Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-19 15:32:15 +00:00
parent de50c86371
commit fcc64234da
54 changed files with 406 additions and 118 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j8gh-87rx-c7w9",
-  "modified": "2024-09-19T09:36:03Z",
+  "modified": "2024-09-19T15:30:49Z",
  "published": "2024-09-17T00:31:06Z",
  "aliases": [
    "CVE-2024-45496"
@@ -48,6 +48,10 @@
      "type": "WEB",
      "url": "https://github.com/openshift/openshift-controller-manager/commit/3af3628103f9ddc3b825e6e5243ec58e85311046"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:6685"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:6687"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qqv8-ph7f-h3f7",
-  "modified": "2024-09-19T09:36:03Z",
+  "modified": "2024-09-19T15:30:49Z",
  "published": "2024-09-17T00:31:06Z",
  "aliases": [
    "CVE-2024-7387"
@@ -48,6 +48,10 @@
      "type": "WEB",
      "url": "https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:6685"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:6687"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rhfh-gm98-5fx4",
-  "modified": "2024-04-04T05:48:50Z",
+  "modified": "2024-09-19T15:30:47Z",
  "published": "2023-07-06T21:15:07Z",
  "aliases": [
    "CVE-2023-0635"
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-1391",
      "CWE-269"
    ],
    "severity": "CRITICAL",
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-22"
+      "CWE-22",
+      "CWE-23"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4w34-678c-q5hp",
-  "modified": "2023-11-15T00:31:08Z",
+  "modified": "2024-09-19T15:30:47Z",
  "published": "2023-11-15T00:31:08Z",
  "aliases": [
    "CVE-2023-43582"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-287"
+      "CWE-287",
+      "CWE-939"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cw6w-5w44-ccrq",
-  "modified": "2023-11-15T00:31:07Z",
+  "modified": "2024-09-19T15:30:47Z",
  "published": "2023-11-15T00:31:07Z",
  "aliases": [
    "CVE-2023-39199"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-325"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-46q9-5vx3-f5qh",
-  "modified": "2023-12-14T00:30:26Z",
+  "modified": "2024-09-19T15:30:47Z",
  "published": "2023-12-14T00:30:26Z",
  "aliases": [
    "CVE-2023-43583"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-798"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-311"
+      "CWE-311",
+      "CWE-319"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2hmf-4j5w-6vm3",
-  "modified": "2024-06-19T15:30:54Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-06-19T15:30:54Z",
  "aliases": [
    "CVE-2024-38590"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Modify the print level of CQE error\n\nToo much print may lead to a panic in kernel. Change ibdev_err() to\nibdev_err_ratelimited(), and change the printing level of cqe dump\nto debug level.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -51,7 +54,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:19Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2xq5-458f-5cj8",
-  "modified": "2024-06-19T15:30:53Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-06-19T15:30:53Z",
  "aliases": [
    "CVE-2024-38568"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: hisi: hns3: Fix out-of-bound access when valid event group\n\nThe perf tool allows users to create event groups through following\ncmd [1], but the driver does not check whether the array index is out\nof bounds when writing data to the event_group array. If the number of\nevents in an event_group is greater than HNS3_PMU_MAX_HW_EVENTS, the\nmemory write overflow of event_group array occurs.\n\nAdd array index check to fix the possible array out of bounds violation,\nand return directly when write new events are written to array bounds.\n\nThere are 9 different events in an event_group.\n[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -41,9 +44,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-129"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:16Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9fpr-g62f-647w",
-  "modified": "2024-07-05T09:33:44Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-06-19T15:30:54Z",
  "aliases": [
    "CVE-2024-38588"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix possible use-after-free issue in ftrace_location()\n\nKASAN reports a bug:\n\n  BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\n  Read of size 8 at addr ffff888141d40010 by task insmod/424\n  CPU: 8 PID: 424 Comm: insmod Tainted: G        W          6.9.0-rc2+\n  [...]\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcf/0x610\n   kasan_report+0xb5/0xe0\n   ftrace_location+0x90/0x120\n   register_kprobe+0x14b/0xa40\n   kprobe_init+0x2d/0xff0 [kprobe_example]\n   do_one_initcall+0x8f/0x2d0\n   do_init_module+0x13a/0x3c0\n   load_module+0x3082/0x33d0\n   init_module_from_file+0xd2/0x130\n   __x64_sys_finit_module+0x306/0x440\n   do_syscall_64+0x68/0x140\n   entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause is that, in lookup_rec(), ftrace record of some address\nis being searched in ftrace pages of some module, but those ftrace pages\nat the same time is being freed in ftrace_release_mod() as the\ncorresponding module is being deleted:\n\n           CPU1                       |      CPU2\n  register_kprobes() {                | delete_module() {\n    check_kprobe_address_safe() {     |\n      arch_check_ftrace_location() {  |\n        ftrace_location() {           |\n          lookup_rec() // USE!        |   ftrace_release_mod() // Free!\n\nTo fix this issue:\n  1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\n  2. Use ftrace_location_range() instead of lookup_rec() in\n     ftrace_location();\n  3. Call synchronize_rcu() before freeing any ftrace pages both in\n     ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -45,9 +48,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:18Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fr6h-wc99-8m37",
-  "modified": "2024-06-19T15:30:53Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-06-19T15:30:53Z",
  "aliases": [
    "CVE-2024-38569"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers/perf: hisi_pcie: Fix out-of-bound access when valid event group\n\nThe perf tool allows users to create event groups through following\ncmd [1], but the driver does not check whether the array index is out of\nbounds when writing data to the event_group array. If the number of events\nin an event_group is greater than HISI_PCIE_MAX_COUNTERS, the memory write\noverflow of event_group array occurs.\n\nAdd array index check to fix the possible array out of bounds violation,\nand return directly when write new events are written to array bounds.\n\nThere are 9 different events in an event_group.\n[1] perf stat -e '{pmu/event1/, ... ,pmu/event9/}'",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -41,9 +44,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-129"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:17Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j3jr-f652-x9f7",
-  "modified": "2024-06-19T15:30:53Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-06-19T15:30:53Z",
  "aliases": [
    "CVE-2024-38584"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()\n\nIn the prueth_probe() function, if one of the calls to emac_phy_connect()\nfails due to of_phy_connect() returning NULL, then the subsequent call to\nphy_attached_info() will dereference a NULL pointer.\n\nCheck the return code of emac_phy_connect and fail cleanly if there is an\nerror.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -37,9 +40,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:18Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-27mm-4rvr-4q6h",
-  "modified": "2024-07-27T03:30:50Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-07-27T03:30:50Z",
  "aliases": [
    "CVE-2024-1804"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7xgh-c82h-rvjj",
-  "modified": "2024-07-27T03:30:50Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-07-27T03:30:50Z",
  "aliases": [
    "CVE-2024-1798"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mpp7-xq5h-6fjh",
-  "modified": "2024-07-27T00:32:44Z",
+  "modified": "2024-09-19T15:30:48Z",
  "published": "2024-07-27T00:32:44Z",
  "aliases": [
    "CVE-2024-37034"
  ],
  "details": "An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-326"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-26T22:15:03Z"
--- a/Show More
+++ b/Show More