diff --git a/advisories/github-reviewed/2024/02/GHSA-3v79-q7ph-j75h/GHSA-3v79-q7ph-j75h.json b/advisories/github-reviewed/2024/02/GHSA-3v79-q7ph-j75h/GHSA-3v79-q7ph-j75h.json index e9679783d92..cbaf7f2782a 100644 --- a/advisories/github-reviewed/2024/02/GHSA-3v79-q7ph-j75h/GHSA-3v79-q7ph-j75h.json +++ b/advisories/github-reviewed/2024/02/GHSA-3v79-q7ph-j75h/GHSA-3v79-q7ph-j75h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3v79-q7ph-j75h", - "modified": "2024-08-06T23:39:53Z", + "modified": "2025-01-22T17:33:18Z", "published": "2024-02-24T00:30:20Z", "aliases": [ "CVE-2024-27133" @@ -11,7 +11,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], "affected": [ @@ -65,7 +65,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-02-27T21:57:34Z", "nvd_published_at": "2024-02-23T22:15:55Z" diff --git a/advisories/github-reviewed/2024/02/GHSA-6749-m5cp-6cg7/GHSA-6749-m5cp-6cg7.json b/advisories/github-reviewed/2024/02/GHSA-6749-m5cp-6cg7/GHSA-6749-m5cp-6cg7.json index ff16b6fbcf7..088adaecde3 100644 --- a/advisories/github-reviewed/2024/02/GHSA-6749-m5cp-6cg7/GHSA-6749-m5cp-6cg7.json +++ b/advisories/github-reviewed/2024/02/GHSA-6749-m5cp-6cg7/GHSA-6749-m5cp-6cg7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6749-m5cp-6cg7", - "modified": "2024-02-26T20:07:33Z", + "modified": "2025-01-22T17:33:34Z", "published": "2024-02-24T00:30:20Z", "aliases": [ "CVE-2024-27132" @@ -11,7 +11,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" } ], "affected": [ @@ -57,7 +57,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-02-26T20:07:33Z", "nvd_published_at": "2024-02-23T22:15:55Z" diff --git a/advisories/github-reviewed/2024/09/GHSA-cxww-7g56-2vh6/GHSA-cxww-7g56-2vh6.json b/advisories/github-reviewed/2024/09/GHSA-cxww-7g56-2vh6/GHSA-cxww-7g56-2vh6.json index 458792f1b90..d3896cc4414 100644 --- a/advisories/github-reviewed/2024/09/GHSA-cxww-7g56-2vh6/GHSA-cxww-7g56-2vh6.json +++ b/advisories/github-reviewed/2024/09/GHSA-cxww-7g56-2vh6/GHSA-cxww-7g56-2vh6.json @@ -1,11 +1,11 @@ { "schema_version": "1.4.0", "id": "GHSA-cxww-7g56-2vh6", - "modified": "2024-09-04T18:08:32Z", + "modified": "2025-01-22T17:31:55Z", "published": "2024-09-03T20:55:34Z", "aliases": [], "summary": "@actions/download-artifact has an Arbitrary File Write via artifact extraction", - "details": "### Impact\n\nVersions of `actions/download-artifact` before 4.1.7 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.\n\n### Patches\n\nUpgrade to version 4.1.7 or higher. Alternatively use 'v4' tag which points to the latest and secure version.\n\n### References\n\n- https://snyk.io/research/zip-slip-vulnerability\n- https://github.com/actions/download-artifact/releases/tag/v4.1.7\n\n### CVE\n\nCVE-2024-42471\n\n### Credits\n\nJustin Taft from Google", + "details": "### Impact\n\nVersions of `actions/download-artifact` before 4.1.3 are vulnerable to arbitrary file write when downloading and extracting a specifically crafted artifact that contains path traversal filenames.\n\n### Patches\n\nUpgrade to version 4.1.3 or higher. Alternatively use 'v4' tag which points to the latest and secure version.\n\n### References\n\n- https://snyk.io/research/zip-slip-vulnerability\n- https://github.com/actions/download-artifact/releases/tag/v4.1.3\n- https://github.com/actions/download-artifact/pull/299\n\n### CVE\n\nCVE-2024-42471\n\n### Credits\n\nJustin Taft from Google", "severity": [ { "type": "CVSS_V3", @@ -30,7 +30,7 @@ "introduced": "4.0.0" }, { - "fixed": "4.1.7" + "fixed": "4.1.3" } ] } @@ -48,7 +48,7 @@ }, { "type": "WEB", - "url": "https://github.com/actions/download-artifact/releases/tag/v4.1.7" + "url": "https://github.com/actions/download-artifact/releases/tag/v4.1.3" }, { "type": "ADVISORY",