diff --git a/advisories/github-reviewed/2022/05/GHSA-hw4g-fhcp-x5mq/GHSA-hw4g-fhcp-x5mq.json b/advisories/github-reviewed/2022/05/GHSA-hw4g-fhcp-x5mq/GHSA-hw4g-fhcp-x5mq.json index 5b316501c63..8771db01c57 100644 --- a/advisories/github-reviewed/2022/05/GHSA-hw4g-fhcp-x5mq/GHSA-hw4g-fhcp-x5mq.json +++ b/advisories/github-reviewed/2022/05/GHSA-hw4g-fhcp-x5mq/GHSA-hw4g-fhcp-x5mq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hw4g-fhcp-x5mq", - "modified": "2022-07-08T18:48:45Z", + "modified": "2024-10-21T20:26:55Z", "published": "2022-05-17T05:47:39Z", "aliases": [ "CVE-2010-3494" @@ -9,7 +9,14 @@ "summary": "Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib", "details": "Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -45,6 +52,10 @@ "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-hw4g-fhcp-x5mq" }, + { + "type": "PACKAGE", + "url": "https://github.com/giampaolo/pyftpdlib" + }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyftpdlib/PYSEC-2010-11.yaml" @@ -94,7 +105,7 @@ "cwe_ids": [ "CWE-362" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2022-07-08T18:48:45Z", "nvd_published_at": "2010-10-19T20:00:00Z" diff --git a/advisories/github-reviewed/2022/05/GHSA-x377-f64p-hf5j/GHSA-x377-f64p-hf5j.json b/advisories/github-reviewed/2022/05/GHSA-x377-f64p-hf5j/GHSA-x377-f64p-hf5j.json index 54292248e2a..7b6e77f81b6 100644 --- a/advisories/github-reviewed/2022/05/GHSA-x377-f64p-hf5j/GHSA-x377-f64p-hf5j.json +++ b/advisories/github-reviewed/2022/05/GHSA-x377-f64p-hf5j/GHSA-x377-f64p-hf5j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x377-f64p-hf5j", - "modified": "2024-04-22T22:55:06Z", + "modified": "2024-10-21T20:27:56Z", "published": "2022-05-17T04:59:18Z", "aliases": [ "CVE-2013-1445" @@ -9,7 +9,14 @@ "summary": "PyCrypto does not properly reseed PRNG before allowing access", "details": "The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -45,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/pycrypto/pycrypto" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pycrypto/PYSEC-2013-29.yaml" + }, { "type": "WEB", "url": "http://www.debian.org/security/2013/dsa-2781" @@ -58,7 +69,7 @@ "cwe_ids": [ "CWE-332" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-04-22T22:55:06Z", "nvd_published_at": "2013-10-26T17:55:00Z"