From ee77ada6f0862743e1ab79a64073ce7abe5e7bf4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 29 Jan 2025 19:21:46 +0000 Subject: [PATCH] Publish Advisories GHSA-c476-j253-5rgq GHSA-h5jh-rp76-q242 GHSA-qq5h-rjj9-q9qg GHSA-v664-qgx9-wf79 GHSA-v664-qgx9-wf79 --- .../GHSA-c476-j253-5rgq.json | 31 ++++++-- .../GHSA-h5jh-rp76-q242.json | 44 +++++++++-- .../GHSA-qq5h-rjj9-q9qg.json | 31 ++++++-- .../GHSA-v664-qgx9-wf79.json | 74 +++++++++++++++++++ .../GHSA-v664-qgx9-wf79.json | 37 ---------- 5 files changed, 162 insertions(+), 55 deletions(-) rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json (70%) rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json (53%) rename advisories/{unreviewed => github-reviewed}/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json (64%) create mode 100644 advisories/github-reviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json delete mode 100644 advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json diff --git a/advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json b/advisories/github-reviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json similarity index 70% rename from advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json rename to advisories/github-reviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json index 5ba6731af24..aa126668360 100644 --- a/advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json +++ b/advisories/github-reviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c476-j253-5rgq", - "modified": "2025-01-29T15:31:34Z", + "modified": "2025-01-29T19:20:08Z", "published": "2025-01-29T00:31:54Z", "aliases": [ "CVE-2024-29869" ], + "summary": "Apache Hive Incorrectly Assigns Permissions for a Critical Resource", "details": "Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.hive:hive-exec" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.0.1" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -24,7 +45,7 @@ "url": "https://github.com/apache/hive/commit/20106e254527f7d71b2e34455c4322e14950c620" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/apache/hive" }, { @@ -45,8 +66,8 @@ "CWE-732" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-01-29T19:20:08Z", "nvd_published_at": "2025-01-28T22:15:15Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json b/advisories/github-reviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json similarity index 53% rename from advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json rename to advisories/github-reviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json index c357873a4c1..4f8253792a0 100644 --- a/advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json +++ b/advisories/github-reviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json @@ -1,21 +1,47 @@ { "schema_version": "1.4.0", "id": "GHSA-h5jh-rp76-q242", - "modified": "2025-01-29T15:31:35Z", + "modified": "2025-01-29T19:20:33Z", "published": "2025-01-29T15:31:35Z", "aliases": [ "CVE-2024-57438" ], + "summary": "RuoYi has insecure permissions", "details": "Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.ruoyi:ruoyi" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.8.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57438" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://gitee.com/y_project/RuoYi" }, { @@ -32,10 +58,12 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-01-29T19:20:33Z", "nvd_published_at": "2025-01-29T15:15:17Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json b/advisories/github-reviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json similarity index 64% rename from advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json rename to advisories/github-reviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json index ad85b37bfb7..38d5d5b3519 100644 --- a/advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json +++ b/advisories/github-reviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-qq5h-rjj9-q9qg", - "modified": "2025-01-29T18:31:22Z", + "modified": "2025-01-29T19:20:35Z", "published": "2025-01-29T15:31:35Z", "aliases": [ "CVE-2024-57439" ], + "summary": "RuoYi vulnerable to Denial of Service by attackers with admin privileges", "details": "An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.", "severity": [ { @@ -13,14 +14,34 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.ruoyi:ruoyi" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.8.0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57439" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://gitee.com/y_project/RuoYi" }, { @@ -41,8 +62,8 @@ "CWE-281" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-01-29T19:20:35Z", "nvd_published_at": "2025-01-29T15:15:17Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json b/advisories/github-reviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json new file mode 100644 index 00000000000..c21407378e4 --- /dev/null +++ b/advisories/github-reviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v664-qgx9-wf79", + "modified": "2025-01-29T19:20:31Z", + "published": "2025-01-29T15:31:35Z", + "aliases": [ + "CVE-2024-57436" + ], + "summary": "RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring", + "details": "RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.ruoyi:ruoyi" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.8.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57436" + }, + { + "type": "PACKAGE", + "url": "https://gitee.com/y_project/RuoYi" + }, + { + "type": "WEB", + "url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md" + }, + { + "type": "WEB", + "url": "https://github.com/yangzongzhuan/RuoYi" + }, + { + "type": "WEB", + "url": "https://ruoyi.vip" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-922" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-01-29T19:20:31Z", + "nvd_published_at": "2025-01-29T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json b/advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json deleted file mode 100644 index 5046634d59d..00000000000 --- a/advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v664-qgx9-wf79", - "modified": "2025-01-29T15:31:35Z", - "published": "2025-01-29T15:31:35Z", - "aliases": [ - "CVE-2024-57436" - ], - "details": "RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57436" - }, - { - "type": "WEB", - "url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md" - }, - { - "type": "WEB", - "url": "https://github.com/yangzongzhuan/RuoYi" - }, - { - "type": "WEB", - "url": "https://ruoyi.vip" - } - ], - "database_specific": { - "cwe_ids": [], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-01-29T15:15:17Z" - } -} \ No newline at end of file