diff --git a/advisories/github-reviewed/2018/07/GHSA-3cgg-gh9j-w8vm/GHSA-3cgg-gh9j-w8vm.json b/advisories/github-reviewed/2018/07/GHSA-3cgg-gh9j-w8vm/GHSA-3cgg-gh9j-w8vm.json index d4bf39c948a..58931f47ceb 100644 --- a/advisories/github-reviewed/2018/07/GHSA-3cgg-gh9j-w8vm/GHSA-3cgg-gh9j-w8vm.json +++ b/advisories/github-reviewed/2018/07/GHSA-3cgg-gh9j-w8vm/GHSA-3cgg-gh9j-w8vm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-3cgg-gh9j-w8vm", - "modified": "2020-08-31T18:20:01Z", + "modified": "2023-09-08T20:52:35Z", "published": "2018-07-24T13:58:10Z", "aliases": [ "CVE-2017-16094" ], "summary": "Directory Traversal in iter-http", - "details": "Affected versions of `iter-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\nExample request:\n```\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.", + "details": "Affected versions of `iter-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n**Example request:**\n```http\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.", "severity": [ ], @@ -17,6 +17,11 @@ "ecosystem": "npm", "name": "iter-http" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", diff --git a/advisories/github-reviewed/2019/02/GHSA-2hpj-g53m-9gj6/GHSA-2hpj-g53m-9gj6.json b/advisories/github-reviewed/2019/02/GHSA-2hpj-g53m-9gj6/GHSA-2hpj-g53m-9gj6.json index 257ed32e1cc..81c5548d151 100644 --- a/advisories/github-reviewed/2019/02/GHSA-2hpj-g53m-9gj6/GHSA-2hpj-g53m-9gj6.json +++ b/advisories/github-reviewed/2019/02/GHSA-2hpj-g53m-9gj6/GHSA-2hpj-g53m-9gj6.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-2hpj-g53m-9gj6", - "modified": "2021-08-30T21:55:14Z", + "modified": "2023-09-08T20:52:07Z", "published": "2019-02-18T23:58:03Z", "aliases": [ "CVE-2016-10583" ], - "summary": "Downloads Resources over HTTP in closure-util", + "summary": "closure-util downloads Resources over HTTP", "details": "Affected versions of `closure-util` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closure-util`.\n\n\n## Recommendation\n\nTo mitigate this issue:\n1. Install the package using npm's `--ignore-scripts` flag.\n2. Navigate to the package directory, and open `default-config.json` in a text editor\n3. Change the download URLs in the `compiler_url` and `library_url` to `https` equivalents\n4. run `npm i` in the package directory.", "severity": [ { @@ -20,6 +20,11 @@ "ecosystem": "npm", "name": "closure-util" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -51,7 +56,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-311" ], "severity": "HIGH", "github_reviewed": true,