From ec59940e8205d23e4f244a13652125a9d31c0f6b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 16 Sep 2024 22:13:17 +0000
Subject: [PATCH] Publish Advisories

GHSA-vx6v-xg64-pmr8
GHSA-qgvw-qc2q-gv5q
---
 .../GHSA-vx6v-xg64-pmr8.json                  | 25 ++++++++++++++++---
 .../GHSA-qgvw-qc2q-gv5q.json                  | 17 ++++++++++---
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/advisories/github-reviewed/2021/11/GHSA-vx6v-xg64-pmr8/GHSA-vx6v-xg64-pmr8.json b/advisories/github-reviewed/2021/11/GHSA-vx6v-xg64-pmr8/GHSA-vx6v-xg64-pmr8.json
index 3ad0868e882..f542f425373 100644
--- a/advisories/github-reviewed/2021/11/GHSA-vx6v-xg64-pmr8/GHSA-vx6v-xg64-pmr8.json
+++ b/advisories/github-reviewed/2021/11/GHSA-vx6v-xg64-pmr8/GHSA-vx6v-xg64-pmr8.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vx6v-xg64-pmr8",
-  "modified": "2021-11-17T21:10:26Z",
+  "modified": "2024-09-16T22:11:51Z",
   "published": "2021-11-15T23:12:41Z",
   "aliases": [
     "CVE-2021-3945"
@@ -12,6 +12,10 @@
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
@@ -28,11 +32,14 @@
               "introduced": "0"
             },
             {
-              "last_affected": "0.3.0"
+              "fixed": "0.3.1"
             }
           ]
         }
-      ]
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.3.0"
+      }
     }
   ],
   "references": [
@@ -44,10 +51,22 @@
       "type": "WEB",
       "url": "https://github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/django-helpdesk/django-helpdesk/commit/44abb197120a843cce5b5fe8276e4a44b8bb2f48"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-vx6v-xg64-pmr8"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/django-helpdesk/django-helpdesk"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django-helpdesk/PYSEC-2021-430.yaml"
+    },
     {
       "type": "WEB",
       "url": "https://huntr.dev/bounties/745f483c-70ed-441f-ab2e-7ac1305439a4"
diff --git a/advisories/github-reviewed/2022/05/GHSA-qgvw-qc2q-gv5q/GHSA-qgvw-qc2q-gv5q.json b/advisories/github-reviewed/2022/05/GHSA-qgvw-qc2q-gv5q/GHSA-qgvw-qc2q-gv5q.json
index e78412b147b..5d4a9bd55b2 100644
--- a/advisories/github-reviewed/2022/05/GHSA-qgvw-qc2q-gv5q/GHSA-qgvw-qc2q-gv5q.json
+++ b/advisories/github-reviewed/2022/05/GHSA-qgvw-qc2q-gv5q/GHSA-qgvw-qc2q-gv5q.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qgvw-qc2q-gv5q",
-  "modified": "2024-01-12T20:55:43Z",
+  "modified": "2024-09-16T22:12:36Z",
   "published": "2022-05-14T03:08:09Z",
   "aliases": [
     "CVE-2011-4104"
@@ -9,7 +9,14 @@
   "summary": "Django Tastypie Improper Deserialization of YAML Data",
   "details": "The `from_yaml` method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -41,6 +48,10 @@
       "type": "WEB",
       "url": "https://github.com/toastdriven/django-tastypie/commit/e8af315211b07c8f48f32a063233cc3f76dd5bc2"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django-tastypie/PYSEC-2014-25.yaml"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/toastdriven/django-tastypie"
@@ -66,7 +77,7 @@
     "cwe_ids": [
       "CWE-502"
     ],
-    "severity": "HIGH",
+    "severity": "CRITICAL",
     "github_reviewed": true,
     "github_reviewed_at": "2024-01-12T20:55:43Z",
     "nvd_published_at": "2014-10-27T01:55:00Z"