diff --git a/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json b/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json index ba9b58f173b..17d6e681e4a 100644 --- a/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json +++ b/advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9qv8-7jfq-73j2", - "modified": "2023-12-18T18:39:15Z", + "modified": "2024-11-15T22:25:23Z", "published": "2023-12-13T18:31:04Z", "aliases": [ "CVE-2023-50771" @@ -28,7 +28,7 @@ "introduced": "0" }, { - "last_affected": "2.6" + "fixed": "3.0" } ] } @@ -40,10 +40,26 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50771" }, + { + "type": "WEB", + "url": "https://github.com/jenkins-infra/update-center2/pull/767" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/oic-auth-plugin/pull/261" + }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/oic-auth-plugin/commit/a97a4041f39c85aa746c047ac14ee69199dadf05" + }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/oic-auth-plugin" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/oic-auth-plugin/releases/tag/oic-auth-3.0" + }, { "type": "WEB", "url": "https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-2979" diff --git a/advisories/unreviewed/2024/11/GHSA-3xgq-45jj-v275/GHSA-3xgq-45jj-v275.json b/advisories/github-reviewed/2024/11/GHSA-3xgq-45jj-v275/GHSA-3xgq-45jj-v275.json similarity index 68% rename from advisories/unreviewed/2024/11/GHSA-3xgq-45jj-v275/GHSA-3xgq-45jj-v275.json rename to advisories/github-reviewed/2024/11/GHSA-3xgq-45jj-v275/GHSA-3xgq-45jj-v275.json index c860ed98367..5f3d086eb9a 100644 --- a/advisories/unreviewed/2024/11/GHSA-3xgq-45jj-v275/GHSA-3xgq-45jj-v275.json +++ b/advisories/github-reviewed/2024/11/GHSA-3xgq-45jj-v275/GHSA-3xgq-45jj-v275.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-3xgq-45jj-v275", - "modified": "2024-11-08T06:30:47Z", + "modified": "2024-11-15T22:25:53Z", "published": "2024-11-08T06:30:47Z", "aliases": [ "CVE-2024-21538" ], + "summary": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "details": "Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "cross-spawn" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.0.5" + } + ] + } + ] + } ], "references": [ { @@ -33,6 +52,10 @@ "type": "WEB", "url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f" }, + { + "type": "PACKAGE", + "url": "https://github.com/moxystudio/node-cross-spawn" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230" @@ -43,8 +66,8 @@ "CWE-1333" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-15T22:25:53Z", "nvd_published_at": "2024-11-08T05:15:06Z" } } \ No newline at end of file