From fc18fd0937f44a5a249ac31f3c24f3915443f3b0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 9 Oct 2024 19:44:50 +0000 Subject: [PATCH] Publish Advisories GHSA-hggx-3h72-49ww GHSA-8843-m7mw-mxqm GHSA-4cvp-hr63-822j GHSA-66m2-493m-crh2 GHSA-cgwc-qvrx-rf7f GHSA-pp84-v3mw-gg4w --- .../GHSA-hggx-3h72-49ww/GHSA-hggx-3h72-49ww.json | 12 ++++++++++-- .../GHSA-8843-m7mw-mxqm/GHSA-8843-m7mw-mxqm.json | 16 ++++++++++++++-- .../GHSA-4cvp-hr63-822j/GHSA-4cvp-hr63-822j.json | 3 ++- .../GHSA-66m2-493m-crh2/GHSA-66m2-493m-crh2.json | 3 ++- .../GHSA-cgwc-qvrx-rf7f/GHSA-cgwc-qvrx-rf7f.json | 1 + .../GHSA-pp84-v3mw-gg4w/GHSA-pp84-v3mw-gg4w.json | 4 ++-- 6 files changed, 31 insertions(+), 8 deletions(-) diff --git a/advisories/github-reviewed/2018/07/GHSA-hggx-3h72-49ww/GHSA-hggx-3h72-49ww.json b/advisories/github-reviewed/2018/07/GHSA-hggx-3h72-49ww/GHSA-hggx-3h72-49ww.json index d01ff444968..b917547400a 100644 --- a/advisories/github-reviewed/2018/07/GHSA-hggx-3h72-49ww/GHSA-hggx-3h72-49ww.json +++ b/advisories/github-reviewed/2018/07/GHSA-hggx-3h72-49ww/GHSA-hggx-3h72-49ww.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hggx-3h72-49ww", - "modified": "2023-09-05T09:22:11Z", + "modified": "2024-10-09T19:42:52Z", "published": "2018-07-24T20:03:51Z", "aliases": [ "CVE-2016-0740" @@ -12,13 +12,17 @@ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "Pillow" + "name": "pillow" }, "ranges": [ { @@ -48,6 +52,10 @@ "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-hggx-3h72-49ww" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2016-5.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/python-pillow/Pillow" diff --git a/advisories/github-reviewed/2020/07/GHSA-8843-m7mw-mxqm/GHSA-8843-m7mw-mxqm.json b/advisories/github-reviewed/2020/07/GHSA-8843-m7mw-mxqm/GHSA-8843-m7mw-mxqm.json index 51aaa69c917..9ef0f071bd1 100644 --- a/advisories/github-reviewed/2020/07/GHSA-8843-m7mw-mxqm/GHSA-8843-m7mw-mxqm.json +++ b/advisories/github-reviewed/2020/07/GHSA-8843-m7mw-mxqm/GHSA-8843-m7mw-mxqm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8843-m7mw-mxqm", - "modified": "2023-09-05T09:17:03Z", + "modified": "2024-10-09T19:44:21Z", "published": "2020-07-27T21:52:41Z", "aliases": [ "CVE-2020-10379" @@ -12,13 +12,17 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "Pillow" + "name": "pillow" }, "ranges": [ { @@ -52,6 +56,14 @@ "type": "WEB", "url": "https://github.com/python-pillow/Pillow/commit/46f4a349b88915787fea3fb91348bb1665831bbb#diff-9478f2787e3ae9668a15123b165c23ac" }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-8843-m7mw-mxqm" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2020-78.yaml" + }, { "type": "PACKAGE", "url": "https://github.com/python-pillow/Pillow" diff --git a/advisories/github-reviewed/2023/05/GHSA-4cvp-hr63-822j/GHSA-4cvp-hr63-822j.json b/advisories/github-reviewed/2023/05/GHSA-4cvp-hr63-822j/GHSA-4cvp-hr63-822j.json index 8e1b5255545..617d1c8d91b 100644 --- a/advisories/github-reviewed/2023/05/GHSA-4cvp-hr63-822j/GHSA-4cvp-hr63-822j.json +++ b/advisories/github-reviewed/2023/05/GHSA-4cvp-hr63-822j/GHSA-4cvp-hr63-822j.json @@ -82,7 +82,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-209" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2023/09/GHSA-66m2-493m-crh2/GHSA-66m2-493m-crh2.json b/advisories/github-reviewed/2023/09/GHSA-66m2-493m-crh2/GHSA-66m2-493m-crh2.json index 1b4d8cb20b2..5625271b3f7 100644 --- a/advisories/github-reviewed/2023/09/GHSA-66m2-493m-crh2/GHSA-66m2-493m-crh2.json +++ b/advisories/github-reviewed/2023/09/GHSA-66m2-493m-crh2/GHSA-66m2-493m-crh2.json @@ -74,7 +74,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-94" ], "severity": "CRITICAL", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/06/GHSA-cgwc-qvrx-rf7f/GHSA-cgwc-qvrx-rf7f.json b/advisories/github-reviewed/2024/06/GHSA-cgwc-qvrx-rf7f/GHSA-cgwc-qvrx-rf7f.json index 476f7bf58d7..6908a66ec5e 100644 --- a/advisories/github-reviewed/2024/06/GHSA-cgwc-qvrx-rf7f/GHSA-cgwc-qvrx-rf7f.json +++ b/advisories/github-reviewed/2024/06/GHSA-cgwc-qvrx-rf7f/GHSA-cgwc-qvrx-rf7f.json @@ -51,6 +51,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-913", "CWE-915" ], "severity": "CRITICAL", diff --git a/advisories/github-reviewed/2024/08/GHSA-pp84-v3mw-gg4w/GHSA-pp84-v3mw-gg4w.json b/advisories/github-reviewed/2024/08/GHSA-pp84-v3mw-gg4w/GHSA-pp84-v3mw-gg4w.json index 878c406028b..fc90c32bd57 100644 --- a/advisories/github-reviewed/2024/08/GHSA-pp84-v3mw-gg4w/GHSA-pp84-v3mw-gg4w.json +++ b/advisories/github-reviewed/2024/08/GHSA-pp84-v3mw-gg4w/GHSA-pp84-v3mw-gg4w.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-pp84-v3mw-gg4w", - "modified": "2024-10-07T16:50:25Z", + "modified": "2024-10-09T19:42:44Z", "published": "2024-08-27T19:50:54Z", "aliases": [ ], "summary": "Taipy 3.1.1 affected by CVEs on flask-core and pymongo", - "details": "### Summary\nCVEs on latest 3.1.1\n\n### Details\n## SECURITY ISSUES\n### CVE-2024-1681: flask-core <4.0.1 \nlatest version of taipi 3.1.1 needs <=4.0.0 \n\n### CVE-2024-5629: pymongo <4.6.3 \n#latest version of taipi 3.1.1 needs <=4.6.1 \n\n### PoC\nplease upgrade to these versions \n\n### Impact\npre-commit breaks\n", + "details": "### Summary\nCVEs on 3.1.1\n\nFixed on patch versions: >=3.1.2 \nand on major releases: >=4.0.0\n\n### Details\n\n### CVE-2024-1681: flask-core <4.0.1 \nlatest version of taipy 3.1.1 needs <=4.0.0 \n\n### CVE-2024-5629: pymongo <4.6.3 \nlatest version of taipy 3.1.1 needs <=4.6.1 \n\n### PoC\nplease upgrade to these versions \n\n### Impact\npre-commit breaks", "severity": [ ],