Publish Advisories

GHSA-mxcc-7h5m-x57r
GHSA-mfcw-83qg-4vw3
GHSA-mjmf-7wjw-f5xx

advisories/github-reviewed/2022/07/GHSA-mxcc-7h5m-x57r/GHSA-mxcc-7h5m-x57r.json

@@ -1,12 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mxcc-7h5m-x57r",
-  "modified": "2022-12-12T20:55:51Z",
+  "modified": "2024-01-05T13:44:46Z",
   "published": "2022-07-28T00:00:43Z",
   "aliases": [
     "CVE-2022-36885"
   ],
-  "summary": "Jenkins GitHub plugin 1.34.4 uses weak webhook signature function",
+  "summary": "Jenkins GitHub plugin uses weak webhook signature function",
   "details": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature. GitHub Plugin 1.34.5 uses a constant-time comparison when validating the webhook signature.\n\n",
   "severity": [
     {
@@ -43,6 +43,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/github-plugin/commit/11d1d79ebf85248dc43432389746c1ecc3452b6a"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/jenkinsci/github-plugin"

advisories/github-reviewed/2022/10/GHSA-mfcw-83qg-4vw3/GHSA-mfcw-83qg-4vw3.json

@@ -40,6 +40,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43424"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/compuware-xpediter-code-coverage-plugin/commit/e506fc9e77a2609f6a5aa331e052d35be652071c"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/jenkinsci/compuware-xpediter-code-coverage-plugin"

advisories/github-reviewed/2023/05/GHSA-mjmf-7wjw-f5xx/GHSA-mjmf-7wjw-f5xx.json

@@ -40,6 +40,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2631"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jenkinsci/codedx-plugin/commit/0214f30488ea8481f01e4b14a861e13d75bebb8b"
+    },
     {
       "type": "WEB",
       "url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3118"