From e0f215a32eded5735c03cfa2d6cd6f09b2a75fae Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 13 Feb 2024 18:38:12 +0000
Subject: [PATCH] Publish GHSA-747x-5m58-mq97

---
 .../GHSA-747x-5m58-mq97.json                  | 36 ++++++++++++++++---
 1 file changed, 32 insertions(+), 4 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json (69%)

diff --git a/advisories/unreviewed/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json b/advisories/github-reviewed/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json
similarity index 69%
rename from advisories/unreviewed/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json
rename to advisories/github-reviewed/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json
index 896c1b62bd5..5d4c9d6a6ed 100644
--- a/advisories/unreviewed/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json
+++ b/advisories/github-reviewed/2024/02/GHSA-747x-5m58-mq97/GHSA-747x-5m58-mq97.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-747x-5m58-mq97",
-  "modified": "2024-02-13T06:30:28Z",
+  "modified": "2024-02-13T18:36:52Z",
   "published": "2024-02-13T06:30:28Z",
   "aliases": [
     "CVE-2024-21491"
   ],
+  "summary": "svix vulnerable to Authentication Bypass",
   "details": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\n\n**Note:**\n\nThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues.",
   "severity": [
     {
@@ -14,7 +15,30 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "svix"
+      },
+      "ecosystem_specific": {
+        "affected_functions": [
+          "svix::webhooks::Webhook::verify"
+        ]
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.17.0"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -29,6 +53,10 @@
       "type": "WEB",
       "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/svix/svix-webhooks"
+    },
     {
       "type": "WEB",
       "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html"
@@ -43,8 +71,8 @@
       "CWE-288"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-02-13T18:36:52Z",
     "nvd_published_at": "2024-02-13T05:15:08Z"
   }
 }
\ No newline at end of file