From af26687e138ca72d367b670cf6b0a2c5700fd08b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 26 Jan 2024 20:29:35 +0000 Subject: [PATCH] Publish Advisories GHSA-mpwq-j3xf-7m5w GHSA-23rx-79r7-6cpx GHSA-3f63-hfp8-52jq GHSA-3p77-wg4c-qm24 GHSA-c4pg-5ggh-vcpp GHSA-hj55-9jmv-9jrj --- .../GHSA-mpwq-j3xf-7m5w.json | 44 ++++++++++++++++++- .../GHSA-23rx-79r7-6cpx.json | 9 ++-- .../GHSA-3f63-hfp8-52jq.json | 11 ++++- .../GHSA-3p77-wg4c-qm24.json | 9 ++-- .../GHSA-c4pg-5ggh-vcpp.json | 7 ++- .../GHSA-hj55-9jmv-9jrj.json | 9 ++-- 6 files changed, 74 insertions(+), 15 deletions(-) diff --git a/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json b/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json index 5b2ac49c91d..794dba49e89 100644 --- a/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json +++ b/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mpwq-j3xf-7m5w", - "modified": "2023-12-21T18:25:30Z", + "modified": "2024-01-26T20:28:52Z", "published": "2023-12-21T18:25:30Z", "aliases": [ "CVE-2023-6291" @@ -40,10 +40,50 @@ "type": "WEB", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6291" + }, { "type": "WEB", "url": "https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7854" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7855" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7856" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7857" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7858" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7860" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2023:7861" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-6291" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251407" + }, { "type": "PACKAGE", "url": "https://github.com/keycloak/keycloak" @@ -56,6 +96,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-12-21T18:25:30Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-26T15:15:08Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-23rx-79r7-6cpx/GHSA-23rx-79r7-6cpx.json b/advisories/github-reviewed/2024/01/GHSA-23rx-79r7-6cpx/GHSA-23rx-79r7-6cpx.json index e76ed241f80..0f8be700b9a 100644 --- a/advisories/github-reviewed/2024/01/GHSA-23rx-79r7-6cpx/GHSA-23rx-79r7-6cpx.json +++ b/advisories/github-reviewed/2024/01/GHSA-23rx-79r7-6cpx/GHSA-23rx-79r7-6cpx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-23rx-79r7-6cpx", - "modified": "2024-01-23T14:34:38Z", + "modified": "2024-01-26T20:28:43Z", "published": "2024-01-19T21:30:36Z", "aliases": [ "CVE-2024-23683" @@ -9,7 +9,10 @@ "summary": "Sandbox escape in Artemis Java Test Sandbox", "details": "Artemis Java Test Sandbox versions less than 1.7.6 are vulnerable to a sandbox escape when an attacker crafts a special subclass of InvocationTargetException. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.\n\n\n\n\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" + } ], "affected": [ { @@ -70,7 +73,7 @@ "cwe_ids": [ ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-23T14:34:38Z", "nvd_published_at": "2024-01-19T21:15:10Z" diff --git a/advisories/github-reviewed/2024/01/GHSA-3f63-hfp8-52jq/GHSA-3f63-hfp8-52jq.json b/advisories/github-reviewed/2024/01/GHSA-3f63-hfp8-52jq/GHSA-3f63-hfp8-52jq.json index 0e2c3dd6e64..161d348457f 100644 --- a/advisories/github-reviewed/2024/01/GHSA-3f63-hfp8-52jq/GHSA-3f63-hfp8-52jq.json +++ b/advisories/github-reviewed/2024/01/GHSA-3f63-hfp8-52jq/GHSA-3f63-hfp8-52jq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3f63-hfp8-52jq", - "modified": "2024-01-22T21:28:18Z", + "modified": "2024-01-26T20:28:55Z", "published": "2024-01-19T21:30:35Z", "aliases": [ "CVE-2023-50447" @@ -9,7 +9,10 @@ "summary": "Arbitrary Code Execution in Pillow", "details": "Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -58,6 +61,10 @@ "type": "PACKAGE", "url": "https://github.com/python-pillow/Pillow" }, + { + "type": "WEB", + "url": "https://github.com/python-pillow/Pillow/releases" + }, { "type": "WEB", "url": "https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security" diff --git a/advisories/github-reviewed/2024/01/GHSA-3p77-wg4c-qm24/GHSA-3p77-wg4c-qm24.json b/advisories/github-reviewed/2024/01/GHSA-3p77-wg4c-qm24/GHSA-3p77-wg4c-qm24.json index 317812b876d..86c0459b38f 100644 --- a/advisories/github-reviewed/2024/01/GHSA-3p77-wg4c-qm24/GHSA-3p77-wg4c-qm24.json +++ b/advisories/github-reviewed/2024/01/GHSA-3p77-wg4c-qm24/GHSA-3p77-wg4c-qm24.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3p77-wg4c-qm24", - "modified": "2024-01-23T14:34:54Z", + "modified": "2024-01-26T20:28:30Z", "published": "2024-01-19T21:30:36Z", "aliases": [ "CVE-2024-23689" @@ -9,7 +9,10 @@ "summary": "Exposure of sensitive information in ClickHouse", "details": "Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -108,7 +111,7 @@ "cwe_ids": [ "CWE-209" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-23T14:34:54Z", "nvd_published_at": "2024-01-19T21:15:10Z" diff --git a/advisories/github-reviewed/2024/01/GHSA-c4pg-5ggh-vcpp/GHSA-c4pg-5ggh-vcpp.json b/advisories/github-reviewed/2024/01/GHSA-c4pg-5ggh-vcpp/GHSA-c4pg-5ggh-vcpp.json index 39f458c05a8..5a5b65e5349 100644 --- a/advisories/github-reviewed/2024/01/GHSA-c4pg-5ggh-vcpp/GHSA-c4pg-5ggh-vcpp.json +++ b/advisories/github-reviewed/2024/01/GHSA-c4pg-5ggh-vcpp/GHSA-c4pg-5ggh-vcpp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c4pg-5ggh-vcpp", - "modified": "2024-01-22T21:25:12Z", + "modified": "2024-01-26T20:28:48Z", "published": "2024-01-19T21:30:36Z", "aliases": [ "CVE-2024-23681" @@ -9,7 +9,10 @@ "summary": "Sandbox escape in Artemis Java Test Sandbox", "details": "Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.\n\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/01/GHSA-hj55-9jmv-9jrj/GHSA-hj55-9jmv-9jrj.json b/advisories/github-reviewed/2024/01/GHSA-hj55-9jmv-9jrj/GHSA-hj55-9jmv-9jrj.json index e4945e47d14..3e222c7edc0 100644 --- a/advisories/github-reviewed/2024/01/GHSA-hj55-9jmv-9jrj/GHSA-hj55-9jmv-9jrj.json +++ b/advisories/github-reviewed/2024/01/GHSA-hj55-9jmv-9jrj/GHSA-hj55-9jmv-9jrj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hj55-9jmv-9jrj", - "modified": "2024-01-22T21:31:04Z", + "modified": "2024-01-26T20:28:16Z", "published": "2024-01-19T21:30:36Z", "aliases": [ "CVE-2024-23682" @@ -9,7 +9,10 @@ "summary": "Sandbox escape in Artemis Java Test Sandbox", "details": "Artemis Java Test Sandbox versions before 1.8.0 are vulnerable to a sandbox escape when an attacker includes class files in a package that Ares trusts. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.\n\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" + } ], "affected": [ { @@ -66,7 +69,7 @@ "cwe_ids": [ "CWE-501" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-22T21:31:04Z", "nvd_published_at": "2024-01-19T21:15:10Z"