From ddc3786c4dda9624001815a00e8ddf7e39ec7cbf Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 24 Apr 2023 16:49:19 +0000
Subject: [PATCH] Publish Advisories

GHSA-h83h-77x2-6w6g
GHSA-qvc4-78gw-pv8p
---
 .../GHSA-h83h-77x2-6w6g.json                  | 31 ++++++++--
 .../GHSA-qvc4-78gw-pv8p.json                  | 58 +++++++++++++++++++
 2 files changed, 85 insertions(+), 4 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json (60%)
 create mode 100644 advisories/github-reviewed/2023/04/GHSA-qvc4-78gw-pv8p/GHSA-qvc4-78gw-pv8p.json

diff --git a/advisories/unreviewed/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json b/advisories/github-reviewed/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json
similarity index 60%
rename from advisories/unreviewed/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json
rename to advisories/github-reviewed/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json
index c12838f3381..34f87b467df 100644
--- a/advisories/unreviewed/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json
+++ b/advisories/github-reviewed/2023/04/GHSA-h83h-77x2-6w6g/GHSA-h83h-77x2-6w6g.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h83h-77x2-6w6g",
-  "modified": "2023-04-22T18:30:28Z",
+  "modified": "2023-04-24T16:48:19Z",
   "published": "2023-04-22T18:30:28Z",
   "aliases": [
     "CVE-2023-2239"
   ],
+  "summary": "Information exposure in microweber",
   "details": "Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "microweber/microweber"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.3.4"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -25,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/microweber/microweber/commit/b0644cb3411b36b6ccc2ff7cdf7af3fa49525baa"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/microweber/microweber"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.dev/bounties/edeff16b-fc71-4e26-8d2d-dfe7bb5e7868"
@@ -35,8 +58,8 @@
       "CWE-359"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-04-24T16:48:19Z",
     "nvd_published_at": null
   }
 }
\ No newline at end of file
diff --git a/advisories/github-reviewed/2023/04/GHSA-qvc4-78gw-pv8p/GHSA-qvc4-78gw-pv8p.json b/advisories/github-reviewed/2023/04/GHSA-qvc4-78gw-pv8p/GHSA-qvc4-78gw-pv8p.json
new file mode 100644
index 00000000000..008e8ee6623
--- /dev/null
+++ b/advisories/github-reviewed/2023/04/GHSA-qvc4-78gw-pv8p/GHSA-qvc4-78gw-pv8p.json
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qvc4-78gw-pv8p",
+  "modified": "2023-04-24T16:47:24Z",
+  "published": "2023-04-24T16:47:24Z",
+  "aliases": [
+
+  ],
+  "summary": "Adverserial use of `make_bitflags!` macro can cause undefined behavior",
+  "details": "The macro relied on an expression of the form `Enum::Variant` always being a\nvariant of the enum. However, it may also be an associated integer constant, in\nwhich case there's no guarantee that the value of said constant consists only of\nbits valid for this bitflag type.\n\nThus, code like this could create an invalid `BitFlags<Test>`, which would cause\niterating over it to trigger undefined behavior. As the debug formatter\ninternally iterates over the value, it is also affected.\n\n```rust\nuse enumflags2::{bitflags, make_bitflags};\n\n#[bitflags]\n#[repr(u8)]\n#[derive(Copy, Clone, Debug)]\nenum Test {\n    A = 1,\n    B = 2,\n}\n\nimpl Test {\n    const C: u8 = 69;\n}\n\nfn main() {\n    let x = make_bitflags!(Test::{C});\n    // printing or iterating over x is UB\n}\n```\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "enumflags2"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.7.0"
+            },
+            {
+              "fixed": "0.7.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/meithecatte/enumflags2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/meithecatte/enumflags2/releases/tag/v0.7.7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://rustsec.org/advisories/RUSTSEC-2023-0035.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-04-24T16:47:24Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file