diff --git a/advisories/unreviewed/2025/03/GHSA-fx47-jpv9-7hxr/GHSA-fx47-jpv9-7hxr.json b/advisories/github-reviewed/2025/03/GHSA-fx47-jpv9-7hxr/GHSA-fx47-jpv9-7hxr.json similarity index 55% rename from advisories/unreviewed/2025/03/GHSA-fx47-jpv9-7hxr/GHSA-fx47-jpv9-7hxr.json rename to advisories/github-reviewed/2025/03/GHSA-fx47-jpv9-7hxr/GHSA-fx47-jpv9-7hxr.json index 882373674c2..c4e5c2e58bc 100644 --- a/advisories/unreviewed/2025/03/GHSA-fx47-jpv9-7hxr/GHSA-fx47-jpv9-7hxr.json +++ b/advisories/github-reviewed/2025/03/GHSA-fx47-jpv9-7hxr/GHSA-fx47-jpv9-7hxr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fx47-jpv9-7hxr", - "modified": "2025-03-20T12:32:38Z", + "modified": "2025-03-20T18:57:07Z", "published": "2025-03-20T12:32:38Z", "aliases": [ "CVE-2024-10110" ], + "summary": "Aim Vulnerable to Denial of Service (DoS)", "details": "In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.", "severity": [ { @@ -13,12 +14,40 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "aim" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.15.0" + }, + { + "last_affected": "3.23.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10110" }, + { + "type": "PACKAGE", + "url": "https://github.com/aimhubio/aim" + }, + { + "type": "WEB", + "url": "https://github.com/aimhubio/aim/blob/a566d4a2501c96a545a3c89d92af6ad7e7e0da99/aim/sdk/reporter/__init__.py#L789" + }, { "type": "WEB", "url": "https://huntr.com/bounties/5ea6cf56-7b4c-4dce-9b6c-3e910fbb1ae4" @@ -29,8 +58,8 @@ "CWE-400" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-03-20T18:57:06Z", "nvd_published_at": "2025-03-20T10:15:14Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json b/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json index 0a7b04fcdc2..756c03e7e13 100644 --- a/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json +++ b/advisories/github-reviewed/2025/03/GHSA-x3m8-f7g5-qhm7/GHSA-x3m8-f7g5-qhm7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x3m8-f7g5-qhm7", - "modified": "2025-03-19T15:55:58Z", + "modified": "2025-03-20T18:58:15Z", "published": "2025-03-19T15:55:58Z", "aliases": [ "CVE-2025-29783" @@ -25,7 +25,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "0.6.5" }, { "fixed": "0.8.0" @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29783" + }, { "type": "WEB", "url": "https://github.com/vllm-project/vllm/pull/14228" @@ -60,6 +64,6 @@ "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2025-03-19T15:55:58Z", - "nvd_published_at": null + "nvd_published_at": "2025-03-19T16:15:32Z" } } \ No newline at end of file