From df2693a1ac3e3f157f475a16c9c7074dc141252b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 1 Apr 2024 16:15:32 +0000 Subject: [PATCH] Publish GHSA-qppj-fm5r-hxr3 --- .../GHSA-qppj-fm5r-hxr3.json | 322 +++++++++++------- 1 file changed, 205 insertions(+), 117 deletions(-) diff --git a/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json b/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json index ab8498d6d68..e8361fbb6de 100644 --- a/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json +++ b/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qppj-fm5r-hxr3", - "modified": "2024-03-05T21:48:12Z", + "modified": "2024-04-01T16:13:51Z", "published": "2023-10-10T21:28:24Z", "aliases": [ "CVE-2023-44487" @@ -413,6 +413,82 @@ ] } ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.typesafe.akka:akka-http-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.5.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.typesafe.akka:akka-http-core_2.13" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.5.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.typesafe.akka:akka-http-core_2.12" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "10.5.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.typesafe.akka:akka-http-core_2.11" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "10.1.15" + } + ] + } + ] } ], "references": [ @@ -444,17 +520,21 @@ "type": "WEB", "url": "https://github.com/apache/apisix/issues/10320" }, + { + "type": "WEB", + "url": "https://github.com/varnishcache/varnish-cache/issues/3996" + }, { "type": "WEB", "url": "https://github.com/caddyserver/caddy/issues/5877" }, { "type": "WEB", - "url": "https://github.com/dotnet/announcements/issues/277" + "url": "https://github.com/tempesta-tech/tempesta/issues/1986" }, { "type": "WEB", - "url": "https://github.com/varnishcache/varnish-cache/issues/3996" + "url": "https://github.com/dotnet/announcements/issues/277" }, { "type": "WEB", @@ -468,10 +548,6 @@ "type": "WEB", "url": "https://github.com/golang/go/issues/63417" }, - { - "type": "WEB", - "url": "https://github.com/tempesta-tech/tempesta/issues/1986" - }, { "type": "WEB", "url": "https://github.com/haproxy/haproxy/issues/2312" @@ -480,6 +556,10 @@ "type": "WEB", "url": "https://github.com/hyperium/hyper/issues/3337" }, + { + "type": "WEB", + "url": "https://github.com/opensearch-project/data-prepper/issues/3474" + }, { "type": "WEB", "url": "https://github.com/junkurihara/rust-rpxy/issues/97" @@ -488,41 +568,13 @@ "type": "WEB", "url": "https://github.com/kazu-yamamoto/http2/issues/93" }, - { - "type": "WEB", - "url": "https://github.com/opensearch-project/data-prepper/issues/3474" - }, - { - "type": "WEB", - "url": "https://github.com/ninenines/cowboy/issues/1615" - }, { "type": "WEB", "url": "https://github.com/openresty/openresty/issues/930" }, { "type": "WEB", - "url": "https://github.com/nodejs/node/pull/50121" - }, - { - "type": "WEB", - "url": "https://github.com/nghttp2/nghttp2/pull/1961" - }, - { - "type": "WEB", - "url": "https://github.com/microsoft/CBL-Mariner/pull/6381" - }, - { - "type": "WEB", - "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632" - }, - { - "type": "WEB", - "url": "https://github.com/line/armeria/pull/5232" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/pull/121120" + "url": "https://github.com/ninenines/cowboy/issues/1615" }, { "type": "WEB", @@ -532,29 +584,57 @@ "type": "WEB", "url": "https://github.com/h2o/h2o/pull/3291" }, - { - "type": "WEB", - "url": "https://github.com/grpc/grpc-go/pull/6703" - }, - { - "type": "WEB", - "url": "https://github.com/facebook/proxygen/pull/466" - }, { "type": "WEB", "url": "https://github.com/envoyproxy/envoy/pull/30055" }, - { - "type": "WEB", - "url": "https://github.com/apache/httpd-site/pull/10" - }, { "type": "WEB", "url": "https://github.com/apache/trafficserver/pull/10564" }, { "type": "WEB", - "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1" + "url": "https://github.com/grpc/grpc-go/pull/6703" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/pull/121120" + }, + { + "type": "WEB", + "url": "https://github.com/apache/httpd-site/pull/10" + }, + { + "type": "WEB", + "url": "https://github.com/line/armeria/pull/5232" + }, + { + "type": "WEB", + "url": "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632" + }, + { + "type": "WEB", + "url": "https://github.com/akka/akka-http/pull/4325" + }, + { + "type": "WEB", + "url": "https://github.com/akka/akka-http/pull/4324" + }, + { + "type": "WEB", + "url": "https://github.com/facebook/proxygen/pull/466" + }, + { + "type": "WEB", + "url": "https://github.com/microsoft/CBL-Mariner/pull/6381" + }, + { + "type": "WEB", + "url": "https://github.com/nghttp2/nghttp2/pull/1961" + }, + { + "type": "WEB", + "url": "https://github.com/nodejs/node/pull/50121" }, { "type": "WEB", @@ -562,11 +642,27 @@ }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT" + "url": "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1" }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG" + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4" + }, + { + "type": "WEB", + "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT" }, { "type": "WEB", @@ -576,30 +672,6 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y" }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2" - }, - { - "type": "WEB", - "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH" - }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH" @@ -610,23 +682,19 @@ }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK" + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK" }, { "type": "WEB", - "url": "https://access.redhat.com/security/cve/cve-2023-44487" + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH" }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3" + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y" }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A" + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2" }, { "type": "WEB", @@ -634,7 +702,15 @@ }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ" + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG" }, { "type": "WEB", @@ -642,31 +718,7 @@ }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ" - }, - { - "type": "WEB", - "url": "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html" - }, - { - "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ" - }, - { - "type": "WEB", - "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html" + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE" }, { "type": "WEB", @@ -678,7 +730,39 @@ }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE" + "url": "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A" + }, + { + "type": "WEB", + "url": "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html" }, { "type": "WEB", @@ -816,6 +900,14 @@ "type": "WEB", "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81" }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/cve-2023-44487" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715" + }, { "type": "WEB", "url": "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve" @@ -878,7 +970,7 @@ }, { "type": "WEB", - "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244" + "url": "https://akka.io/security/akka-http-cve-2023-44487.html" }, { "type": "WEB", @@ -942,7 +1034,7 @@ }, { "type": "WEB", - "url": "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715" + "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html" }, { "type": "WEB", @@ -1006,7 +1098,7 @@ }, { "type": "WEB", - "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK" + "url": "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244" }, { "type": "WEB", @@ -1068,10 +1160,6 @@ "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html" }, - { - "type": "WEB", - "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html" - }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2023/10/13/4"