From cd2d4bb60b0974fe0ea3488b2e56ad01829a29e9 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 10 Jun 2024 20:19:08 +0000
Subject: [PATCH] Publish Advisories

GHSA-grv7-fg5c-xmjg
GHSA-wgrm-67xf-hhpq
---
 .../GHSA-grv7-fg5c-xmjg.json                  | 31 ++++++++++++++++---
 .../GHSA-wgrm-67xf-hhpq.json                  | 28 +++++++++++++++--
 2 files changed, 53 insertions(+), 6 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json (73%)

diff --git a/advisories/unreviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json b/advisories/github-reviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json
similarity index 73%
rename from advisories/unreviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json
rename to advisories/github-reviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json
index 9e062e9f09e..450e45ce83c 100644
--- a/advisories/unreviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json
+++ b/advisories/github-reviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-grv7-fg5c-xmjg",
-  "modified": "2024-05-22T12:32:25Z",
+  "modified": "2024-06-10T20:17:26Z",
   "published": "2024-05-14T18:30:54Z",
   "aliases": [
     "CVE-2024-4068"
   ],
+  "summary": "Uncontrolled resource consumption in braces",
   "details": "The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.\n",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "braces"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.0.3"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -41,6 +60,10 @@
       "type": "WEB",
       "url": "https://devhub.checkmarx.com/cve-details/CVE-2024-4068"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/micromatch/braces"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308"
@@ -51,8 +74,8 @@
       "CWE-1050"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-06-10T20:17:26Z",
     "nvd_published_at": "2024-05-14T15:42:48Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json b/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json
index 2180e09a5d3..85e73e00284 100644
--- a/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json
+++ b/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wgrm-67xf-hhpq",
-  "modified": "2024-05-07T10:25:08Z",
+  "modified": "2024-06-10T20:18:18Z",
   "published": "2024-05-07T10:25:08Z",
   "aliases": [
     "CVE-2024-4367"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4367"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/mozilla/pdf.js/pull/18015"
@@ -55,6 +59,26 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/mozilla/pdf.js"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00010.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00012.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/security/advisories/mfsa2024-21"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/security/advisories/mfsa2024-22"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.mozilla.org/security/advisories/mfsa2024-23"
     }
   ],
   "database_specific": {
@@ -64,6 +88,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-05-07T10:25:08Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-05-14T18:15:12Z"
   }
 }
\ No newline at end of file