From d7ba2ceb7b33d2cb0a3820b2a48b799332123423 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 22 Jan 2025 18:46:07 +0000 Subject: [PATCH] Publish Advisories GHSA-h8wv-9h96-m4hr GHSA-pr2m-px7j-xg65 GHSA-wgrm-67xf-hhpq GHSA-6q32-hq47-5qq3 GHSA-9m5p-c77c-f9j7 GHSA-h78m-j95m-5356 --- .../GHSA-h8wv-9h96-m4hr/GHSA-h8wv-9h96-m4hr.json | 6 +++++- .../GHSA-pr2m-px7j-xg65/GHSA-pr2m-px7j-xg65.json | 6 +++++- .../GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json | 13 +++++++++++-- .../GHSA-6q32-hq47-5qq3/GHSA-6q32-hq47-5qq3.json | 6 +++++- .../GHSA-9m5p-c77c-f9j7/GHSA-9m5p-c77c-f9j7.json | 16 +++++++++++++--- .../GHSA-h78m-j95m-5356/GHSA-h78m-j95m-5356.json | 12 +++++++++--- 6 files changed, 48 insertions(+), 11 deletions(-) diff --git a/advisories/github-reviewed/2024/02/GHSA-h8wv-9h96-m4hr/GHSA-h8wv-9h96-m4hr.json b/advisories/github-reviewed/2024/02/GHSA-h8wv-9h96-m4hr/GHSA-h8wv-9h96-m4hr.json index d7594e960bd..cdc2ab01b75 100644 --- a/advisories/github-reviewed/2024/02/GHSA-h8wv-9h96-m4hr/GHSA-h8wv-9h96-m4hr.json +++ b/advisories/github-reviewed/2024/02/GHSA-h8wv-9h96-m4hr/GHSA-h8wv-9h96-m4hr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h8wv-9h96-m4hr", - "modified": "2024-04-24T14:38:06Z", + "modified": "2025-01-22T18:45:14Z", "published": "2024-02-23T18:30:59Z", "aliases": [ "CVE-2024-27319" @@ -51,6 +51,10 @@ "type": "PACKAGE", "url": "https://github.com/onnx/onnx" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-223.yaml" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY" diff --git a/advisories/github-reviewed/2024/03/GHSA-pr2m-px7j-xg65/GHSA-pr2m-px7j-xg65.json b/advisories/github-reviewed/2024/03/GHSA-pr2m-px7j-xg65/GHSA-pr2m-px7j-xg65.json index 9e7b2d5f0dc..e03b9358fbd 100644 --- a/advisories/github-reviewed/2024/03/GHSA-pr2m-px7j-xg65/GHSA-pr2m-px7j-xg65.json +++ b/advisories/github-reviewed/2024/03/GHSA-pr2m-px7j-xg65/GHSA-pr2m-px7j-xg65.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pr2m-px7j-xg65", - "modified": "2024-03-13T15:33:15Z", + "modified": "2025-01-22T18:45:42Z", "published": "2024-03-13T15:33:14Z", "aliases": [ "CVE-2024-27305" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/aio-libs/aiosmtpd" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/aiosmtpd/PYSEC-2024-221.yaml" + }, { "type": "WEB", "url": "https://www.postfix.org/smtp-smuggling.html" diff --git a/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json b/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json index 13e50201e62..02c9ea2d1f2 100644 --- a/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json +++ b/advisories/github-reviewed/2024/05/GHSA-wgrm-67xf-hhpq/GHSA-wgrm-67xf-hhpq.json @@ -1,14 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-wgrm-67xf-hhpq", - "modified": "2024-06-10T20:18:18Z", + "modified": "2025-01-22T18:45:03Z", "published": "2024-05-07T10:25:08Z", "aliases": [ "CVE-2024-4367" ], "summary": "PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF", "details": "### Impact\nIf pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.\n\n### Patches\nThe patch removes the use of `eval`:\nhttps://github.com/mozilla/pdf.js/pull/18015\n\n### Workarounds\nSet the option `isEvalSupported` to `false`. \n\n### References\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1893645", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [ { "package": { @@ -77,6 +82,10 @@ { "type": "WEB", "url": "https://www.mozilla.org/security/advisories/mfsa2024-23" + }, + { + "type": "WEB", + "url": "http://seclists.org/fulldisclosure/2024/Aug/30" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/09/GHSA-6q32-hq47-5qq3/GHSA-6q32-hq47-5qq3.json b/advisories/github-reviewed/2024/09/GHSA-6q32-hq47-5qq3/GHSA-6q32-hq47-5qq3.json index e3f0aaddc54..8cb20bcae84 100644 --- a/advisories/github-reviewed/2024/09/GHSA-6q32-hq47-5qq3/GHSA-6q32-hq47-5qq3.json +++ b/advisories/github-reviewed/2024/09/GHSA-6q32-hq47-5qq3/GHSA-6q32-hq47-5qq3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6q32-hq47-5qq3", - "modified": "2025-01-22T17:30:37Z", + "modified": "2025-01-22T18:44:59Z", "published": "2024-09-03T20:08:30Z", "aliases": [ "CVE-2024-42471" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/actions/toolkit/pull/1602" }, + { + "type": "WEB", + "url": "https://github.com/actions/toolkit/pull/1666" + }, { "type": "WEB", "url": "https://github.com/actions/toolkit/pull/1724" diff --git a/advisories/github-reviewed/2025/01/GHSA-9m5p-c77c-f9j7/GHSA-9m5p-c77c-f9j7.json b/advisories/github-reviewed/2025/01/GHSA-9m5p-c77c-f9j7/GHSA-9m5p-c77c-f9j7.json index 189d4a2598d..503de47611c 100644 --- a/advisories/github-reviewed/2025/01/GHSA-9m5p-c77c-f9j7/GHSA-9m5p-c77c-f9j7.json +++ b/advisories/github-reviewed/2025/01/GHSA-9m5p-c77c-f9j7/GHSA-9m5p-c77c-f9j7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9m5p-c77c-f9j7", - "modified": "2025-01-22T18:08:13Z", + "modified": "2025-01-22T18:44:35Z", "published": "2025-01-22T18:08:13Z", "aliases": [ "CVE-2025-23028" @@ -78,6 +78,14 @@ "type": "WEB", "url": "https://github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23028" + }, + { + "type": "WEB", + "url": "https://github.com/cilium/cilium/pull/36252" + }, { "type": "WEB", "url": "https://github.com/cilium/cilium/commit/1971bc684b6b36703ebae0dd7539c623f988a257" @@ -92,10 +100,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-770" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-22T18:08:13Z", - "nvd_published_at": null + "nvd_published_at": "2025-01-22T17:15:13Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-h78m-j95m-5356/GHSA-h78m-j95m-5356.json b/advisories/github-reviewed/2025/01/GHSA-h78m-j95m-5356/GHSA-h78m-j95m-5356.json index 461d56a3edf..d293eab25af 100644 --- a/advisories/github-reviewed/2025/01/GHSA-h78m-j95m-5356/GHSA-h78m-j95m-5356.json +++ b/advisories/github-reviewed/2025/01/GHSA-h78m-j95m-5356/GHSA-h78m-j95m-5356.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h78m-j95m-5356", - "modified": "2025-01-22T18:09:27Z", + "modified": "2025-01-22T18:44:37Z", "published": "2025-01-22T18:09:27Z", "aliases": [ "CVE-2025-23047" @@ -78,6 +78,10 @@ "type": "WEB", "url": "https://github.com/cilium/cilium/security/advisories/GHSA-h78m-j95m-5356" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23047" + }, { "type": "WEB", "url": "https://github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d" @@ -88,10 +92,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-200" + ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2025-01-22T18:09:27Z", - "nvd_published_at": null + "nvd_published_at": "2025-01-22T18:15:21Z" } } \ No newline at end of file