From bee259b794820039964329f928f26824db041a67 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 20 Feb 2024 23:49:50 +0000
Subject: [PATCH] Publish Advisories

GHSA-r969-783f-6jqr
GHSA-vfph-hjfv-cpv2
GHSA-vp66-gf7w-9m4x
---
 .../GHSA-r969-783f-6jqr.json                  | 31 ++++++++++++++++---
 .../GHSA-vfph-hjfv-cpv2.json                  | 31 ++++++++++++++++---
 .../GHSA-vp66-gf7w-9m4x.json                  | 31 ++++++++++++++++---
 3 files changed, 81 insertions(+), 12 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json (64%)
 rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json (65%)
 rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json (67%)

diff --git a/advisories/unreviewed/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json b/advisories/github-reviewed/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json
similarity index 64%
rename from advisories/unreviewed/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json
rename to advisories/github-reviewed/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json
index 6c8ad64b9d0..25c94cdd81e 100644
--- a/advisories/unreviewed/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json
+++ b/advisories/github-reviewed/2024/02/GHSA-r969-783f-6jqr/GHSA-r969-783f-6jqr.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r969-783f-6jqr",
-  "modified": "2024-02-17T06:30:35Z",
+  "modified": "2024-02-20T23:48:04Z",
   "published": "2024-02-17T06:30:35Z",
   "aliases": [
     "CVE-2024-21499"
   ],
+  "summary": "Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security",
   "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/greenpau/caddy-security"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.1.23"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -32,6 +51,10 @@
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "github.com/greenpau/caddy-security"
     }
   ],
   "database_specific": {
@@ -39,8 +62,8 @@
       "CWE-644"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-20T23:48:04Z",
     "nvd_published_at": "2024-02-17T05:15:10Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json b/advisories/github-reviewed/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json
similarity index 65%
rename from advisories/unreviewed/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json
rename to advisories/github-reviewed/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json
index e8e1377a267..bc983ca9dfd 100644
--- a/advisories/unreviewed/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json
+++ b/advisories/github-reviewed/2024/02/GHSA-vfph-hjfv-cpv2/GHSA-vfph-hjfv-cpv2.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vfph-hjfv-cpv2",
-  "modified": "2024-02-17T06:30:35Z",
+  "modified": "2024-02-20T23:48:22Z",
   "published": "2024-02-17T06:30:35Z",
   "aliases": [
     "CVE-2024-21500"
   ],
+  "summary": "Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security",
   "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA). Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/greenpau/caddy-security"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.1.23"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -32,6 +51,10 @@
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249864"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "github.com/greenpau/caddy-security"
     }
   ],
   "database_specific": {
@@ -39,8 +62,8 @@
       "CWE-307"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-20T23:48:22Z",
     "nvd_published_at": "2024-02-17T05:15:10Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json b/advisories/github-reviewed/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json
similarity index 67%
rename from advisories/unreviewed/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json
rename to advisories/github-reviewed/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json
index 7ce054cae33..70179970488 100644
--- a/advisories/unreviewed/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json
+++ b/advisories/github-reviewed/2024/02/GHSA-vp66-gf7w-9m4x/GHSA-vp66-gf7w-9m4x.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vp66-gf7w-9m4x",
-  "modified": "2024-02-17T06:30:34Z",
+  "modified": "2024-02-20T23:47:50Z",
   "published": "2024-02-17T06:30:34Z",
   "aliases": [
     "CVE-2024-21492"
   ],
+  "summary": "Insufficient Session Expiration in github.com/greenpau/caddy-security",
   "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the \"Sign Out\" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers who gain access to an active but supposedly logged-out session can perform unauthorized actions on behalf of the user.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/greenpau/caddy-security"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.1.23"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -32,6 +51,10 @@
     {
       "type": "WEB",
       "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5920787"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "github.com/greenpau/caddy-security"
     }
   ],
   "database_specific": {
@@ -39,8 +62,8 @@
       "CWE-613"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-20T23:47:50Z",
     "nvd_published_at": "2024-02-17T05:15:08Z"
   }
 }
\ No newline at end of file