diff --git a/advisories/unreviewed/2024/03/GHSA-fj7x-q9j7-g6q6/GHSA-fj7x-q9j7-g6q6.json b/advisories/github-reviewed/2024/03/GHSA-fj7x-q9j7-g6q6/GHSA-fj7x-q9j7-g6q6.json similarity index 64% rename from advisories/unreviewed/2024/03/GHSA-fj7x-q9j7-g6q6/GHSA-fj7x-q9j7-g6q6.json rename to advisories/github-reviewed/2024/03/GHSA-fj7x-q9j7-g6q6/GHSA-fj7x-q9j7-g6q6.json index ed4fec13577..11ef440a1ad 100644 --- a/advisories/unreviewed/2024/03/GHSA-fj7x-q9j7-g6q6/GHSA-fj7x-q9j7-g6q6.json +++ b/advisories/github-reviewed/2024/03/GHSA-fj7x-q9j7-g6q6/GHSA-fj7x-q9j7-g6q6.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-fj7x-q9j7-g6q6", - "modified": "2024-03-19T06:30:52Z", + "modified": "2024-03-20T15:24:01Z", "published": "2024-03-19T06:30:52Z", "aliases": [ "CVE-2024-21503" ], + "summary": "Black vulnerable to Regular Expression Denial of Service (ReDoS)", "details": "Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.\n\nExploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "black" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "24.3.0" + } + ] + } + ] + } ], "references": [ { @@ -25,10 +44,18 @@ "type": "WEB", "url": "https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8" }, + { + "type": "PACKAGE", + "url": "https://github.com/psf/black" + }, { "type": "WEB", "url": "https://github.com/psf/black/releases/tag/24.3.0" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/black/PYSEC-2024-48.yaml" + }, { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-PYTHON-BLACK-6256273" @@ -39,8 +66,8 @@ "CWE-1333" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-03-20T15:24:01Z", "nvd_published_at": "2024-03-19T05:15:09Z" } } \ No newline at end of file