Publish Advisories

GHSA-mpwq-j3xf-7m5w GHSA-23rx-79r7-6cpx GHSA-3f63-hfp8-52jq GHSA-3p77-wg4c-qm24 GHSA-c4pg-5ggh-vcpp GHSA-hj55-9jmv-9jrj
2026-05-22 18:04:22 -07:00 · 2024-01-26 20:29:35 +00:00
parent f536f53fb0
commit af26687e13
6 changed files with 74 additions and 15 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mpwq-j3xf-7m5w",
-  "modified": "2023-12-21T18:25:30Z",
+  "modified": "2024-01-26T20:28:52Z",
  "published": "2023-12-21T18:25:30Z",
  "aliases": [
    "CVE-2023-6291"
@@ -40,10 +40,50 @@
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w"
    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6291"
+    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7854"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7855"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7856"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7857"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7858"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7860"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:7861"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2023-6291"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251407"
+    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
@@ -56,6 +96,6 @@
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-21T18:25:30Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-01-26T15:15:08Z"
  }
 }
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-23rx-79r7-6cpx",
-  "modified": "2024-01-23T14:34:38Z",
+  "modified": "2024-01-26T20:28:43Z",
  "published": "2024-01-19T21:30:36Z",
  "aliases": [
    "CVE-2024-23683"
@@ -9,7 +9,10 @@
  "summary": "Sandbox escape in Artemis Java Test Sandbox",
  "details": "Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.\n\n\n\n\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -70,7 +73,7 @@
    "cwe_ids": [

    ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T14:34:38Z",
    "nvd_published_at": "2024-01-19T21:15:10Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3f63-hfp8-52jq",
-  "modified": "2024-01-22T21:28:18Z",
+  "modified": "2024-01-26T20:28:55Z",
  "published": "2024-01-19T21:30:35Z",
  "aliases": [
    "CVE-2023-50447"
@@ -9,7 +9,10 @@
  "summary": "Arbitrary Code Execution in Pillow",
  "details": "Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -58,6 +61,10 @@
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/python-pillow/Pillow/releases"
+    },
    {
      "type": "WEB",
      "url": "https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3p77-wg4c-qm24",
-  "modified": "2024-01-23T14:34:54Z",
+  "modified": "2024-01-26T20:28:30Z",
  "published": "2024-01-19T21:30:36Z",
  "aliases": [
    "CVE-2024-23689"
@@ -9,7 +9,10 @@
  "summary": "Exposure of sensitive information in ClickHouse",
  "details": "Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -108,7 +111,7 @@
    "cwe_ids": [
      "CWE-209"
    ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T14:34:54Z",
    "nvd_published_at": "2024-01-19T21:15:10Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c4pg-5ggh-vcpp",
-  "modified": "2024-01-22T21:25:12Z",
+  "modified": "2024-01-26T20:28:48Z",
  "published": "2024-01-19T21:30:36Z",
  "aliases": [
    "CVE-2024-23681"
@@ -9,7 +9,10 @@
  "summary": "Sandbox escape in Artemis Java Test Sandbox",
  "details": "Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.\n\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hj55-9jmv-9jrj",
-  "modified": "2024-01-22T21:31:04Z",
+  "modified": "2024-01-26T20:28:16Z",
  "published": "2024-01-19T21:30:36Z",
  "aliases": [
    "CVE-2024-23682"
@@ -9,7 +9,10 @@
  "summary": "Sandbox escape in Artemis Java Test Sandbox",
  "details": "Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.\n\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -66,7 +69,7 @@
    "cwe_ids": [
      "CWE-501"
    ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-22T21:31:04Z",
    "nvd_published_at": "2024-01-19T21:15:10Z"