From f924352a207ffb5a6309f438d8d8b4713016e3a0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 25 Apr 2024 19:58:27 +0000 Subject: [PATCH] Publish Advisories GHSA-9wmf-xf3h-r8pr GHSA-m9w6-wp3h-vq8g GHSA-x5m7-63c6-fx79 GHSA-x5m7-63c6-fx79 --- .../GHSA-9wmf-xf3h-r8pr.json | 37 +++++++-- .../GHSA-m9w6-wp3h-vq8g.json | 38 ++++++++- .../GHSA-x5m7-63c6-fx79.json | 77 +++++++++++++++++++ .../GHSA-x5m7-63c6-fx79.json | 42 ---------- 4 files changed, 143 insertions(+), 51 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json (57%) rename advisories/{unreviewed => github-reviewed}/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json (56%) create mode 100644 advisories/github-reviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json delete mode 100644 advisories/unreviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json diff --git a/advisories/unreviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json b/advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json similarity index 57% rename from advisories/unreviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json rename to advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json index 74b98539282..0103bb3448a 100644 --- a/advisories/unreviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json +++ b/advisories/github-reviewed/2024/04/GHSA-9wmf-xf3h-r8pr/GHSA-9wmf-xf3h-r8pr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-9wmf-xf3h-r8pr", - "modified": "2024-04-25T18:30:39Z", + "modified": "2024-04-25T19:57:35Z", "published": "2024-04-25T18:30:39Z", "aliases": [ "CVE-2024-1102" ], + "summary": "Jberet: jberet-core logging database credentials", "details": "A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.jberet:jberet-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.1.Final" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +44,10 @@ "type": "WEB", "url": "https://github.com/jberet/jsr352/issues/452" }, + { + "type": "WEB", + "url": "https://github.com/jberet/jsr352/commit/eeef999663d7da0e372aeeeac26ecf7201a3121d" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-1102" @@ -32,15 +55,19 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262060" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jberet/jsr352" } ], "database_specific": { "cwe_ids": [ - + "CWE-532" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T19:57:35Z", "nvd_published_at": "2024-04-25T17:15:47Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json b/advisories/github-reviewed/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json similarity index 56% rename from advisories/unreviewed/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json rename to advisories/github-reviewed/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json index f061a7a71d9..4ec7d849909 100644 --- a/advisories/unreviewed/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json +++ b/advisories/github-reviewed/2024/04/GHSA-m9w6-wp3h-vq8g/GHSA-m9w6-wp3h-vq8g.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-m9w6-wp3h-vq8g", - "modified": "2024-04-25T18:30:39Z", + "modified": "2024-04-25T19:57:51Z", "published": "2024-04-25T18:30:39Z", "aliases": [ "CVE-2024-0874" ], + "summary": " CoreDNS may return invalid cache entries", "details": "A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.", "severity": [ { @@ -14,7 +15,28 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/coredns/coredns" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.2" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 1.11.1" + } + } ], "references": [ { @@ -29,6 +51,10 @@ "type": "WEB", "url": "https://github.com/coredns/coredns/pull/6354" }, + { + "type": "WEB", + "url": "https://github.com/coredns/coredns/commit/997c7f953962d47c242273f0e41398fdfb5b0151" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-0874" @@ -36,6 +62,10 @@ { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219234" + }, + { + "type": "PACKAGE", + "url": "https://github.com/coredns/coredns" } ], "database_specific": { @@ -43,8 +73,8 @@ "CWE-524" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T19:57:51Z", "nvd_published_at": "2024-04-25T17:15:47Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json b/advisories/github-reviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json new file mode 100644 index 00000000000..fc4e5ac8a9d --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json @@ -0,0 +1,77 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5m7-63c6-fx79", + "modified": "2024-04-25T19:57:06Z", + "published": "2024-04-25T18:30:39Z", + "aliases": [ + "CVE-2024-1139" + ], + "summary": "Cluster Monitoring Operator contains a credentials leak", + "details": "A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "github.com/openshift/cluster-monitoring-operator" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1139" + }, + { + "type": "WEB", + "url": "https://github.com/openshift/cluster-monitoring-operator/pull/1747" + }, + { + "type": "WEB", + "url": "https://github.com/openshift/cluster-monitoring-operator/commit/1cfbe9ffafe1e43f8f87a451b72fddf5d76fa4e3" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-1139" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262158" + }, + { + "type": "PACKAGE", + "url": "https://github.com/openshift/cluster-monitoring-operator" + }, + { + "type": "WEB", + "url": "https://github.com/openshift/cluster-monitoring-operator/blob/d45a3335c2bbada0948adef9fcba55c4e14fa1d7/pkg/manifests/manifests.go#L3135" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-25T19:57:06Z", + "nvd_published_at": "2024-04-25T17:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json b/advisories/unreviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json deleted file mode 100644 index 69dc6cef9ec..00000000000 --- a/advisories/unreviewed/2024/04/GHSA-x5m7-63c6-fx79/GHSA-x5m7-63c6-fx79.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x5m7-63c6-fx79", - "modified": "2024-04-25T18:30:39Z", - "published": "2024-04-25T18:30:39Z", - "aliases": [ - "CVE-2024-1139" - ], - "details": "A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1139" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2024-1139" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262158" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-04-25T17:15:47Z" - } -} \ No newline at end of file