diff --git a/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json b/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json new file mode 100644 index 00000000000..dd4e0f74364 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qghg-5fph-q28c", + "modified": "2024-01-31T06:30:17Z", + "published": "2024-01-31T06:30:17Z", + "aliases": [ + "CVE-2024-0914" + ], + "details": "A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0914" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-0914" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2260407" + }, + { + "type": "WEB", + "url": "https://people.redhat.com/~hkario/marvin/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-203" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-31T05:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-qpjv-gm6g-p2gh/GHSA-qpjv-gm6g-p2gh.json b/advisories/unreviewed/2024/01/GHSA-qpjv-gm6g-p2gh/GHSA-qpjv-gm6g-p2gh.json new file mode 100644 index 00000000000..2a880d492f2 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-qpjv-gm6g-p2gh/GHSA-qpjv-gm6g-p2gh.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qpjv-gm6g-p2gh", + "modified": "2024-01-31T06:30:17Z", + "published": "2024-01-31T06:30:17Z", + "aliases": [ + "CVE-2023-3934" + ], + "details": "Rejected reason: Please discard this CVE, we are not using this anymore. The vulnerability turned out to be a non-security issue", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3934" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-31T06:15:45Z" + } +} \ No newline at end of file