diff --git a/advisories/github-reviewed/2024/02/GHSA-3qx3-6hxr-j2ch/GHSA-3qx3-6hxr-j2ch.json b/advisories/github-reviewed/2024/02/GHSA-3qx3-6hxr-j2ch/GHSA-3qx3-6hxr-j2ch.json index 26ac73abc12..eecaa794acc 100644 --- a/advisories/github-reviewed/2024/02/GHSA-3qx3-6hxr-j2ch/GHSA-3qx3-6hxr-j2ch.json +++ b/advisories/github-reviewed/2024/02/GHSA-3qx3-6hxr-j2ch/GHSA-3qx3-6hxr-j2ch.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-3qx3-6hxr-j2ch", - "modified": "2024-02-08T18:47:28Z", + "modified": "2024-03-06T15:34:20Z", "published": "2024-02-08T18:47:28Z", "aliases": [ - + "CVE-2024-25817" ], "summary": "eza Potential Heap Overflow Vulnerability for AArch64", "details": "### Summary\nIn `eza`, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on `ubuntu-raspi` kernel, relating to the `.git` directory.\n\n### Details\nThe vulnerability seems to be triggered by the `.git` directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include `.git/HEAD`, `.git/refs`, and `.git/objects`.\n\nAs @polly pointed out to me, this is likely caused by [GHSA-j2v7-4f6v-gpg8](https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8), which we do seem to use currently.\n\n### PoC\nFor more information check @CuB3y0nd's blogpost [blog](https://www.cubeyond.net/blog/eza-cve-report).\n\n### Impact\nArbitrary code execution.", diff --git a/advisories/github-reviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json b/advisories/github-reviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json new file mode 100644 index 00000000000..f0d8f2b6638 --- /dev/null +++ b/advisories/github-reviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3xc6-7h59-j2x4", + "modified": "2024-03-06T15:34:11Z", + "published": "2024-03-06T00:31:27Z", + "withdrawn": "2024-03-06T15:34:11Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: eza Potential Heap Overflow Vulnerability for AArch64", + "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-3qx3-6hxr-j2ch. This link is maintained to preserve external references.\n\n## Original Description\nBuffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "eza" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.18.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25817" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-3qx3-6hxr-j2ch" + }, + { + "type": "WEB", + "url": "https://www.cubeyond.net/blog/my-cves/eza-cve-report" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-03-06T15:34:11Z", + "nvd_published_at": "2024-03-06T00:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json b/advisories/unreviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json deleted file mode 100644 index eeb9a0ca931..00000000000 --- a/advisories/unreviewed/2024/03/GHSA-3xc6-7h59-j2x4/GHSA-3xc6-7h59-j2x4.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3xc6-7h59-j2x4", - "modified": "2024-03-06T00:31:27Z", - "published": "2024-03-06T00:31:27Z", - "aliases": [ - "CVE-2024-25817" - ], - "details": "Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25817" - }, - { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-3qx3-6hxr-j2ch" - }, - { - "type": "WEB", - "url": "https://www.cubeyond.net/blog/my-cves/eza-cve-report" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-03-06T00:15:52Z" - } -} \ No newline at end of file