From af31d0cd6909f208feb8b900e3060533e134ba81 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 29 Feb 2024 23:28:08 +0000 Subject: [PATCH] Publish Advisories GHSA-6v6w-h8m6-7mv2 GHSA-q76r-7p4q-mqpw GHSA-vf7j-cmrj-pmmm --- .../GHSA-6v6w-h8m6-7mv2.json | 40 ++++++++++++++++--- .../GHSA-q76r-7p4q-mqpw.json | 21 ++++++++-- .../GHSA-vf7j-cmrj-pmmm.json | 15 +++---- 3 files changed, 58 insertions(+), 18 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json (56%) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json (69%) diff --git a/advisories/unreviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json b/advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json similarity index 56% rename from advisories/unreviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json rename to advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json index 98b333d40ae..1a5e042b0f0 100644 --- a/advisories/unreviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json +++ b/advisories/github-reviewed/2024/02/GHSA-6v6w-h8m6-7mv2/GHSA-6v6w-h8m6-7mv2.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-6v6w-h8m6-7mv2", - "modified": "2024-02-29T12:31:06Z", + "modified": "2024-02-29T23:27:11Z", "published": "2024-02-29T12:31:06Z", "aliases": [ "CVE-2024-27906" ], + "summary": "Apache Airflow: DAG Code and Import Error Permissions Ignored", "details": "Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability\n", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.8.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.8.1" + } + } ], "references": [ { @@ -26,18 +48,26 @@ "type": "WEB", "url": "https://github.com/apache/airflow/pull/37468" }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, { "type": "WEB", "url": "https://lists.apache.org/thread/on4f7t5sqr3vfgp1pvkck79wv7mq9st5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/29/1" } ], "database_specific": { "cwe_ids": [ "CWE-668" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T23:27:11Z", "nvd_published_at": "2024-02-29T11:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json b/advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json similarity index 69% rename from advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json rename to advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json index 79929e08bfc..b3d352ae701 100644 --- a/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json +++ b/advisories/github-reviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-q76r-7p4q-mqpw", - "modified": "2024-02-29T15:32:26Z", + "modified": "2024-02-29T23:27:17Z", "published": "2024-02-29T15:32:26Z", "aliases": [ "CVE-2024-2001" ], + "summary": "Cockpit CMS Cross-Site Scripting vulnerability", "details": "A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.", "severity": [ { @@ -14,13 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "cockpit-hq/cockpit" + }, + "versions": [ + "2.7.0" + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2001" }, + { + "type": "PACKAGE", + "url": "https://github.com/Cockpit-HQ/Cockpit" + }, { "type": "WEB", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cms" @@ -31,8 +44,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-29T23:27:17Z", "nvd_published_at": "2024-02-29T14:15:45Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json b/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json index fe821934c68..531fc5b3590 100644 --- a/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json +++ b/advisories/github-reviewed/2024/02/GHSA-vf7j-cmrj-pmmm/GHSA-vf7j-cmrj-pmmm.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vf7j-cmrj-pmmm", - "modified": "2024-02-27T21:54:56Z", + "modified": "2024-02-29T23:26:54Z", "published": "2024-02-27T15:30:33Z", "aliases": [ "CVE-2024-25723" ], - "summary": "ZenML vulnerable to remote privilege escalation", + "summary": "ZenML Server Remote Privilege Escalation Vulnerability", "details": "ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.", "severity": [ @@ -63,16 +63,13 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0.44.0" + "introduced": "0.45.0" }, { - "fixed": "0.44.1" + "fixed": "0.46.7" } ] } - ], - "versions": [ - "0.44.0" ] }, { @@ -85,10 +82,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0.45.0" + "introduced": "0.44.0" }, { - "fixed": "0.46.7" + "fixed": "0.44.4" } ] }