Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-10-25 21:32:28 +00:00
parent c9d9cc5539
commit e310b583b9
96 changed files with 1202 additions and 236 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8q59-q68h-6hv4",
-  "modified": "2021-09-28T19:04:49Z",
+  "modified": "2024-10-25T21:31:44Z",
  "published": "2021-03-25T21:26:26Z",
  "aliases": [
    "CVE-2020-14343"
@@ -12,6 +12,10 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
@@ -20,12 +24,6 @@
        "ecosystem": "PyPI",
        "name": "PyYAML"
      },
-      "ecosystem_specific": {
-        "affected_functions": [
-          "yaml.constructor.FullConstructor",
-          "yaml.constructor.UnsafeConstructor"
-        ]
-      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
@@ -66,6 +64,14 @@
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860466"
    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-8q59-q68h-6hv4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyyaml/PYSEC-2021-142.yaml"
+    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yaml/pyyaml"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hrj7-f62f-j7x7",
-  "modified": "2022-09-30T04:41:04Z",
+  "modified": "2024-10-25T21:29:32Z",
  "published": "2022-09-27T00:00:22Z",
  "aliases": [
    "CVE-2022-3295"
@@ -12,6 +12,10 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qq29-5vjh-vxwr",
-  "modified": "2022-09-30T04:44:55Z",
+  "modified": "2024-10-25T21:29:58Z",
  "published": "2022-09-27T00:00:22Z",
  "aliases": [
    "CVE-2022-3301"
@@ -12,6 +12,10 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "affected": [
@@ -61,7 +65,7 @@
    "cwe_ids": [
      "CWE-460"
    ],
-    "severity": "LOW",
+    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-30T04:44:55Z",
    "nvd_published_at": "2022-09-26T11:15:00Z"
@@ -44,7 +44,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-125"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-1336"
+      "CWE-1336",
+      "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-125"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-1336"
+      "CWE-1336",
+      "CWE-78"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-300"
+      "CWE-300",
+      "CWE-639"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-125"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -40,7 +40,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-125"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-125"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -36,7 +36,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-289"
+      "CWE-289",
+      "CWE-639"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-362",
      "CWE-368"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-pqp2-hjwx-f6qp",
-  "modified": "2024-10-22T18:32:04Z",
+  "modified": "2024-10-25T21:31:26Z",
  "published": "2024-08-17T12:30:33Z",
  "aliases": [
    "CVE-2024-43845"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix bogus checksum computation in udf_rename()\n\nSyzbot reports uninitialized memory access in udf_rename() when updating\nchecksum of '..' directory entry of a moved directory. This is indeed\ntrue as we pass on-stack diriter.fi to the udf_update_tag() and because\nthat has only struct fileIdentDesc included in it and not the impUse or\nname fields, the checksumming function is going to checksum random stack\ncontents beyond the end of the structure. This is actually harmless\nbecause the following udf_fiiter_write_fi() will recompute the checksum\nfrom on-disk buffers where everything is properly included. So all that\nis needed is just removing the bogus calculation.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+    }
  ],
  "affected": [

@@ -41,9 +44,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-908"
    ],
-    "severity": null,
+    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T10:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rqp9-2crf-qjg9",
-  "modified": "2024-08-19T06:30:54Z",
+  "modified": "2024-10-25T21:31:26Z",
  "published": "2024-08-17T12:30:33Z",
  "aliases": [
    "CVE-2024-43846"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib: objagg: Fix general protection fault\n\nThe library supports aggregation of objects into other objects only if\nthe parent object does not have a parent itself. That is, nesting is not\nsupported.\n\nAggregation happens in two cases: Without and with hints, where hints\nare a pre-computed recommendation on how to aggregate the provided\nobjects.\n\nNesting is not possible in the first case due to a check that prevents\nit, but in the second case there is no check because the assumption is\nthat nesting cannot happen when creating objects based on hints. The\nviolation of this assumption leads to various warnings and eventually to\na general protection fault [1].\n\nBefore fixing the root cause, error out when nesting happens and warn.\n\n[1]\ngeneral protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI\nCPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G        W          6.9.0-rc6-custom-gd9b4f1cca7fb #7\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80\n[...]\nCall Trace:\n <TASK>\n mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n </TASK>",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -51,7 +54,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T10:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-x8hg-ghpc-gxw6",
-  "modified": "2024-08-17T12:30:33Z",
+  "modified": "2024-10-25T21:31:26Z",
  "published": "2024-08-17T12:30:33Z",
  "aliases": [
    "CVE-2024-43847"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix invalid memory access while processing fragmented packets\n\nThe monitor ring and the reo reinject ring share the same ring mask index.\nWhen the driver receives an interrupt for the reo reinject ring, the\nmonitor ring is also processed, leading to invalid memory access. Since\nmonitor support is not yet enabled in ath12k, the ring mask for the monitor\nring should be removed.\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-17T10:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-24vf-v4v3-xgmr",
-  "modified": "2024-10-21T18:30:59Z",
+  "modified": "2024-10-25T21:31:26Z",
  "published": "2024-10-21T18:30:59Z",
  "aliases": [
    "CVE-2024-49975"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nuprobes: fix kernel info leak via \"[uprobes]\" vma\n\nxol_add_vma() maps the uninitialized page allocated by __create_xol_area()\ninto userspace. On some architectures (x86) this memory is readable even\nwithout VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,\nalthough this doesn't really matter, debugger can read this memory anyway.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -49,9 +52,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-401"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T18:15:18Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2645-7hqp-7qr7",
-  "modified": "2024-10-21T21:30:51Z",
+  "modified": "2024-10-25T21:31:27Z",
  "published": "2024-10-21T21:30:51Z",
  "aliases": [
    "CVE-2022-48967"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nci: Bounds check struct nfc_target arrays\n\nWhile running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported:\n\n  memcpy: detected field-spanning write (size 129) of single field \"target->sensf_res\" at net/nfc/nci/ntf.c:260 (size 18)\n\nThis appears to be a legitimate lack of bounds checking in\nnci_add_new_protocol(). Add the missing checks.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-129"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T20:15:08Z"
--- a/Show More
+++ b/Show More