diff --git a/advisories/github-reviewed/2023/12/GHSA-9759-3276-g2pm/GHSA-9759-3276-g2pm.json b/advisories/github-reviewed/2023/12/GHSA-9759-3276-g2pm/GHSA-9759-3276-g2pm.json index 7ec12d75f73..b33e3d6b80e 100644 --- a/advisories/github-reviewed/2023/12/GHSA-9759-3276-g2pm/GHSA-9759-3276-g2pm.json +++ b/advisories/github-reviewed/2023/12/GHSA-9759-3276-g2pm/GHSA-9759-3276-g2pm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-9759-3276-g2pm", - "modified": "2023-12-13T23:15:56Z", + "modified": "2023-12-14T21:18:57Z", "published": "2023-12-13T23:15:56Z", "aliases": [ "CVE-2023-50709" ], "summary": "Denial of service attack on the cube-api endpoint", - "details": "### Impact\nIt is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.\n\n### Patches\nThe issue has been patched in the `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.\n\n### Workarounds\nThere are currently no workaround for older versions, and the recommendation is to upgrade.\n\n### References\nThe issue was reported by an independent researcher in our Community Slack and has been promptly patched in the recent update.", + "details": "### Impact\nIt is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.\n\n### Patches\nThe issue has been patched in the `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.\n\n### Workarounds\nThere are currently no workaround for older versions, and the recommendation is to upgrade.\n\n### References\nThe issue was reported by [y0d3n](https://github.com/y0d3n) in our Community Slack and has been promptly patched in the recent update.", "severity": [ { "type": "CVSS_V3", @@ -40,18 +40,26 @@ "type": "WEB", "url": "https://github.com/cube-js/cube/security/advisories/GHSA-9759-3276-g2pm" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50709" + }, { "type": "PACKAGE", "url": "https://github.com/cube-js/cube" + }, + { + "type": "WEB", + "url": "https://github.com/cube-js/cube/releases/tag/v0.34.34" } ], "database_specific": { "cwe_ids": [ - + "CWE-20" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-12-13T23:15:56Z", - "nvd_published_at": null + "nvd_published_at": "2023-12-13T22:15:43Z" } } \ No newline at end of file