From addc8fb4940c4ac4ef7d2af9c6895da3b61d7c53 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 21 Jan 2025 20:17:40 +0000 Subject: [PATCH] Publish Advisories GHSA-fh5r-crhr-qrrq GHSA-jgx4-7v3v-vwfm GHSA-fh5r-crhr-qrrq GHSA-jgx4-7v3v-vwfm --- .../GHSA-fh5r-crhr-qrrq.json | 115 ++++++++++++++++++ .../GHSA-jgx4-7v3v-vwfm.json | 80 ++++++++++++ .../GHSA-fh5r-crhr-qrrq.json | 40 ------ .../GHSA-jgx4-7v3v-vwfm.json | 36 ------ 4 files changed, 195 insertions(+), 76 deletions(-) create mode 100644 advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json create mode 100644 advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json diff --git a/advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json b/advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json new file mode 100644 index 00000000000..f7c486b519f --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json @@ -0,0 +1,115 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fh5r-crhr-qrrq", + "modified": "2025-01-21T20:15:57Z", + "published": "2025-01-21T12:30:47Z", + "aliases": [ + "CVE-2025-23184" + ], + "summary": "Apache CXF: Denial of Service vulnerability with temporary files", + "details": "A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0" + }, + { + "fixed": "3.6.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.cxf:cxf-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.0.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23184" + }, + { + "type": "WEB", + "url": "https://github.com/apache/cxf/pull/2048" + }, + { + "type": "WEB", + "url": "https://github.com/apache/cxf/pull/2111" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/cxf" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/CXF-7396" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/01/20/3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-21T20:15:57Z", + "nvd_published_at": "2025-01-21T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json b/advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json new file mode 100644 index 00000000000..83e989f67e1 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jgx4-7v3v-vwfm", + "modified": "2025-01-21T20:17:05Z", + "published": "2025-01-21T12:30:47Z", + "aliases": [ + "CVE-2024-43709" + ], + "summary": "Elasticsearch allocation of resources without limits or throttling leads to crash", + "details": "An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.elasticsearch:elasticsearch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.17.21" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.elasticsearch:elasticsearch" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.0.0" + }, + { + "fixed": "8.13.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43709" + }, + { + "type": "WEB", + "url": "https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442" + }, + { + "type": "PACKAGE", + "url": "https://github.com/elastic/elasticsearch" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-21T20:17:05Z", + "nvd_published_at": "2025-01-21T11:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json b/advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json deleted file mode 100644 index d6311aa9429..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-fh5r-crhr-qrrq/GHSA-fh5r-crhr-qrrq.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fh5r-crhr-qrrq", - "modified": "2025-01-21T12:30:47Z", - "published": "2025-01-21T12:30:47Z", - "aliases": [ - "CVE-2025-23184" - ], - "details": "A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23184" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2025/01/20/3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-400" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-21T10:15:08Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json b/advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json deleted file mode 100644 index b4f09e8f3f7..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-jgx4-7v3v-vwfm/GHSA-jgx4-7v3v-vwfm.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jgx4-7v3v-vwfm", - "modified": "2025-01-21T12:30:47Z", - "published": "2025-01-21T12:30:47Z", - "aliases": [ - "CVE-2024-43709" - ], - "details": "An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43709" - }, - { - "type": "WEB", - "url": "https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-770" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-21T11:15:09Z" - } -} \ No newline at end of file