From b3cbce51411361a999b148f9d0ca4b8724dbd2a1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 10 Nov 2023 00:43:51 +0000 Subject: [PATCH] Publish Advisories GHSA-4qhc-v8r6-8vwm GHSA-5cvx-cwpx-9rjh GHSA-cwh2-q44x-5w3c GHSA-fm5h-58g2-4m3f GHSA-jr83-8x65-xcr5 GHSA-4qhc-v8r6-8vwm GHSA-jr83-8x65-xcr5 --- .../GHSA-4qhc-v8r6-8vwm.json | 99 +++++++++++++++++++ .../GHSA-5cvx-cwpx-9rjh.json | 35 ++++++- .../GHSA-cwh2-q44x-5w3c.json | 35 ++++++- .../GHSA-fm5h-58g2-4m3f.json | 35 ++++++- .../GHSA-jr83-8x65-xcr5.json | 81 +++++++++++++++ .../GHSA-4qhc-v8r6-8vwm.json | 38 ------- .../GHSA-jr83-8x65-xcr5.json | 46 --------- 7 files changed, 273 insertions(+), 96 deletions(-) create mode 100644 advisories/github-reviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json rename advisories/{unreviewed => github-reviewed}/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json (61%) rename advisories/{unreviewed => github-reviewed}/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json (56%) rename advisories/{unreviewed => github-reviewed}/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json (59%) create mode 100644 advisories/github-reviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json delete mode 100644 advisories/unreviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json delete mode 100644 advisories/unreviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json diff --git a/advisories/github-reviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json b/advisories/github-reviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json new file mode 100644 index 00000000000..03a1aba9a34 --- /dev/null +++ b/advisories/github-reviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json @@ -0,0 +1,99 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4qhc-v8r6-8vwm", + "modified": "2023-11-10T00:43:02Z", + "published": "2023-11-09T21:30:39Z", + "aliases": [ + "CVE-2023-5954" + ], + "summary": "HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability", + "details": "HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.13.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.14.0" + }, + { + "fixed": "1.14.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/hashicorp/vault" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.15.0" + }, + { + "fixed": "1.15.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5954" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926" + }, + { + "type": "PACKAGE", + "url": "https://github.com/hashicorp/vault" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-401" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-11-10T00:43:02Z", + "nvd_published_at": "2023-11-09T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json b/advisories/github-reviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json similarity index 61% rename from advisories/unreviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json rename to advisories/github-reviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json index 0bceadbde8d..e9015a2bda3 100644 --- a/advisories/unreviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json +++ b/advisories/github-reviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-5cvx-cwpx-9rjh", - "modified": "2023-11-09T21:30:39Z", + "modified": "2023-11-10T00:42:36Z", "published": "2023-11-09T21:30:39Z", "aliases": [ "CVE-2023-5550" ], + "summary": "Moodle Code Injection vulnerability", "details": "In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.", "severity": [ { @@ -14,17 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.0-rc2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5550" }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/77766f9c8af8fc8d861d7ac09ce4e1f6e72faca7" + }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243452" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=451591" @@ -39,8 +66,8 @@ "CWE-94" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-10T00:42:36Z", "nvd_published_at": "2023-11-09T20:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json b/advisories/github-reviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json similarity index 56% rename from advisories/unreviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json rename to advisories/github-reviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json index d12294f3ebf..535e387b88a 100644 --- a/advisories/unreviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json +++ b/advisories/github-reviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-cwh2-q44x-5w3c", - "modified": "2023-11-09T21:30:39Z", + "modified": "2023-11-10T00:42:08Z", "published": "2023-11-09T21:30:39Z", "aliases": [ "CVE-2023-5548" ], + "summary": "Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability", "details": "Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.", "severity": [ { @@ -14,17 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.0-rc2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5548" }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/7679452caff6faa33f00d3f0589c5190bc01a933" + }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243449" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=451589" @@ -39,8 +66,8 @@ "CWE-349" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-10T00:42:08Z", "nvd_published_at": "2023-11-09T20:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json b/advisories/github-reviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json similarity index 59% rename from advisories/unreviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json rename to advisories/github-reviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json index fadb436109b..f74f3359215 100644 --- a/advisories/unreviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json +++ b/advisories/github-reviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fm5h-58g2-4m3f", - "modified": "2023-11-09T21:30:39Z", + "modified": "2023-11-10T00:42:19Z", "published": "2023-11-09T21:30:39Z", "aliases": [ "CVE-2023-5549" ], + "summary": "Moodle Improper Access Control vulnerability", "details": "Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.", "severity": [ { @@ -14,17 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.0-rc2" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5549" }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/5a765e124c950b1e4313c9bf96ea2dd194f65c75" + }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243451" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "https://moodle.org/mod/forum/discuss.php?d=451590" @@ -39,8 +66,8 @@ "CWE-284" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-10T00:42:19Z", "nvd_published_at": "2023-11-09T20:15:10Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json b/advisories/github-reviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json new file mode 100644 index 00000000000..334ebb4561d --- /dev/null +++ b/advisories/github-reviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jr83-8x65-xcr5", + "modified": "2023-11-10T00:42:49Z", + "published": "2023-11-09T21:30:39Z", + "aliases": [ + "CVE-2023-5551" + ], + "summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability", + "details": "Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.3.0-rc2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5551" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/2bb6c551cf2e7be29857db35388911b8179394b0" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/6de45d2c9f7dd7b24210ab0310c296366a82986a" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/b91feb0b2328cdda2561d68b8dfe2a129190bc85" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243453" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=451592" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79310" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2023-11-10T00:42:49Z", + "nvd_published_at": "2023-11-09T20:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json b/advisories/unreviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json deleted file mode 100644 index 21f31419d54..00000000000 --- a/advisories/unreviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-4qhc-v8r6-8vwm", - "modified": "2023-11-09T21:30:39Z", - "published": "2023-11-09T21:30:39Z", - "aliases": [ - "CVE-2023-5954" - ], - "details": "HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5954" - }, - { - "type": "WEB", - "url": "https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-401" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-11-09T21:15:25Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json b/advisories/unreviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json deleted file mode 100644 index 94081693999..00000000000 --- a/advisories/unreviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-jr83-8x65-xcr5", - "modified": "2023-11-09T21:30:39Z", - "published": "2023-11-09T21:30:39Z", - "aliases": [ - "CVE-2023-5551" - ], - "details": "Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5551" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243453" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=451592" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79310" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2023-11-09T20:15:11Z" - } -} \ No newline at end of file