diff --git a/advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json b/advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json new file mode 100644 index 00000000000..3d1c08cc3f1 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqvr-2rp8-j7h4", + "modified": "2024-12-04T22:33:48Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-38829" + ], + "summary": "Spring LDAP data exposure vulnerability", + "details": "A vulnerability in VMware Tanzu Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.\n\nThe usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried\nRelated to CVE-2024-38820 https://spring.io/security/cve-2024-38820", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.ldap:spring-ldap-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.2.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.ldap:spring-ldap-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38829" + }, + { + "type": "PACKAGE", + "url": "https://github.com/spring-projects/spring-ldap" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-38829" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-178" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-04T22:33:48Z", + "nvd_published_at": "2024-12-04T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json b/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json deleted file mode 100644 index 134ce395823..00000000000 --- a/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mqvr-2rp8-j7h4", - "modified": "2024-12-04T21:30:52Z", - "published": "2024-12-04T21:30:52Z", - "aliases": [ - "CVE-2024-38829" - ], - "details": "A vulnerability in VMware Tanzu Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.\n\nThe usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried\nRelated to CVE-2024-38820 https://spring.io/security/cve-2024-38820", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38829" - }, - { - "type": "WEB", - "url": "https://spring.io/security/cve-2024-38829" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-178" - ], - "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-12-04T21:15:24Z" - } -} \ No newline at end of file