netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6q32-hq47-5qq3
GHSA-cxww-7g56-2vh6
This commit is contained in:
advisory-database[bot]
2024-09-04 18:10:50 +00:00
parent 3c73b2a6c2
commit bd23fc4ccc
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/09/GHSA-6q32-hq47-5qq3/GHSA-6q32-hq47-5qq3.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6q32-hq47-5qq3",
"modified": "2024-09-04T14:00:04Z",
"modified": "2024-09-04T18:08:34Z",
"published": "2024-09-03T20:08:30Z",
"aliases": [
"CVE-2024-42471"
@@ -29,7 +29,7 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.1"
"introduced": "2.0.0"
},
{
"fixed": "2.1.7"
advisories/github-reviewed/2024/09/GHSA-cxww-7g56-2vh6/GHSA-cxww-7g56-2vh6.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cxww-7g56-2vh6",
"modified": "2024-09-04T14:43:19Z",
"modified": "2024-09-04T18:08:32Z",
"published": "2024-09-03T20:55:34Z",
"aliases": [
],
"summary": "@actions/download-artifact has an Arbitrary File Write via artifact extraction",
"details": "### Impact\n\nVersions of `actions/download-artifact` starting in 4.0.0 and before 4.1.7 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.\n\n### Patches\n\nUpgrade to version 4.1.7 or higher. Alternatively use 'v4' tag which points to the latest and secure version.\n\n### References\n\n- https://snyk.io/research/zip-slip-vulnerability\n- https://github.com/actions/download-artifact/releases/tag/v4.1.7\n\n### CVE\n\nCVE-2024-42471\n\n### Credits\n\nJustin Taft from Google",
"details": "### Impact\n\nVersions of `actions/download-artifact` before 4.1.7 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.\n\n### Patches\n\nUpgrade to version 4.1.7 or higher. Alternatively use 'v4' tag which points to the latest and secure version.\n\n### References\n\n- https://snyk.io/research/zip-slip-vulnerability\n- https://github.com/actions/download-artifact/releases/tag/v4.1.7\n\n### CVE\n\nCVE-2024-42471\n\n### Credits\n\nJustin Taft from Google",
"severity": [
{
"type": "CVSS_V3",