diff --git a/advisories/unreviewed/2022/05/GHSA-8jx9-7j5m-79x4/GHSA-8jx9-7j5m-79x4.json b/advisories/github-reviewed/2022/05/GHSA-8jx9-7j5m-79x4/GHSA-8jx9-7j5m-79x4.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-8jx9-7j5m-79x4/GHSA-8jx9-7j5m-79x4.json rename to advisories/github-reviewed/2022/05/GHSA-8jx9-7j5m-79x4/GHSA-8jx9-7j5m-79x4.json index ceae3147bc4..55095255cba 100644 --- a/advisories/unreviewed/2022/05/GHSA-8jx9-7j5m-79x4/GHSA-8jx9-7j5m-79x4.json +++ b/advisories/github-reviewed/2022/05/GHSA-8jx9-7j5m-79x4/GHSA-8jx9-7j5m-79x4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8jx9-7j5m-79x4", - "modified": "2022-05-13T01:40:54Z", + "modified": "2024-01-30T22:46:28Z", "published": "2022-05-13T01:40:54Z", "aliases": [ "CVE-2017-1000089" ], + "summary": "Jenkins Build Step Plugin fails to check Item/Build permission", "details": "Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:pipeline-build-step" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.5.1" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.5" + } + } ], "references": [ { @@ -31,8 +53,8 @@ "CWE-276" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:46:28Z", "nvd_published_at": "2017-10-05T01:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vcgj-j8c5-2h52/GHSA-vcgj-j8c5-2h52.json b/advisories/github-reviewed/2022/05/GHSA-vcgj-j8c5-2h52/GHSA-vcgj-j8c5-2h52.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-vcgj-j8c5-2h52/GHSA-vcgj-j8c5-2h52.json rename to advisories/github-reviewed/2022/05/GHSA-vcgj-j8c5-2h52/GHSA-vcgj-j8c5-2h52.json index 9b3f604c007..f40872dc32d 100644 --- a/advisories/unreviewed/2022/05/GHSA-vcgj-j8c5-2h52/GHSA-vcgj-j8c5-2h52.json +++ b/advisories/github-reviewed/2022/05/GHSA-vcgj-j8c5-2h52/GHSA-vcgj-j8c5-2h52.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vcgj-j8c5-2h52", - "modified": "2022-05-13T01:36:52Z", + "modified": "2024-01-30T22:46:41Z", "published": "2022-05-13T01:36:52Z", "aliases": [ "CVE-2017-2649" ], + "summary": "Jenkins Active Directory Plugin did not verify certificate of AD server", "details": "It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Directory server, thereby enabling Man-in-the-Middle attacks.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:active-directory" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.2" + } + } ], "references": [ { @@ -35,8 +57,8 @@ "CWE-295" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:46:41Z", "nvd_published_at": "2018-07-27T20:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-x654-4wjh-74q6/GHSA-x654-4wjh-74q6.json b/advisories/github-reviewed/2022/05/GHSA-x654-4wjh-74q6/GHSA-x654-4wjh-74q6.json similarity index 64% rename from advisories/unreviewed/2022/05/GHSA-x654-4wjh-74q6/GHSA-x654-4wjh-74q6.json rename to advisories/github-reviewed/2022/05/GHSA-x654-4wjh-74q6/GHSA-x654-4wjh-74q6.json index 1a1726ef68f..c79315f7806 100644 --- a/advisories/unreviewed/2022/05/GHSA-x654-4wjh-74q6/GHSA-x654-4wjh-74q6.json +++ b/advisories/github-reviewed/2022/05/GHSA-x654-4wjh-74q6/GHSA-x654-4wjh-74q6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-x654-4wjh-74q6", - "modified": "2022-05-13T01:36:51Z", + "modified": "2024-01-30T22:46:58Z", "published": "2022-05-13T01:36:51Z", "aliases": [ "CVE-2017-2648" ], + "summary": "Jenkins SSH Build Agents Plugin did not verify host keys", "details": "It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jenkins-ci.plugins:ssh-slaves" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.15" + } + ] + } + ] + } ], "references": [ { @@ -39,8 +58,8 @@ "CWE-295" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-30T22:46:58Z", "nvd_published_at": "2018-07-27T20:29:00Z" } } \ No newline at end of file