diff --git a/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json b/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json index d2981c7b6dd..9e8765268b5 100644 --- a/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json +++ b/advisories/github-reviewed/2019/09/GHSA-62gw-3rmj-wmp2/GHSA-62gw-3rmj-wmp2.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-62gw-3rmj-wmp2", - "modified": "2021-09-01T22:36:39Z", + "modified": "2025-04-02T22:32:31Z", "published": "2019-09-13T13:25:47Z", "aliases": [ "CVE-2019-1301" ], "summary": "High severity vulnerability that affects System.Management.Automation", - "details": "## Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in .NET Core\n\n# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=&labels=Issue-Question&template=Support_Question.md&title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## Affected Software\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n| PowerShell Core Version | Fixed in |\n|-------------------------|-------------------|\n| 6.1 | 6.1.6 |\n| 6.2 | 6.2.3 |\n| 7.0 | unaffected |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected. This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)\n\n### Revisions\n\nV1.0 (September 12, 2019): Advisory published.\n\n*Version 1.0*\n*Last Updated 2019-09-12*", + "details": "# Microsoft Security Advisory CVE-2019-1301: Denial of Service Vulnerability in PowerShell Core\n\n## Executive Summary\n\nA denial of service vulnerability exists when PowerShell Core or .NET Core improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a PowerShell Core scripts.\n\nThe update addresses the vulnerability by correcting how the .NET Core handles web requests.\n\nSystem administrators are advised to update PowerShell Core to an unaffected version (see [affected software](#user-content-affected-software).)\n\n\n## Discussion\n\nPlease [open a support question](https://github.com/PowerShell/PowerShell/issues/new?assignees=&labels=Issue-Question&template=Support_Question.md&title=Support+Question) to discussion the PowerShell aspects of this advisory.\nPlease use dotnet/announcements#121 for discussion of the .NET aspects this advisory.\n\n## Affected Software\n\nThe vulnerability affects PowerShell Core prior to the following versions:\n\n\n| PowerShell Core Version | Fixed in |\n|-------------------------|-------------------|\n| 6.1 | 6.1.6 |\n| 6.2 | 6.2.3 |\n| 7.0 | unaffected |\n|5 | unaffected |\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nIf all of the following are true:\n\n1. Run `pwsh -v`, then, check the version in the table in [Affected Software](#user-content-affected-software) to see if your version of PowerShell Core is affected.\n1. If you are running a version of PowerShell Core where the executable is not `pwsh` or `pwsh.exe`, then you are affected. This only existed for preview version of `6.0`.\n\n### How do I update to an unaffected version?\n\nFollow the instructions at [Installing PowerShell Core](https://docs.microsoft.com/en-us/powershell/scripting/setup/installing-powershell?view=powershell-6) to install the latest version of PowerShell Core.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in PowerShell Core,\nplease email details to secure@microsoft.com.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the PowerShell organization.\nThis is located at https://github.com/PowerShell/.\nThe Announcements repo (https://github.com/PowerShell/Announcements)\nwill contain this bulletin as an issue and will include a link to a discussion issue where you can ask questions.\n\n### What if the update breaks my script or module?\n\nYou can uninstall the newer version of PowerShell Core and install the previous version of PowerShell Core.\nThis should be treated as a temporary measure.\nTherefore, the script or module should be updated to work with the patched version of PowerShell Core.\n\n### Acknowledgments\n\nPaul Ryman of VMware Sydney Engineering Team\n\nMicrosoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure.\n\nSee [acknowledgments](https://portal.msrc.microsoft.com/en-us/security-guidance/acknowledgments) for more information.\n\n### External Links\n\n[CVE-2019-1301](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1301)", "severity": [ { "type": "CVSS_V3", @@ -44,7 +44,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "6.0.0" }, { "fixed": "6.1.6" @@ -63,6 +63,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1301" }, + { + "type": "PACKAGE", + "url": "https://github.com/PowerShell/PowerShell" + }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-62gw-3rmj-wmp2" diff --git a/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json b/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json index a78944ebd7d..33769cfeaf7 100644 --- a/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json +++ b/advisories/github-reviewed/2023/01/GHSA-2jpx-h8j2-g8m4/GHSA-2jpx-h8j2-g8m4.json @@ -50,7 +50,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-284" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-01-27T01:02:39Z", diff --git a/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json b/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json index 085c3447ec6..023677a5d74 100644 --- a/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json +++ b/advisories/github-reviewed/2023/01/GHSA-3mpg-q26j-83j5/GHSA-3mpg-q26j-83j5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3mpg-q26j-83j5", - "modified": "2023-01-31T01:41:32Z", + "modified": "2025-04-02T22:31:52Z", "published": "2023-01-21T03:30:28Z", "aliases": [ "CVE-2020-36655"