diff --git a/advisories/unreviewed/2022/05/GHSA-h3q4-6j7f-r24c/GHSA-h3q4-6j7f-r24c.json b/advisories/github-reviewed/2022/05/GHSA-h3q4-6j7f-r24c/GHSA-h3q4-6j7f-r24c.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-h3q4-6j7f-r24c/GHSA-h3q4-6j7f-r24c.json rename to advisories/github-reviewed/2022/05/GHSA-h3q4-6j7f-r24c/GHSA-h3q4-6j7f-r24c.json index 3d2815c26f8..0ec0b75f822 100644 --- a/advisories/unreviewed/2022/05/GHSA-h3q4-6j7f-r24c/GHSA-h3q4-6j7f-r24c.json +++ b/advisories/github-reviewed/2022/05/GHSA-h3q4-6j7f-r24c/GHSA-h3q4-6j7f-r24c.json @@ -1,42 +1,77 @@ { "schema_version": "1.4.0", "id": "GHSA-h3q4-6j7f-r24c", - "modified": "2022-05-17T03:02:35Z", + "modified": "2024-08-30T23:37:23Z", "published": "2022-05-17T03:02:35Z", "aliases": [ "CVE-2016-6580" ], + "summary": "priority vulnerable to denial of service", "details": "A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "priority" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6580" }, + { + "type": "WEB", + "url": "https://github.com/python-hyper/priority/commit/7d01a7dc4db83bce50f20d47caf4f37b403a3ecd" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/priority/PYSEC-2017-93.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/python-hyper/priority" + }, { "type": "WEB", "url": "https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.html" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/92311" + "url": "https://web.archive.org/web/20160806004329/http://www.securityfocus.com/bid/92311" } ], "database_specific": { "cwe_ids": [ - + "CWE-770" ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:23Z", "nvd_published_at": "2017-01-10T15:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-pw5x-x5jw-ccmh/GHSA-pw5x-x5jw-ccmh.json b/advisories/github-reviewed/2024/01/GHSA-pw5x-x5jw-ccmh/GHSA-pw5x-x5jw-ccmh.json new file mode 100644 index 00000000000..16df9f8dfef --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-pw5x-x5jw-ccmh/GHSA-pw5x-x5jw-ccmh.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pw5x-x5jw-ccmh", + "modified": "2024-08-30T23:37:34Z", + "published": "2024-01-12T03:30:49Z", + "aliases": [ + "CVE-2016-20021" + ], + "summary": "Gentoo Portage missing PGP validation of executed code", + "details": "In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "portage" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0.47" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-20021" + }, + { + "type": "WEB", + "url": "https://github.com/gentoo/portage/commit/28cd240fb23d880b8641a058831c6762db71c3e2" + }, + { + "type": "WEB", + "url": "https://bugs.gentoo.org/597800" + }, + { + "type": "PACKAGE", + "url": "https://github.com/gentoo/portage" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/portage/PYSEC-2024-10.yaml" + }, + { + "type": "WEB", + "url": "https://gitweb.gentoo.org/proj/portage.git/tree/NEWS" + }, + { + "type": "WEB", + "url": "https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b3c80502e96406b4b175e2ee79eb65f3f3cd9f6" + }, + { + "type": "WEB", + "url": "https://wiki.gentoo.org/wiki/Portage" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:34Z", + "nvd_published_at": "2024-01-12T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-2r6g-7r83-jg72/GHSA-2r6g-7r83-jg72.json b/advisories/github-reviewed/2024/08/GHSA-2r6g-7r83-jg72/GHSA-2r6g-7r83-jg72.json new file mode 100644 index 00000000000..b6fa445e4b3 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-2r6g-7r83-jg72/GHSA-2r6g-7r83-jg72.json @@ -0,0 +1,53 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2r6g-7r83-jg72", + "modified": "2024-08-30T23:37:36Z", + "published": "2024-08-30T23:37:36Z", + "aliases": [ + + ], + "summary": "`spam` project on PyPI compromised, malicious releases made", + "details": "The `spam` project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "spam" + }, + "versions": [ + "2.0.2" + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "spam" + }, + "versions": [ + "4.0.2" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/spam/PYSEC-2022-251.yaml" + }, + { + "type": "WEB", + "url": "https://twitter.com/pypi/status/1562442207079976966" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:36Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-cxjf-x6jp-p7mc/GHSA-cxjf-x6jp-p7mc.json b/advisories/github-reviewed/2024/08/GHSA-cxjf-x6jp-p7mc/GHSA-cxjf-x6jp-p7mc.json new file mode 100644 index 00000000000..2d23d62a035 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-cxjf-x6jp-p7mc/GHSA-cxjf-x6jp-p7mc.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cxjf-x6jp-p7mc", + "modified": "2024-08-30T23:37:19Z", + "published": "2024-08-30T23:37:19Z", + "aliases": [ + + ], + "summary": "opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863", + "details": "opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "opencv-contrib-python" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.8.1.78" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/pull/24274" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-j7hp-h8jx-5ppr" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opencv/opencv-python" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/wiki/ChangeLog#version481" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python/PYSEC-2023-181.yaml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:19Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-jh2j-j4j9-crg3/GHSA-jh2j-j4j9-crg3.json b/advisories/github-reviewed/2024/08/GHSA-jh2j-j4j9-crg3/GHSA-jh2j-j4j9-crg3.json new file mode 100644 index 00000000000..2c686cce873 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-jh2j-j4j9-crg3/GHSA-jh2j-j4j9-crg3.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jh2j-j4j9-crg3", + "modified": "2024-08-30T23:37:17Z", + "published": "2024-08-30T23:37:17Z", + "aliases": [ + + ], + "summary": "opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863", + "details": "opencv-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "opencv-python-headless" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.8.1.78" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/pull/24274" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-j7hp-h8jx-5ppr" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opencv/opencv-python" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/wiki/ChangeLog#version481" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/opencv-python-headless/PYSEC-2023-184.yaml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:17Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-qr4w-53vh-m672/GHSA-qr4w-53vh-m672.json b/advisories/github-reviewed/2024/08/GHSA-qr4w-53vh-m672/GHSA-qr4w-53vh-m672.json new file mode 100644 index 00000000000..d9cbd3b3d98 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-qr4w-53vh-m672/GHSA-qr4w-53vh-m672.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr4w-53vh-m672", + "modified": "2024-08-30T23:37:21Z", + "published": "2024-08-30T23:37:20Z", + "aliases": [ + + ], + "summary": "opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863", + "details": "opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "opencv-python" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.8.1.78" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/pull/24274" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opencv/opencv-python" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/wiki/ChangeLog#version481" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/opencv-python/PYSEC-2023-183.yaml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:20Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-w2pj-9cgh-mq2c/GHSA-w2pj-9cgh-mq2c.json b/advisories/github-reviewed/2024/08/GHSA-w2pj-9cgh-mq2c/GHSA-w2pj-9cgh-mq2c.json new file mode 100644 index 00000000000..446abc1610e --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-w2pj-9cgh-mq2c/GHSA-w2pj-9cgh-mq2c.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2pj-9cgh-mq2c", + "modified": "2024-08-30T23:37:14Z", + "published": "2024-08-30T23:37:14Z", + "aliases": [ + + ], + "summary": "opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863", + "details": "opencv-contrib-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "opencv-contrib-python-headless" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.8.1.78" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4863" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/pull/24274" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/commit/687fc11626901cff09d2b3b5f331fd59190ad4c7" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-j7hp-h8jx-5ppr" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opencv/opencv-python" + }, + { + "type": "WEB", + "url": "https://github.com/opencv/opencv/wiki/ChangeLog#version481" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/opencv-contrib-python-headless/PYSEC-2023-182.yaml" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:14Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-x6xg-3fj2-4pq3/GHSA-x6xg-3fj2-4pq3.json b/advisories/github-reviewed/2024/08/GHSA-x6xg-3fj2-4pq3/GHSA-x6xg-3fj2-4pq3.json new file mode 100644 index 00000000000..2a24d6f1830 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-x6xg-3fj2-4pq3/GHSA-x6xg-3fj2-4pq3.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x6xg-3fj2-4pq3", + "modified": "2024-08-30T23:36:58Z", + "published": "2024-08-30T23:36:58Z", + "aliases": [ + + ], + "summary": "`exotel` project on PyPI compromised, malicious release made", + "details": "The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "exotel" + }, + "versions": [ + "0.1.6" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/exotel/PYSEC-2022-250.yaml" + }, + { + "type": "WEB", + "url": "https://twitter.com/pypi/status/1562442207079976966" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:36:58Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-xm4r-5rj9-2pg3/GHSA-xm4r-5rj9-2pg3.json b/advisories/github-reviewed/2024/08/GHSA-xm4r-5rj9-2pg3/GHSA-xm4r-5rj9-2pg3.json new file mode 100644 index 00000000000..31b96fd3b81 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-xm4r-5rj9-2pg3/GHSA-xm4r-5rj9-2pg3.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xm4r-5rj9-2pg3", + "modified": "2024-08-30T23:37:05Z", + "published": "2024-08-30T23:37:05Z", + "aliases": [ + + ], + "summary": "gratient 0.5 contains credential harvesting code", + "details": "gratient is a user-facing library for generating color gradients of text.\nVersion 0.5 contained obfuscated, malicious code targeting\nWindows platforms, harvesting information and credentials from the\nuser's system and sending them to a remote server.\nServices may include Mullvad VPN and Telegram.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "gratient" + }, + "versions": [ + "0.5" + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/gratient/PYSEC-2024-1.yaml" + }, + { + "type": "WEB", + "url": "https://inspector.pypi.io/project/gratient/0.5/packages/c5/c5/353e45fa57fa5f1b2b42fa24a029cdfb018d7263850fb43b6d6352157734/gratient-0.5-py3-none-any.whl/gratient/__init__.py#line.4" + }, + { + "type": "WEB", + "url": "https://pypi.org/project/gratient" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-30T23:37:05Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-pw5x-x5jw-ccmh/GHSA-pw5x-x5jw-ccmh.json b/advisories/unreviewed/2024/01/GHSA-pw5x-x5jw-ccmh/GHSA-pw5x-x5jw-ccmh.json deleted file mode 100644 index 11b6e984068..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-pw5x-x5jw-ccmh/GHSA-pw5x-x5jw-ccmh.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-pw5x-x5jw-ccmh", - "modified": "2024-01-22T18:31:16Z", - "published": "2024-01-12T03:30:49Z", - "aliases": [ - "CVE-2016-20021" - ], - "details": "In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-20021" - }, - { - "type": "WEB", - "url": "https://bugs.gentoo.org/597800" - }, - { - "type": "WEB", - "url": "https://gitweb.gentoo.org/proj/portage.git/tree/NEWS" - }, - { - "type": "WEB", - "url": "https://wiki.gentoo.org/wiki/Portage" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-347" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-12T03:15:08Z" - } -} \ No newline at end of file