netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-g5hv-r743-v8pm
GHSA-j482-47xf-p25c
GHSA-g5hv-r743-v8pm
GHSA-j482-47xf-p25c
This commit is contained in:
advisory-database[bot]
2024-07-17 18:00:40 +00:00
parent 89144fb7e4
commit fa65d8de3c
4 changed files with 146 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5hv-r743-v8pm",
"modified": "2024-07-17T17:59:44Z",
"published": "2024-07-17T09:30:49Z",
"aliases": [
"CVE-2024-39877"
],
"summary": "Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler",
"details": "Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.9.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39877"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/40522"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/8159f6e24704f5e0e3b3217cf79ecf5083dce531"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-07-17T17:59:44Z",
"nvd_published_at": "2024-07-17T08:15:02Z"
}
}
advisories/github-reviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j482-47xf-p25c",
"modified": "2024-07-17T17:59:08Z",
"published": "2024-07-17T09:30:48Z",
"aliases": [
"CVE-2024-39863"
],
"summary": "Apache Airflow Potential Cross-site Scripting Vulnerability",
"details": "Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39863"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/40475"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/f18f48492dc69f392e45567580b6ddb0c070ea58"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-07-17T17:59:08Z",
"nvd_published_at": "2024-07-17T08:15:01Z"
}
}
advisories/unreviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5hv-r743-v8pm",
"modified": "2024-07-17T09:30:49Z",
"published": "2024-07-17T09:30:49Z",
"aliases": [
"CVE-2024-39877"
],
"details": "Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39877"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/40522"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-17T08:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j482-47xf-p25c",
"modified": "2024-07-17T09:30:49Z",
"published": "2024-07-17T09:30:48Z",
"aliases": [
"CVE-2024-39863"
],
"details": "Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39863"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/40475"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-17T08:15:01Z"
}
}