diff --git a/advisories/unreviewed/2025/02/GHSA-7wwr-h8cm-9jf7/GHSA-7wwr-h8cm-9jf7.json b/advisories/github-reviewed/2025/02/GHSA-7wwr-h8cm-9jf7/GHSA-7wwr-h8cm-9jf7.json similarity index 52% rename from advisories/unreviewed/2025/02/GHSA-7wwr-h8cm-9jf7/GHSA-7wwr-h8cm-9jf7.json rename to advisories/github-reviewed/2025/02/GHSA-7wwr-h8cm-9jf7/GHSA-7wwr-h8cm-9jf7.json index c1f47806015..2865a90acd3 100644 --- a/advisories/unreviewed/2025/02/GHSA-7wwr-h8cm-9jf7/GHSA-7wwr-h8cm-9jf7.json +++ b/advisories/github-reviewed/2025/02/GHSA-7wwr-h8cm-9jf7/GHSA-7wwr-h8cm-9jf7.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-7wwr-h8cm-9jf7", - "modified": "2025-02-10T21:31:38Z", + "modified": "2025-02-10T22:57:36Z", "published": "2025-02-10T21:31:37Z", "aliases": [ "CVE-2024-42513" ], + "summary": "Authentication Bypass by Spoofing in OPC UA .NET Standard Stack", "details": "Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "OPCFoundation.NetStandard.Opc.Ua" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.374.158" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,14 @@ { "type": "WEB", "url": "https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42513.pdf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OPCFoundation/UA-.NETStandard" + }, + { + "type": "WEB", + "url": "https://github.com/OPCFoundation/UA-.NETStandard/tree/1.5.374.158" } ], "database_specific": { @@ -29,8 +58,8 @@ "CWE-290" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-10T22:57:35Z", "nvd_published_at": "2025-02-10T19:15:38Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-qv5f-57gw-vx3h/GHSA-qv5f-57gw-vx3h.json b/advisories/github-reviewed/2025/02/GHSA-qv5f-57gw-vx3h/GHSA-qv5f-57gw-vx3h.json similarity index 57% rename from advisories/unreviewed/2025/02/GHSA-qv5f-57gw-vx3h/GHSA-qv5f-57gw-vx3h.json rename to advisories/github-reviewed/2025/02/GHSA-qv5f-57gw-vx3h/GHSA-qv5f-57gw-vx3h.json index 51ce71a8bc2..a49246cde21 100644 --- a/advisories/unreviewed/2025/02/GHSA-qv5f-57gw-vx3h/GHSA-qv5f-57gw-vx3h.json +++ b/advisories/github-reviewed/2025/02/GHSA-qv5f-57gw-vx3h/GHSA-qv5f-57gw-vx3h.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qv5f-57gw-vx3h", - "modified": "2025-02-10T21:31:37Z", + "modified": "2025-02-10T22:57:19Z", "published": "2025-02-10T21:31:37Z", "aliases": [ "CVE-2024-42512" ], + "summary": "Authorization Bypass in OPC UA .NET Standard Stack", "details": "Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "OPCFoundation.NetStandard.Opc.Ua" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.5.374.158" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -22,6 +43,10 @@ { "type": "WEB", "url": "https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42512.pdf" + }, + { + "type": "PACKAGE", + "url": "https://github.com/OPCFoundation/UA-.NETStandard" } ], "database_specific": { @@ -29,8 +54,8 @@ "CWE-639" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-02-10T22:57:19Z", "nvd_published_at": "2025-02-10T19:15:37Z" } } \ No newline at end of file