From e8cc7f6b43738f0eb5acb7879ce1346ec8b80441 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 16 Sep 2024 22:34:07 +0000 Subject: [PATCH] Publish Advisories GHSA-r5cj-wv24-92p5 GHSA-wxg3-mfph-qg9w GHSA-9gq6-6936-885w GHSA-c85f-pcx6-2ghm GHSA-v6g6-3cm3-vf6c GHSA-wf9g-c67g-h4ch --- .../GHSA-r5cj-wv24-92p5.json | 39 ++++++++----------- .../GHSA-wxg3-mfph-qg9w.json | 19 +++++++-- .../GHSA-9gq6-6936-885w.json | 6 ++- .../GHSA-c85f-pcx6-2ghm.json | 6 ++- .../GHSA-v6g6-3cm3-vf6c.json | 6 ++- .../GHSA-wf9g-c67g-h4ch.json | 6 ++- 6 files changed, 52 insertions(+), 30 deletions(-) diff --git a/advisories/github-reviewed/2022/05/GHSA-r5cj-wv24-92p5/GHSA-r5cj-wv24-92p5.json b/advisories/github-reviewed/2022/05/GHSA-r5cj-wv24-92p5/GHSA-r5cj-wv24-92p5.json index 794f6b9bd43..1e4bcd24d8d 100644 --- a/advisories/github-reviewed/2022/05/GHSA-r5cj-wv24-92p5/GHSA-r5cj-wv24-92p5.json +++ b/advisories/github-reviewed/2022/05/GHSA-r5cj-wv24-92p5/GHSA-r5cj-wv24-92p5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r5cj-wv24-92p5", - "modified": "2024-05-21T20:28:50Z", + "modified": "2024-09-16T22:32:44Z", "published": "2022-05-02T00:05:00Z", "aliases": [ "CVE-2008-3909" @@ -9,13 +9,20 @@ "summary": "Django cross-site request forgery (CSRF) vulnerability", "details": "The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -34,7 +41,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -53,7 +60,7 @@ { "package": { "ecosystem": "PyPI", - "name": "django" + "name": "Django" }, "ranges": [ { @@ -95,6 +102,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2008-2.yaml" + }, { "type": "WEB", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00091.html" @@ -103,18 +114,6 @@ "type": "WEB", "url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00131.html" }, - { - "type": "WEB", - "url": "http://osvdb.org/47906" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/31837" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/31961" - }, { "type": "WEB", "url": "http://www.debian.org/security/2008/dsa-1640" @@ -126,17 +125,13 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2008/09/03/4" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2008/2533" } ], "database_specific": { "cwe_ids": [ "CWE-352" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-09-22T23:12:22Z", "nvd_published_at": "2008-09-04T17:41:00Z" diff --git a/advisories/github-reviewed/2022/05/GHSA-wxg3-mfph-qg9w/GHSA-wxg3-mfph-qg9w.json b/advisories/github-reviewed/2022/05/GHSA-wxg3-mfph-qg9w/GHSA-wxg3-mfph-qg9w.json index 598eed56cee..89e660bde14 100644 --- a/advisories/github-reviewed/2022/05/GHSA-wxg3-mfph-qg9w/GHSA-wxg3-mfph-qg9w.json +++ b/advisories/github-reviewed/2022/05/GHSA-wxg3-mfph-qg9w/GHSA-wxg3-mfph-qg9w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wxg3-mfph-qg9w", - "modified": "2024-01-16T22:48:09Z", + "modified": "2024-09-16T22:32:03Z", "published": "2022-05-14T03:49:36Z", "aliases": [ "CVE-2011-4138" @@ -9,7 +9,14 @@ "summary": "Django Might Allow CSRF Requests via URL Verification", "details": "The `verify_exists` functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -41,7 +48,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "1.3.0" + "introduced": "1.3" }, { "fixed": "1.3.1" @@ -72,6 +79,10 @@ "type": "PACKAGE", "url": "https://github.com/django/django" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-3.yaml" + }, { "type": "WEB", "url": "https://hermes.opensuse.org/messages/14700881" @@ -101,7 +112,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-16T22:48:09Z", "nvd_published_at": "2011-10-19T10:55:00Z" diff --git a/advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json b/advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json index 82aebe29b26..09c0097fe6a 100644 --- a/advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json +++ b/advisories/github-reviewed/2024/09/GHSA-9gq6-6936-885w/GHSA-9gq6-6936-885w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9gq6-6936-885w", - "modified": "2024-09-16T21:12:06Z", + "modified": "2024-09-16T22:32:50Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45848" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/mindsdb/mindsdb" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-78.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" diff --git a/advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json b/advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json index 385110b7575..4d91b88f320 100644 --- a/advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json +++ b/advisories/github-reviewed/2024/09/GHSA-c85f-pcx6-2ghm/GHSA-c85f-pcx6-2ghm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c85f-pcx6-2ghm", - "modified": "2024-09-16T21:12:15Z", + "modified": "2024-09-16T22:33:01Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45849" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/mindsdb/mindsdb" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-79.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" diff --git a/advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json b/advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json index 30b7298779a..d619f42e3a4 100644 --- a/advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json +++ b/advisories/github-reviewed/2024/09/GHSA-v6g6-3cm3-vf6c/GHSA-v6g6-3cm3-vf6c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v6g6-3cm3-vf6c", - "modified": "2024-09-16T21:12:25Z", + "modified": "2024-09-16T22:33:15Z", "published": "2024-09-12T15:33:00Z", "aliases": [ "CVE-2024-45850" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/mindsdb/mindsdb" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-80.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb" diff --git a/advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json b/advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json index 5a5c6877796..2e1905ecb7e 100644 --- a/advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json +++ b/advisories/github-reviewed/2024/09/GHSA-wf9g-c67g-h4ch/GHSA-wf9g-c67g-h4ch.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wf9g-c67g-h4ch", - "modified": "2024-09-16T21:12:35Z", + "modified": "2024-09-16T22:33:29Z", "published": "2024-09-12T15:33:01Z", "aliases": [ "CVE-2024-45851" @@ -52,6 +52,10 @@ "type": "PACKAGE", "url": "https://github.com/mindsdb/mindsdb" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-81.yaml" + }, { "type": "WEB", "url": "https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb"