diff --git a/advisories/github-reviewed/2022/07/GHSA-mxcc-7h5m-x57r/GHSA-mxcc-7h5m-x57r.json b/advisories/github-reviewed/2022/07/GHSA-mxcc-7h5m-x57r/GHSA-mxcc-7h5m-x57r.json index 1514f80a226..9f81ec66298 100644 --- a/advisories/github-reviewed/2022/07/GHSA-mxcc-7h5m-x57r/GHSA-mxcc-7h5m-x57r.json +++ b/advisories/github-reviewed/2022/07/GHSA-mxcc-7h5m-x57r/GHSA-mxcc-7h5m-x57r.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-mxcc-7h5m-x57r", - "modified": "2022-12-12T20:55:51Z", + "modified": "2024-01-05T13:44:46Z", "published": "2022-07-28T00:00:43Z", "aliases": [ "CVE-2022-36885" ], - "summary": "Jenkins GitHub plugin 1.34.4 uses weak webhook signature function", + "summary": "Jenkins GitHub plugin uses weak webhook signature function", "details": "Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature. GitHub Plugin 1.34.5 uses a constant-time comparison when validating the webhook signature.\n\n", "severity": [ { @@ -43,6 +43,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36885" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/github-plugin/commit/11d1d79ebf85248dc43432389746c1ecc3452b6a" + }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/github-plugin" diff --git a/advisories/github-reviewed/2022/10/GHSA-mfcw-83qg-4vw3/GHSA-mfcw-83qg-4vw3.json b/advisories/github-reviewed/2022/10/GHSA-mfcw-83qg-4vw3/GHSA-mfcw-83qg-4vw3.json index f0944906a86..480f1d0b02a 100644 --- a/advisories/github-reviewed/2022/10/GHSA-mfcw-83qg-4vw3/GHSA-mfcw-83qg-4vw3.json +++ b/advisories/github-reviewed/2022/10/GHSA-mfcw-83qg-4vw3/GHSA-mfcw-83qg-4vw3.json @@ -40,6 +40,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43424" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/compuware-xpediter-code-coverage-plugin/commit/e506fc9e77a2609f6a5aa331e052d35be652071c" + }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/compuware-xpediter-code-coverage-plugin" diff --git a/advisories/github-reviewed/2023/05/GHSA-mjmf-7wjw-f5xx/GHSA-mjmf-7wjw-f5xx.json b/advisories/github-reviewed/2023/05/GHSA-mjmf-7wjw-f5xx/GHSA-mjmf-7wjw-f5xx.json index e3d5570593c..1427761402e 100644 --- a/advisories/github-reviewed/2023/05/GHSA-mjmf-7wjw-f5xx/GHSA-mjmf-7wjw-f5xx.json +++ b/advisories/github-reviewed/2023/05/GHSA-mjmf-7wjw-f5xx/GHSA-mjmf-7wjw-f5xx.json @@ -40,6 +40,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2631" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/codedx-plugin/commit/0214f30488ea8481f01e4b14a861e13d75bebb8b" + }, { "type": "WEB", "url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3118"