diff --git a/advisories/github-reviewed/2018/11/GHSA-2jc8-4r6g-282j/GHSA-2jc8-4r6g-282j.json b/advisories/github-reviewed/2018/11/GHSA-2jc8-4r6g-282j/GHSA-2jc8-4r6g-282j.json index e2b843ec5e6..7bbb6382085 100644 --- a/advisories/github-reviewed/2018/11/GHSA-2jc8-4r6g-282j/GHSA-2jc8-4r6g-282j.json +++ b/advisories/github-reviewed/2018/11/GHSA-2jc8-4r6g-282j/GHSA-2jc8-4r6g-282j.json @@ -1,15 +1,22 @@ { "schema_version": "1.4.0", "id": "GHSA-2jc8-4r6g-282j", - "modified": "2020-06-16T20:52:26Z", + "modified": "2024-10-25T20:46:24Z", "published": "2018-11-06T23:13:02Z", "aliases": [ "CVE-2014-1928" ], - "summary": "Moderate severity vulnerability that affects python-gnupg", + "summary": "python-gnupg's shell_quote function does not properly escape characters", "details": "The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"\\\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -41,7 +48,7 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1928" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://code.google.com/p/python-gnupg" }, { @@ -52,6 +59,10 @@ "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-2jc8-4r6g-282j" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/python-gnupg/PYSEC-2014-91.yaml" + }, { "type": "WEB", "url": "http://seclists.org/oss-sec/2014/q1/246" @@ -60,14 +71,6 @@ "type": "WEB", "url": "http://seclists.org/oss-sec/2014/q1/294" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/56616" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/59031" - }, { "type": "WEB", "url": "http://www.debian.org/security/2014/dsa-2946" @@ -77,7 +80,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:52:26Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2022/05/GHSA-gwvq-rgqf-993f/GHSA-gwvq-rgqf-993f.json b/advisories/github-reviewed/2022/05/GHSA-gwvq-rgqf-993f/GHSA-gwvq-rgqf-993f.json index eb47146d4fa..049174141f0 100644 --- a/advisories/github-reviewed/2022/05/GHSA-gwvq-rgqf-993f/GHSA-gwvq-rgqf-993f.json +++ b/advisories/github-reviewed/2022/05/GHSA-gwvq-rgqf-993f/GHSA-gwvq-rgqf-993f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gwvq-rgqf-993f", - "modified": "2023-08-03T23:09:34Z", + "modified": "2024-10-25T20:47:18Z", "published": "2022-05-17T00:13:54Z", "aliases": [ "CVE-2014-0105" @@ -12,6 +12,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L" } ], "affected": [ @@ -47,6 +51,14 @@ "type": "WEB", "url": "https://bugs.launchpad.net/python-keystoneclient/+bug/1282865" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/python-keystoneclient" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2014-70.yaml" + }, { "type": "WEB", "url": "https://review.opendev.org/c/openstack/python-keystoneclient/+/81078" @@ -68,7 +80,7 @@ "cwe_ids": [ "CWE-522" ], - "severity": "MODERATE", + "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2023-08-03T23:09:34Z", "nvd_published_at": "2014-04-15T14:55:00Z"