05Z", + "nvd_published_at": "2025-01-21T11:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json b/advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json deleted file mode 100644 index d6311aa9429..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fh5r-crhr-qrrq", - "modified": "2025-01-21T12:30:47Z", - "published": "2025-01-21T12:30:47Z", - "aliases": [ - "CVE-2025-23184" - ], - "details": "A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23184" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/01/20/3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-21T10:15:08Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json b/advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json deleted file mode 100644 index b4f09e8f3f7..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jgx4-7v3v-vwfm", - "modified": "2025-01-21T12:30:47Z", - "published": "2025-01-21T12:30:47Z", - "aliases": [ - "CVE-2024-43709" - ], - "details": "An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43709" - }, - { - "type": "WEB", - "url": "https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-770" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-21T11:15:09Z" - } -} \ No newline at end of file