From fa65d8de3c29f9c9eaefb8ee69cc470eb7b267c3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 17 Jul 2024 18:00:40 +0000 Subject: [PATCH] Publish Advisories GHSA-g5hv-r743-v8pm GHSA-j482-47xf-p25c GHSA-g5hv-r743-v8pm GHSA-j482-47xf-p25c --- .../GHSA-g5hv-r743-v8pm.json | 73 +++++++++++++++++++ .../GHSA-j482-47xf-p25c.json | 73 +++++++++++++++++++ .../GHSA-g5hv-r743-v8pm.json | 39 ---------- .../GHSA-j482-47xf-p25c.json | 39 ---------- 4 files changed, 146 insertions(+), 78 deletions(-) create mode 100644 advisories/github-reviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json create mode 100644 advisories/github-reviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json delete mode 100644 advisories/unreviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json delete mode 100644 advisories/unreviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json diff --git a/advisories/github-reviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json b/advisories/github-reviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json new file mode 100644 index 00000000000..d249cfc1ffd --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g5hv-r743-v8pm", + "modified": "2024-07-17T17:59:44Z", + "published": "2024-07-17T09:30:49Z", + "aliases": [ + "CVE-2024-39877" + ], + "summary": "Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler", + "details": "Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.9.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39877" + }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/pull/40522" + }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/8159f6e24704f5e0e3b3217cf79ecf5083dce531" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-07-17T17:59:44Z", + "nvd_published_at": "2024-07-17T08:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json b/advisories/github-reviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json new file mode 100644 index 00000000000..9a3bdb9514a --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j482-47xf-p25c", + "modified": "2024-07-17T17:59:08Z", + "published": "2024-07-17T09:30:48Z", + "aliases": [ + "CVE-2024-39863" + ], + "summary": "Apache Airflow Potential Cross-site Scripting Vulnerability", + "details": "Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "apache-airflow" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.9.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39863" + }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/pull/40475" + }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/f18f48492dc69f392e45567580b6ddb0c070ea58" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/airflow" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-07-17T17:59:08Z", + "nvd_published_at": "2024-07-17T08:15:01Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json b/advisories/unreviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json deleted file mode 100644 index a1674370bda..00000000000 --- a/advisories/unreviewed/2024/07/GHSA-g5hv-r743-v8pm/GHSA-g5hv-r743-v8pm.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-g5hv-r743-v8pm", - "modified": "2024-07-17T09:30:49Z", - "published": "2024-07-17T09:30:49Z", - "aliases": [ - "CVE-2024-39877" - ], - "details": "Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39877" - }, - { - "type": "WEB", - "url": "https://github.com/apache/airflow/pull/40522" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-07-17T08:15:02Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json b/advisories/unreviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json deleted file mode 100644 index 4897949d888..00000000000 --- a/advisories/unreviewed/2024/07/GHSA-j482-47xf-p25c/GHSA-j482-47xf-p25c.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-j482-47xf-p25c", - "modified": "2024-07-17T09:30:49Z", - "published": "2024-07-17T09:30:48Z", - "aliases": [ - "CVE-2024-39863" - ], - "details": "Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39863" - }, - { - "type": "WEB", - "url": "https://github.com/apache/airflow/pull/40475" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread/gxkvs279f1mbvckv5q65worr6how20o3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-74" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-07-17T08:15:01Z" - } -} \ No newline at end of file