From ca481b6c2feacf56c112522092ab04aaa2ffcb4a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 25 Apr 2024 22:11:12 +0000
Subject: [PATCH] Publish Advisories

GHSA-c36v-fmgq-m8hx
GHSA-2r5h-6r7v-5m7c
GHSA-5c58-w9xc-qcj9
GHSA-2r5h-6r7v-5m7c
GHSA-5c58-w9xc-qcj9
---
 .../GHSA-c36v-fmgq-m8hx.json                  |   4 +-
 .../GHSA-2r5h-6r7v-5m7c.json                  |  97 ++++++++++
 .../GHSA-5c58-w9xc-qcj9.json                  | 181 ++++++++++++++++++
 .../GHSA-2r5h-6r7v-5m7c.json                  |  47 -----
 .../GHSA-5c58-w9xc-qcj9.json                  |  47 -----
 5 files changed, 280 insertions(+), 96 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json

diff --git a/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json b/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json
index b38f299b594..c03e42b1587 100644
--- a/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json
+++ b/advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-c36v-fmgq-m8hx",
-  "modified": "2022-09-11T22:24:21Z",
+  "modified": "2024-04-25T22:09:12Z",
   "published": "2021-09-07T22:57:14Z",
   "aliases": [
     "CVE-2021-3757"
@@ -25,7 +25,7 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "0"
+              "introduced": "7.0.0"
             },
             {
               "fixed": "9.0.6"
diff --git a/advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json b/advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
new file mode 100644
index 00000000000..b75164990c5
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
@@ -0,0 +1,97 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2r5h-6r7v-5m7c",
+  "modified": "2024-04-25T22:09:29Z",
+  "published": "2022-05-17T01:36:50Z",
+  "aliases": [
+    "CVE-2013-1348"
+  ],
+  "summary": "Symphony Vulnerable to PHP Code Injection via YAML Parsing",
+  "details": "The `Yaml::parse` function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/symfony"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.0.22"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/yaml"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.0.22"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1348"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/symfony/symfony/commit/ac756bf39e646b4e130fad058d10a0228dbd9779"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81550"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-1348.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2013-1348.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/symfony/symfony"
+    },
+    {
+      "type": "WEB",
+      "url": "https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20150612022223/http://www.securityfocus.com/bid/57574"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T22:09:29Z",
+    "nvd_published_at": "2014-06-02T15:55:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json b/advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
new file mode 100644
index 00000000000..78dec3228ba
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
@@ -0,0 +1,181 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5c58-w9xc-qcj9",
+  "modified": "2024-04-25T22:09:04Z",
+  "published": "2022-05-17T03:34:11Z",
+  "aliases": [
+    "CVE-2015-2308"
+  ],
+  "summary": "Symfony Vulnerable to PHP Eval Injection",
+  "details": "Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using the Symfony built-in reverse proxy (the `Symfony\\Component\\HttpKernel\\HttpCache class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.\n\nHttpCache uses eval() to execute files in its cache when they contain ESI tags (and only when ESI is enabled). The vulnerability comes from the fact that PHP allows contents of <script language=\"php\"> tags to be executed (and this kind of PHP tags is always available regardless of the configuration), but there were not escaped before the evaluation.\n\nA possible exploit comes from websites also vulnerable to Cross-Site Scripting as an attacker can successfully conduct a PHP code injection attack by passing such a tag in a user submitted variable (for which proper output escaping was not applied).",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/symfony"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.3.27"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/symfony"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.5.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/symfony"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.6.0"
+            },
+            {
+              "fixed": "2.6.6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/http-kernel"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.3.27"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/http-kernel"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.5.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "symfony/http-kernel"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.6.0"
+            },
+            {
+              "fixed": "2.6.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2308"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/symfony/symfony/pull/14167/commits/195c57e1f50765aff33137689b16e126a689056a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-2308.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-2308.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/symfony/symfony"
+    },
+    {
+      "type": "WEB",
+      "url": "https://symfony.com/blog/cve-2015-2308-esi-code-injection"
+    },
+    {
+      "type": "WEB",
+      "url": "https://symfony.com/cve-2015-2308"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20200228084751/http://www.securityfocus.com/bid/75357"
+    },
+    {
+      "type": "WEB",
+      "url": "http://jvn.jp/en/jp/JVN19578958/index.html"
+    },
+    {
+      "type": "WEB",
+      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-04-25T22:09:04Z",
+    "nvd_published_at": "2015-06-24T10:59:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json b/advisories/unreviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
deleted file mode 100644
index ab85e2cb4d5..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-2r5h-6r7v-5m7c",
-  "modified": "2022-05-17T01:36:50Z",
-  "published": "2022-05-17T01:36:50Z",
-  "aliases": [
-    "CVE-2013-1348"
-  ],
-  "details": "The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1348"
-    },
-    {
-      "type": "WEB",
-      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81550"
-    },
-    {
-      "type": "WEB",
-      "url": "http://secunia.com/advisories/51980"
-    },
-    {
-      "type": "WEB",
-      "url": "http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/57574"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-94"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2014-06-02T15:55:00Z"
-  }
-}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json b/advisories/unreviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
deleted file mode 100644
index 23fc34ad53c..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-5c58-w9xc-qcj9",
-  "modified": "2022-05-17T03:34:11Z",
-  "published": "2022-05-17T03:34:11Z",
-  "aliases": [
-    "CVE-2015-2308"
-  ],
-  "details": "Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language=\"php\" attribute of a SCRIPT element.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2308"
-    },
-    {
-      "type": "WEB",
-      "url": "https://symfony.com/blog/cve-2015-2308-esi-code-injection"
-    },
-    {
-      "type": "WEB",
-      "url": "http://jvn.jp/en/jp/JVN19578958/index.html"
-    },
-    {
-      "type": "WEB",
-      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.securityfocus.com/bid/75357"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-94"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2015-06-24T10:59:00Z"
-  }
-}
\ No newline at end of file