diff --git a/advisories/github-reviewed/2019/09/GHSA-5m2v-hc64-56h6/GHSA-5m2v-hc64-56h6.json b/advisories/github-reviewed/2019/09/GHSA-5m2v-hc64-56h6/GHSA-5m2v-hc64-56h6.json index 1db572237e3..5404d497ce2 100644 --- a/advisories/github-reviewed/2019/09/GHSA-5m2v-hc64-56h6/GHSA-5m2v-hc64-56h6.json +++ b/advisories/github-reviewed/2019/09/GHSA-5m2v-hc64-56h6/GHSA-5m2v-hc64-56h6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5m2v-hc64-56h6", - "modified": "2023-08-29T15:33:31Z", + "modified": "2023-11-17T22:49:37Z", "published": "2019-09-30T16:05:32Z", "aliases": [ "CVE-2019-16892" @@ -68,6 +68,18 @@ "type": "PACKAGE", "url": "https://github.com/rubyzip/rubyzip" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWWPORMSBHZTMP4PGF4DQD22TTKBQMMC/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X255K6ZBAQC462PQN2ND5HOTTQEJ2G2X/" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J45KSFPP6DFVWLC7Z73L7SX735CKZYO6/" @@ -88,6 +100,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2019-09-30T16:04:36Z", - "nvd_published_at": null + "nvd_published_at": "2019-09-25T22:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json b/advisories/github-reviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json similarity index 50% rename from advisories/unreviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json rename to advisories/github-reviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json index 4ac3bd60afc..f91176e3df6 100644 --- a/advisories/unreviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json +++ b/advisories/github-reviewed/2023/11/GHSA-4qq5-mxxx-m6gg/GHSA-4qq5-mxxx-m6gg.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-4qq5-mxxx-m6gg", - "modified": "2023-11-16T21:30:46Z", + "modified": "2023-11-17T22:49:27Z", "published": "2023-11-16T21:30:46Z", "aliases": [ "CVE-2023-6014" ], - "details": "An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.", + "summary": "MLflow authentication requirement bypass can allow a user to arbitrarily create an account", + "details": "An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.", "severity": [ { "type": "CVSS_V3", @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mlflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.5.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6014" }, + { + "type": "PACKAGE", + "url": "https://github.com/mlflow/mlflow" + }, { "type": "WEB", "url": "https://huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4" @@ -31,8 +54,8 @@ "CWE-598" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-11-17T22:49:27Z", "nvd_published_at": "2023-11-16T21:15:09Z" } } \ No newline at end of file