diff --git a/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json b/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json
index d2981c7b6dd..9e8765268b5 100644
--- a/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json
+++ b/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-62gw-3rmj-wmp2",
- "modified": "2021-09-01T22:36:39Z",
+ "modified": "2025-04-02T22:32:31Z",
"published": "2019-09-13T13:25:47Z",
"aliases": [
"CVE-2019-1301"
],
"summary": "High severity vulnerability that affects System.Management.Automation",
- "details": "## Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in .NET Core\n\n# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=&labels=Issue-Question&template=Support_Question.md&title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## Affected Software\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n| PowerShell Core Version | Fixed in |\n|-------------------------|-------------------|\n| 6.1 | 6.1.6 |\n| 6.2 | 6.2.3 |\n| 7.0 | unaffected |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected. This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)\n\n### Revisions\n\nV1.0 (September 12, 2019): Advisory published.\n\n*Version 1.0*\n*Last Updated 2019-09-12*",
+ "details": "# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=&labels=Issue-Question&template=Support_Question.md&title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## Affected Software\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n\n| PowerShell Core Version | Fixed in |\n|-------------------------|-------------------|\n| 6.1 | 6.1.6 |\n| 6.2 | 6.2.3 |\n| 7.0 | unaffected |\n|5 | unaffected |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected. This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)",
"severity": [
{
"type": "CVSS_V3",
@@ -44,7 +44,7 @@
"type": "ECOSYSTEM",
"events": [
{
- "introduced": "0"
+ "introduced": "6.0.0"
},
{
"fixed": "6.1.6"
@@ -63,6 +63,10 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1301"
},
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/PowerShell/PowerShell"
+ },
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-62gw-3rmj-wmp2"
diff --git a/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json b/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json
index a78944ebd7d..33769cfeaf7 100644
--- a/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json
+++ b/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json
@@ -50,7 +50,9 @@
}
],
"database_specific": {
- "cwe_ids": [],
+ "cwe_ids": [
+ "CWE-284"
+ ],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-01-27T01:02:39Z",
diff --git a/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json b/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json
index 085c3447ec6..023677a5d74 100644
--- a/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json
+++ b/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3mpg-q26j-83j5",
- "modified": "2023-01-31T01:41:32Z",
+ "modified": "2025-04-02T22:31:52Z",
"published": "2023-01-21T03:30:28Z",
"aliases": [
"CVE-2020-36655"