Publish Advisories

GHSA-3qx3-6hxr-j2ch
GHSA-3xc6-7h59-j2x4
GHSA-3xc6-7h59-j2x4

advisories/github-reviewed/2024/02/GHSA-3qx3-6hxr-j2ch/GHSA-3qx3-6hxr-j2ch.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3qx3-6hxr-j2ch",
-  "modified": "2024-02-08T18:47:28Z",
+  "modified": "2024-03-06T15:34:20Z",
   "published": "2024-02-08T18:47:28Z",
   "aliases": [
-
+    "CVE-2024-25817"
   ],
   "summary": "eza Potential Heap Overflow Vulnerability for AArch64",
   "details": "### Summary\nIn `eza`, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on `ubuntu-raspi` kernel, relating to the `.git` directory.\n\n### Details\nThe vulnerability seems to be triggered by the `.git` directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include `.git/HEAD`, `.git/refs`, and `.git/objects`.\n\nAs @polly pointed out to me, this is likely caused by [GHSA-j2v7-4f6v-gpg8](https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8), which we do seem to use currently.\n\n### PoC\nFor more information check @CuB3y0nd's blogpost [blog](https://www.cubeyond.net/blog/eza-cve-report).\n\n### Impact\nArbitrary code execution.",

advisories/github-reviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3xc6-7h59-j2x4",
+  "modified": "2024-03-06T15:34:11Z",
+  "published": "2024-03-06T00:31:27Z",
+  "withdrawn": "2024-03-06T15:34:11Z",
+  "aliases": [
+
+  ],
+  "summary": "Duplicate Advisory: eza Potential Heap Overflow Vulnerability for AArch64",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-3qx3-6hxr-j2ch. This link is maintained to preserve external references.\n\n## Original Description\nBuffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "eza"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.18.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25817"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-3qx3-6hxr-j2ch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cubeyond.net/blog/my-cves/eza-cve-report"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-03-06T15:34:11Z",
+    "nvd_published_at": "2024-03-06T00:15:52Z"
+  }
+}

advisories/unreviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json

@@ -1,39 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-3xc6-7h59-j2x4",
-  "modified": "2024-03-06T00:31:27Z",
-  "published": "2024-03-06T00:31:27Z",
-  "aliases": [
-    "CVE-2024-25817"
-  ],
-  "details": "Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25817"
-    },
-    {
-      "type": "ADVISORY",
-      "url": "https://github.com/advisories/GHSA-3qx3-6hxr-j2ch"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.cubeyond.net/blog/my-cves/eza-cve-report"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-03-06T00:15:52Z"
-  }
-}