diff --git a/advisories/unreviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json b/advisories/github-reviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json rename to advisories/github-reviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json index 1a9726561bf..7906a941910 100644 --- a/advisories/unreviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json +++ b/advisories/github-reviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-98c8-36p9-gw66", - "modified": "2022-05-17T01:57:32Z", + "modified": "2024-05-14T21:19:05Z", "published": "2022-05-17T01:57:31Z", "aliases": [ "CVE-2015-3156" ], - "details": "The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.", + "summary": "Openstack DBaaS (Trove) Improper Link Resolution Before File Access ", + "details": "The `_write_config` function in `trove/guestagent/datastore/experimental/mongodb/service.py`, `reset_configuration` function in `trove/guestagent/datastore/experimental/postgresql/service/config.py`, `write_config` function in `trove/guestagent/datastore/experimental/redis/service.py`, `_write_mycnf` function in `trove/guestagent/datastore/mysql/service.py`, `InnoBackupEx::_run_prepare` function in `trove/guestagent/strategies/restore/mysql_impl.py`, `InnoBackupEx::cmd` function in `trove/guestagent/strategies/backup/mysql_impl.py`,`MySQLDump::cmd` in `trove/guestagent/strategies/backup/mysql_impl.py`, `InnoBackupExIncremental::cmd` function in `trove/guestagent/strategies/backup/mysql_impl.py`, `_get_actual_db_status` function in `trove/guestagent/datastore/experimental/cassandra/system.py` and `trove/guestagent/datastore/experimental/cassandra/service.py`, and multiple class CbBackup methods in `trove/guestagent/strategies/backup/experimental/couchbase_impl.py` in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.", "severity": [ { "type": "CVSS_V3", @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "trove" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3156" }, + { + "type": "WEB", + "url": "https://github.com/openstack/trove/commit/61774984aa2bacfe89867fc39a402a6a4cfb8f33" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/trove/+bug/1398195" @@ -29,6 +52,10 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1216073" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/trove" + }, { "type": "WEB", "url": "https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/service.py#L230" @@ -71,8 +98,8 @@ "CWE-59" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:19:05Z", "nvd_published_at": "2017-08-11T21:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json b/advisories/github-reviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json similarity index 61% rename from advisories/unreviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json rename to advisories/github-reviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json index e3542c8283a..60e4d8be27f 100644 --- a/advisories/unreviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json +++ b/advisories/github-reviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-j772-hpmw-32rm", - "modified": "2022-05-17T01:47:00Z", + "modified": "2024-05-14T21:18:27Z", "published": "2022-05-17T01:47:00Z", "aliases": [ "CVE-2012-2094" ], - "details": "Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.", + "summary": "OpenStack Horizon Cross-site scripting (XSS) vulnerability", + "details": "Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in `horizon/static/horizon/js/horizon.js` in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "horizon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { @@ -22,6 +41,10 @@ "type": "WEB", "url": "https://github.com/openstack/horizon/commit/7f8c788aa70db98ac904f37fa4197fcabb802942" }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/ab2e27522aaeb0268fcc121bd3eff5a4485f313c" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/horizon/+bug/977944" @@ -60,8 +83,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:18:27Z", "nvd_published_at": "2012-06-05T22:55:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json b/advisories/github-reviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json rename to advisories/github-reviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json index 32d4061921c..a673835fe49 100644 --- a/advisories/unreviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json +++ b/advisories/github-reviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json @@ -1,23 +1,54 @@ { "schema_version": "1.4.0", "id": "GHSA-rhjj-f6gq-6gx2", - "modified": "2022-05-17T03:17:25Z", + "modified": "2024-05-14T21:19:10Z", "published": "2022-05-17T03:17:25Z", "aliases": [ "CVE-2015-3219" ], + "summary": "OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability", "details": "Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "horizon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.0.0a0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3219" }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/28d8f49786d6df297b2574514916fa782e941e09" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/84da479739fbfff75d9492d00fd0ed1a31ea52b3" + }, + { + "type": "WEB", + "url": "https://github.com/openstack/horizon/commit/dab92e7d2f576caea8f81c8e22a516fb45633794" + }, { "type": "WEB", "url": "https://bugs.launchpad.net/horizon/+bug/1453074" @@ -52,8 +83,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-05-14T21:19:10Z", "nvd_published_at": "2015-08-20T20:59:00Z" } } \ No newline at end of file