diff --git a/advisories/unreviewed/2024/11/GHSA-x4x5-jx9j-mmv7/GHSA-x4x5-jx9j-mmv7.json b/advisories/github-reviewed/2024/11/GHSA-x4x5-jx9j-mmv7/GHSA-x4x5-jx9j-mmv7.json similarity index 59% rename from advisories/unreviewed/2024/11/GHSA-x4x5-jx9j-mmv7/GHSA-x4x5-jx9j-mmv7.json rename to advisories/github-reviewed/2024/11/GHSA-x4x5-jx9j-mmv7/GHSA-x4x5-jx9j-mmv7.json index 93fd8804434..e85d3677961 100644 --- a/advisories/unreviewed/2024/11/GHSA-x4x5-jx9j-mmv7/GHSA-x4x5-jx9j-mmv7.json +++ b/advisories/github-reviewed/2024/11/GHSA-x4x5-jx9j-mmv7/GHSA-x4x5-jx9j-mmv7.json @@ -1,19 +1,44 @@ { "schema_version": "1.4.0", "id": "GHSA-x4x5-jx9j-mmv7", - "modified": "2024-11-29T15:37:53Z", + "modified": "2024-12-02T21:35:15Z", "published": "2024-11-29T06:35:29Z", "aliases": [ "CVE-2024-39162" ], + "summary": "pyspider Cross-site Scripting vulnerability", "details": "pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pyspider" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.3.10" + } + ] + } + ] } ], - "affected": [], "references": [ { "type": "ADVISORY", @@ -24,7 +49,7 @@ "url": "https://docs.pyspider.org/en/latest" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/binux/pyspider" }, { @@ -37,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-12-02T21:35:15Z", "nvd_published_at": "2024-11-29T06:15:06Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-x3f4-45xf-rjm7/GHSA-x3f4-45xf-rjm7.json b/advisories/github-reviewed/2024/12/GHSA-x3f4-45xf-rjm7/GHSA-x3f4-45xf-rjm7.json new file mode 100644 index 00000000000..2d85708c1c0 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-x3f4-45xf-rjm7/GHSA-x3f4-45xf-rjm7.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3f4-45xf-rjm7", + "modified": "2024-12-02T21:34:27Z", + "published": "2024-12-02T21:34:27Z", + "aliases": [], + "summary": "`ruzstd` uninit and out-of-bounds memory reads", + "details": "Affected versions of `ruzstd` miscalculate the length of the allocated and init section of its internal `RingBuffer`, leading to uninitialized or out-of-bounds reads in `copy_bytes_overshooting` of up to 15 bytes.\n\nThis may result in up to 15 bytes of memory contents being written into the decoded data when decompressing a crafted archive. This may occur multiple times per archive.\n", + "severity": [], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "ruzstd" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.7.0" + }, + { + "fixed": "0.7.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/KillingSpark/zstd-rs/issues/75" + }, + { + "type": "WEB", + "url": "https://github.com/KillingSpark/zstd-rs/pull/76" + }, + { + "type": "PACKAGE", + "url": "https://github.com/KillingSpark/zstd-rs" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0400.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-02T21:34:27Z", + "nvd_published_at": null + } +} \ No newline at end of file