From b30531b50218b365302f16e388027a5f609a4ec6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 26 Oct 2024 21:31:50 +0000 Subject: [PATCH] Publish Advisories GHSA-3phv-83cj-p8p7 GHSA-68qg-g787-3rp5 GHSA-fw2v-v7vp-pccq GHSA-mgfv-m47x-4wqp GHSA-p8pc-3f7w-jr5q GHSA-pmvv-57rg-5g86 GHSA-qmpf-c66x-m579 GHSA-rv73-9c8w-jp4c GHSA-w455-mfq9-hf74 --- .../GHSA-3phv-83cj-p8p7.json | 42 +++++++++++++++++++ .../GHSA-68qg-g787-3rp5.json | 42 +++++++++++++++++++ .../GHSA-fw2v-v7vp-pccq.json | 42 +++++++++++++++++++ .../GHSA-mgfv-m47x-4wqp.json | 42 +++++++++++++++++++ .../GHSA-p8pc-3f7w-jr5q.json | 42 +++++++++++++++++++ .../GHSA-pmvv-57rg-5g86.json | 42 +++++++++++++++++++ .../GHSA-qmpf-c66x-m579.json | 42 +++++++++++++++++++ .../GHSA-rv73-9c8w-jp4c.json | 42 +++++++++++++++++++ .../GHSA-w455-mfq9-hf74.json | 42 +++++++++++++++++++ 9 files changed, 378 insertions(+) create mode 100644 advisories/unreviewed/2024/10/GHSA-3phv-83cj-p8p7/GHSA-3phv-83cj-p8p7.json create mode 100644 advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json create mode 100644 advisories/unreviewed/2024/10/GHSA-fw2v-v7vp-pccq/GHSA-fw2v-v7vp-pccq.json create mode 100644 advisories/unreviewed/2024/10/GHSA-mgfv-m47x-4wqp/GHSA-mgfv-m47x-4wqp.json create mode 100644 advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json create mode 100644 advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json create mode 100644 advisories/unreviewed/2024/10/GHSA-qmpf-c66x-m579/GHSA-qmpf-c66x-m579.json create mode 100644 advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json create mode 100644 advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json diff --git a/advisories/unreviewed/2024/10/GHSA-3phv-83cj-p8p7/GHSA-3phv-83cj-p8p7.json b/advisories/unreviewed/2024/10/GHSA-3phv-83cj-p8p7/GHSA-3phv-83cj-p8p7.json new file mode 100644 index 00000000000..d0bc078cf54 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-3phv-83cj-p8p7/GHSA-3phv-83cj-p8p7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3phv-83cj-p8p7", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26309" + ], + "details": "Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26309" + }, + { + "type": "WEB", + "url": "https://github.com/ftonato/nope-validator/issues/352" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-303-redos-nope-validator" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json b/advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json new file mode 100644 index 00000000000..ea7f6571c8a --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-68qg-g787-3rp5/GHSA-68qg-g787-3rp5.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-68qg-g787-3rp5", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26306" + ], + "details": "Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26306" + }, + { + "type": "WEB", + "url": "https://github.com/benhmoore/Knwl/issues/106" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-296-redos-Knwl.js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-fw2v-v7vp-pccq/GHSA-fw2v-v7vp-pccq.json b/advisories/unreviewed/2024/10/GHSA-fw2v-v7vp-pccq/GHSA-fw2v-v7vp-pccq.json new file mode 100644 index 00000000000..4f26a44ea40 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-fw2v-v7vp-pccq/GHSA-fw2v-v7vp-pccq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fw2v-v7vp-pccq", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26310" + ], + "details": "Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26310" + }, + { + "type": "WEB", + "url": "https://github.com/blowsie/Pure-JavaScript-HTML5-Parser/issues/14" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-305-redos-Pure-JavaScript-HTML5-Parser" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-mgfv-m47x-4wqp/GHSA-mgfv-m47x-4wqp.json b/advisories/unreviewed/2024/10/GHSA-mgfv-m47x-4wqp/GHSA-mgfv-m47x-4wqp.json new file mode 100644 index 00000000000..4b2c0c0278e --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-mgfv-m47x-4wqp/GHSA-mgfv-m47x-4wqp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgfv-m47x-4wqp", + "modified": "2024-10-26T21:30:47Z", + "published": "2024-10-26T21:30:47Z", + "aliases": [ + "CVE-2020-26311" + ], + "details": "Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26311" + }, + { + "type": "WEB", + "url": "https://github.com/3rd-Eden/useragent/issues/167" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-312-redos-useragent" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json b/advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json new file mode 100644 index 00000000000..75e9375abf7 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-p8pc-3f7w-jr5q/GHSA-p8pc-3f7w-jr5q.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p8pc-3f7w-jr5q", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26304" + ], + "details": "Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26304" + }, + { + "type": "WEB", + "url": "https://github.com/foundation/foundation-sites/issues/12180" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-290-redos-foundation-sites" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json b/advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json new file mode 100644 index 00000000000..79a339560fc --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-pmvv-57rg-5g86/GHSA-pmvv-57rg-5g86.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmvv-57rg-5g86", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26305" + ], + "details": "CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26305" + }, + { + "type": "WEB", + "url": "https://github.com/talyssonoc/CommonRegexJS/issues/4" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-291-redos-CommonRegexJS" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-qmpf-c66x-m579/GHSA-qmpf-c66x-m579.json b/advisories/unreviewed/2024/10/GHSA-qmpf-c66x-m579/GHSA-qmpf-c66x-m579.json new file mode 100644 index 00000000000..c6a2949f121 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-qmpf-c66x-m579/GHSA-qmpf-c66x-m579.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qmpf-c66x-m579", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26307" + ], + "details": "HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26307" + }, + { + "type": "WEB", + "url": "https://github.com/kates/html2markdown/issues/13" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-301-redos-HTML2Markdown" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json b/advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json new file mode 100644 index 00000000000..bccba7a6cd9 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-rv73-9c8w-jp4c/GHSA-rv73-9c8w-jp4c.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rv73-9c8w-jp4c", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26308" + ], + "details": "Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26308" + }, + { + "type": "WEB", + "url": "https://github.com/ansman/validate.js/issues/342" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-302-redos-validate.js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json b/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json new file mode 100644 index 00000000000..4b8c98a1cc1 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-w455-mfq9-hf74/GHSA-w455-mfq9-hf74.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w455-mfq9-hf74", + "modified": "2024-10-26T21:30:46Z", + "published": "2024-10-26T21:30:46Z", + "aliases": [ + "CVE-2020-26303" + ], + "details": "insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26303" + }, + { + "type": "WEB", + "url": "https://github.com/bevacqua/insane/issues/19" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T21:15:13Z" + } +} \ No newline at end of file