Publish Advisories

GHSA-pchp-c5w8-47gc
GHSA-gvhp-v4m2-3rwf
GHSA-wmq3-24jm-m8xh

advisories/github-reviewed/2022/04/GHSA-pchp-c5w8-47gc/GHSA-pchp-c5w8-47gc.json

@@ -1,17 +1,58 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-pchp-c5w8-47gc",
-  "modified": "2022-04-23T00:40:48Z",
+  "modified": "2024-01-30T21:09:35Z",
   "published": "2022-04-23T00:40:48Z",
   "aliases": [
     "CVE-2012-0785"
   ],
+  "summary": "Hash collision attack vulnerability in Jenkins",
   "details": "Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka \"the Hash DoS attack.\"",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.main:jenkins-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "1.425"
+            },
+            {
+              "fixed": "1.447"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.main:jenkins-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.424.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -44,8 +85,8 @@
 
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T21:09:35Z",
     "nvd_published_at": "2020-02-24T17:15:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-gvhp-v4m2-3rwf/GHSA-gvhp-v4m2-3rwf.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gvhp-v4m2-3rwf",
-  "modified": "2022-05-13T01:15:02Z",
+  "modified": "2024-01-30T21:09:20Z",
   "published": "2022-05-13T01:15:02Z",
   "aliases": [
     "CVE-2019-10277"
   ],
+  "summary": "Jenkins StarTeam Plugin stores credentials in plain text ",
   "details": "Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "hudson.plugins:starteam"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.6.13"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -39,8 +58,8 @@
       "CWE-522"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T21:09:20Z",
     "nvd_published_at": "2019-04-04T16:29:00Z"
   }
 }

advisories/github-reviewed/2022/05/GHSA-wmq3-24jm-m8xh/GHSA-wmq3-24jm-m8xh.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wmq3-24jm-m8xh",
-  "modified": "2022-05-13T01:15:01Z",
+  "modified": "2024-01-30T21:09:04Z",
   "published": "2022-05-13T01:15:01Z",
   "aliases": [
     "CVE-2019-10280"
   ],
+  "summary": "Jenkins Assembla Auth Plugin stores credentials in plain text ",
   "details": "Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.",
   "severity": [
     {
@@ -14,7 +15,28 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.jenkins-ci.plugins:assembla-auth"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.13"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.11"
+      }
+    }
   ],
   "references": [
     {
@@ -39,8 +61,8 @@
       "CWE-522"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T21:09:04Z",
     "nvd_published_at": "2019-04-04T16:29:00Z"
   }
 }