diff --git a/advisories/unreviewed/2023/12/GHSA-554w-xh4j-8w64/GHSA-554w-xh4j-8w64.json b/advisories/github-reviewed/2023/12/GHSA-554w-xh4j-8w64/GHSA-554w-xh4j-8w64.json similarity index 61% rename from advisories/unreviewed/2023/12/GHSA-554w-xh4j-8w64/GHSA-554w-xh4j-8w64.json rename to advisories/github-reviewed/2023/12/GHSA-554w-xh4j-8w64/GHSA-554w-xh4j-8w64.json index 4cb4250937b..4e3e12a636f 100644 --- a/advisories/unreviewed/2023/12/GHSA-554w-xh4j-8w64/GHSA-554w-xh4j-8w64.json +++ b/advisories/github-reviewed/2023/12/GHSA-554w-xh4j-8w64/GHSA-554w-xh4j-8w64.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-554w-xh4j-8w64", - "modified": "2023-12-15T03:30:18Z", + "modified": "2023-12-15T23:01:09Z", "published": "2023-12-15T03:30:18Z", "aliases": [ "CVE-2023-6831" ], + "summary": "Path traversal in MLflow", "details": "Path Traversal: '\\..\\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "mlflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.2" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/mlflow/mlflow/commit/1da75dfcecd4d169e34809ade55748384e8af6c1" }, + { + "type": "PACKAGE", + "url": "https://github.com/mlflow/mlflow" + }, { "type": "WEB", "url": "https://huntr.com/bounties/0acdd745-0167-4912-9d5c-02035fe5b314" @@ -35,8 +58,8 @@ "CWE-29" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2023-12-15T23:01:09Z", "nvd_published_at": "2023-12-15T01:15:08Z" } } \ No newline at end of file