diff --git a/advisories/github-reviewed/2023/05/GHSA-7g2v-2frm-rg94/GHSA-7g2v-2frm-rg94.json b/advisories/github-reviewed/2023/05/GHSA-7g2v-2frm-rg94/GHSA-7g2v-2frm-rg94.json new file mode 100644 index 00000000000..4c31c01b90e --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-7g2v-2frm-rg94/GHSA-7g2v-2frm-rg94.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7g2v-2frm-rg94", + "modified": "2023-05-12T20:17:25Z", + "published": "2023-05-12T09:30:15Z", + "aliases": [ + "CVE-2023-2515" + ], + "summary": "Mattermost Incorrect Authorization vulnerability", + "details": "Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "7.1.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.2.0" + }, + { + "fixed": "7.7.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.8.0" + }, + { + "fixed": "7.8.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "github.com/mattermost/mattermost-server/v6" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.9.0" + }, + { + "fixed": "7.9.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2515" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/mattermost-server" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:17:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-g8ph-74m6-8m7r/GHSA-g8ph-74m6-8m7r.json b/advisories/github-reviewed/2023/05/GHSA-g8ph-74m6-8m7r/GHSA-g8ph-74m6-8m7r.json new file mode 100644 index 00000000000..b3230172bcb --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-g8ph-74m6-8m7r/GHSA-g8ph-74m6-8m7r.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g8ph-74m6-8m7r", + "modified": "2023-05-12T20:18:51Z", + "published": "2023-05-12T20:18:51Z", + "aliases": [ + + ], + "summary": "ClickHouse vulnerable to client certificate password exposure in client exception", + "details": "### Summary\nAs initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option `sslkey`) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy.\n\n### Details\nDuring the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties.\n\n### Impact\nThis vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.clickhouse:clickhouse-client" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.clickhouse:clickhouse-jdbc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.4.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "com.clickhouse:clickhouse-r2dbc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.4.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r" + }, + { + "type": "WEB", + "url": "https://github.com/ClickHouse/clickhouse-java/issues/1331" + }, + { + "type": "WEB", + "url": "https://github.com/ClickHouse/clickhouse-java/pull/1334" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ClickHouse/clickhouse-java" + }, + { + "type": "WEB", + "url": "https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:18:51Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-mg5h-f3q8-c96g/GHSA-mg5h-f3q8-c96g.json b/advisories/github-reviewed/2023/05/GHSA-mg5h-f3q8-c96g/GHSA-mg5h-f3q8-c96g.json new file mode 100644 index 00000000000..6f354253b6d --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-mg5h-f3q8-c96g/GHSA-mg5h-f3q8-c96g.json @@ -0,0 +1,74 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mg5h-f3q8-c96g", + "modified": "2023-05-12T20:18:22Z", + "published": "2023-05-12T09:30:14Z", + "aliases": [ + "CVE-2023-29246" + ], + "summary": "Apache OpenMeetings vulnerable to remote code execution via null-bye injection", + "details": "An attacker who has gained access to an admin account can perform RCE via null-byte injection\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.openmeetings:openmeetings-parent" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "7.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29246" + }, + { + "type": "WEB", + "url": "https://github.com/apache/openmeetings/commit/8e65a1344157b2898f2922d49a0bd2105687c4a5" + }, + { + "type": "WEB", + "url": "https://github.com/apache/openmeetings/commit/9f12a48994d0ad741ac140c52cbd2152f0d048d5" + }, + { + "type": "WEB", + "url": "https://github.com/apache/openmeetings/commit/f91ff1917027625f066a9007694a31d06e69df3a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/openmeetings" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/OPENMEETINGS-2765" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/230plvhbdx26m43b0sy942wlwt6kkmmr" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:18:22Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2023/05/GHSA-v9rm-7rv9-r3fw/GHSA-v9rm-7rv9-r3fw.json b/advisories/github-reviewed/2023/05/GHSA-v9rm-7rv9-r3fw/GHSA-v9rm-7rv9-r3fw.json new file mode 100644 index 00000000000..1b1408b84c9 --- /dev/null +++ b/advisories/github-reviewed/2023/05/GHSA-v9rm-7rv9-r3fw/GHSA-v9rm-7rv9-r3fw.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9rm-7rv9-r3fw", + "modified": "2023-05-12T20:17:54Z", + "published": "2023-05-12T09:30:15Z", + "aliases": [ + "CVE-2023-29032" + ], + "summary": "Apache OpenMeetings Improper Authentication vulnerability", + "details": "An attacker that has gained access to certain private information can use this to act as other user.\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.openmeetings:openmeetings-parent" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.3" + }, + { + "fixed": "7.1.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29032" + }, + { + "type": "WEB", + "url": "https://github.com/apache/openmeetings/commit/4e89e0ca076c83f26562f1146cf3e81ba0b16a7f" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/openmeetings" + }, + { + "type": "WEB", + "url": "https://issues.apache.org/jira/browse/OPENMEETINGS-2764" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/j2d6mg3rzcphfd8vvvk09d8p4o9lvnqp" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2023-05-12T20:17:54Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/05/GHSA-7g2v-2frm-rg94/GHSA-7g2v-2frm-rg94.json b/advisories/unreviewed/2023/05/GHSA-7g2v-2frm-rg94/GHSA-7g2v-2frm-rg94.json deleted file mode 100644 index 8f57e7b0c63..00000000000 --- a/advisories/unreviewed/2023/05/GHSA-7g2v-2frm-rg94/GHSA-7g2v-2frm-rg94.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-7g2v-2frm-rg94", - "modified": "2023-05-12T09:30:15Z", - "published": "2023-05-12T09:30:15Z", - "aliases": [ - "CVE-2023-2515" - ], - "details": "Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin\n", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2515" - }, - { - "type": "WEB", - "url": "https://mattermost.com/security-updates" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-863" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/05/GHSA-mg5h-f3q8-c96g/GHSA-mg5h-f3q8-c96g.json b/advisories/unreviewed/2023/05/GHSA-mg5h-f3q8-c96g/GHSA-mg5h-f3q8-c96g.json deleted file mode 100644 index 87f24417b31..00000000000 --- a/advisories/unreviewed/2023/05/GHSA-mg5h-f3q8-c96g/GHSA-mg5h-f3q8-c96g.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mg5h-f3q8-c96g", - "modified": "2023-05-12T09:30:14Z", - "published": "2023-05-12T09:30:14Z", - "aliases": [ - "CVE-2023-29246" - ], - "details": "An attacker who has gained access to an admin account can perform RCE via null-byte injection\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29246" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/230plvhbdx26m43b0sy942wlwt6kkmmr" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2023/05/GHSA-v9rm-7rv9-r3fw/GHSA-v9rm-7rv9-r3fw.json b/advisories/unreviewed/2023/05/GHSA-v9rm-7rv9-r3fw/GHSA-v9rm-7rv9-r3fw.json deleted file mode 100644 index 2a66ef0c8d6..00000000000 --- a/advisories/unreviewed/2023/05/GHSA-v9rm-7rv9-r3fw/GHSA-v9rm-7rv9-r3fw.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-v9rm-7rv9-r3fw", - "modified": "2023-05-12T09:30:15Z", - "published": "2023-05-12T09:30:15Z", - "aliases": [ - "CVE-2023-29032" - ], - "details": "An attacker that has gained access to certain private information can use this to act as other user.\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29032" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/j2d6mg3rzcphfd8vvvk09d8p4o9lvnqp" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-287" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": null - } -} \ No newline at end of file