From e4278cedc57d337b9a6524638a9fa855cf13e2ef Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 4 Dec 2024 22:35:14 +0000
Subject: [PATCH] Publish Advisories

GHSA-mqvr-2rp8-j7h4
GHSA-mqvr-2rp8-j7h4
---
 .../GHSA-mqvr-2rp8-j7h4.json                  | 84 +++++++++++++++++++
 .../GHSA-mqvr-2rp8-j7h4.json                  | 36 --------
 2 files changed, 84 insertions(+), 36 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json
 delete mode 100644 advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json

diff --git a/advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json b/advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json
new file mode 100644
index 00000000000..3d1c08cc3f1
--- /dev/null
+++ b/advisories/github-reviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json
@@ -0,0 +1,84 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mqvr-2rp8-j7h4",
+  "modified": "2024-12-04T22:33:48Z",
+  "published": "2024-12-04T21:30:52Z",
+  "aliases": [
+    "CVE-2024-38829"
+  ],
+  "summary": "Spring LDAP data exposure vulnerability",
+  "details": "A vulnerability in VMware Tanzu Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.\n\nThe usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried\nRelated to CVE-2024-38820 https://spring.io/security/cve-2024-38820",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework.ldap:spring-ldap-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.2.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.springframework.ldap:spring-ldap-core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.4.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38829"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/spring-projects/spring-ldap"
+    },
+    {
+      "type": "WEB",
+      "url": "https://spring.io/security/cve-2024-38829"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-178"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-04T22:33:48Z",
+    "nvd_published_at": "2024-12-04T21:15:24Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json b/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json
deleted file mode 100644
index 134ce395823..00000000000
--- a/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-mqvr-2rp8-j7h4",
-  "modified": "2024-12-04T21:30:52Z",
-  "published": "2024-12-04T21:30:52Z",
-  "aliases": [
-    "CVE-2024-38829"
-  ],
-  "details": "A vulnerability in VMware Tanzu Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.\n\nThe usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried\nRelated to  CVE-2024-38820 https://spring.io/security/cve-2024-38820",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38829"
-    },
-    {
-      "type": "WEB",
-      "url": "https://spring.io/security/cve-2024-38829"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-178"
-    ],
-    "severity": "LOW",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-12-04T21:15:24Z"
-  }
-}
\ No newline at end of file