diff --git a/advisories/unreviewed/2022/05/GHSA-6875-ff47-r6p6/GHSA-6875-ff47-r6p6.json b/advisories/github-reviewed/2022/05/GHSA-6875-ff47-r6p6/GHSA-6875-ff47-r6p6.json similarity index 57% rename from advisories/unreviewed/2022/05/GHSA-6875-ff47-r6p6/GHSA-6875-ff47-r6p6.json rename to advisories/github-reviewed/2022/05/GHSA-6875-ff47-r6p6/GHSA-6875-ff47-r6p6.json index 88847926e62..1575973b111 100644 --- a/advisories/unreviewed/2022/05/GHSA-6875-ff47-r6p6/GHSA-6875-ff47-r6p6.json +++ b/advisories/github-reviewed/2022/05/GHSA-6875-ff47-r6p6/GHSA-6875-ff47-r6p6.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-6875-ff47-r6p6", - "modified": "2022-05-17T04:01:58Z", + "modified": "2024-11-22T20:20:13Z", "published": "2022-05-17T04:01:58Z", "aliases": [ "CVE-2015-5217" ], + "summary": "Ipsilon denial of service via a duplicate SP name", "details": "providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ipsilon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.1.0" + }, + { + "fixed": "1.2.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 1.0.1" + } + } ], "references": [ { @@ -26,6 +48,14 @@ "type": "WEB", "url": "https://fedorahosted.org/ipsilon/wiki/Releases/v1.0.1" }, + { + "type": "PACKAGE", + "url": "https://github.com/ipsilon-project/ipsilon" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ipsilon/PYSEC-2015-41.yaml" + }, { "type": "WEB", "url": "https://pagure.io/ipsilon/826e6339441546f596320f3d73304ab5f7c10de6" @@ -40,8 +70,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:20:12Z", "nvd_published_at": "2015-11-17T15:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-9qp4-79q8-58pr/GHSA-9qp4-79q8-58pr.json b/advisories/github-reviewed/2022/05/GHSA-9qp4-79q8-58pr/GHSA-9qp4-79q8-58pr.json similarity index 53% rename from advisories/unreviewed/2022/05/GHSA-9qp4-79q8-58pr/GHSA-9qp4-79q8-58pr.json rename to advisories/github-reviewed/2022/05/GHSA-9qp4-79q8-58pr/GHSA-9qp4-79q8-58pr.json index 0ac42cc133b..8a9a3b69d35 100644 --- a/advisories/unreviewed/2022/05/GHSA-9qp4-79q8-58pr/GHSA-9qp4-79q8-58pr.json +++ b/advisories/github-reviewed/2022/05/GHSA-9qp4-79q8-58pr/GHSA-9qp4-79q8-58pr.json @@ -1,17 +1,58 @@ { "schema_version": "1.4.0", "id": "GHSA-9qp4-79q8-58pr", - "modified": "2022-05-17T03:27:18Z", + "modified": "2024-11-22T20:20:08Z", "published": "2022-05-17T03:27:18Z", "aliases": [ "CVE-2015-5301" ], + "summary": "Ipsilon denial of service by deleting a SAML2 Service Provider (SP)", "details": "providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "ipsilon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.1.0" + }, + { + "fixed": "1.0.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "ipsilon" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.1.0" + }, + { + "fixed": "1.2.0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 1.1.1" + } + } ], "references": [ { @@ -30,22 +71,18 @@ "type": "WEB", "url": "https://fedorahosted.org/ipsilon/wiki/Releases/v1.1.1" }, + { + "type": "PACKAGE", + "url": "https://github.com/ipsilon-project/ipsilon" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ipsilon/PYSEC-2015-42.yaml" + }, { "type": "WEB", "url": "https://pagure.io/ipsilon/9dec97c3c83928d231ea10f4160523a13803e594" }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171052.html" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171067.html" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171076.html" - }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2015/10/27/8" @@ -56,8 +93,8 @@ ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:20:08Z", "nvd_published_at": "2015-11-17T15:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-vwp5-w4rq-g4cc/GHSA-vwp5-w4rq-g4cc.json b/advisories/github-reviewed/2022/05/GHSA-vwp5-w4rq-g4cc/GHSA-vwp5-w4rq-g4cc.json similarity index 52% rename from advisories/unreviewed/2022/05/GHSA-vwp5-w4rq-g4cc/GHSA-vwp5-w4rq-g4cc.json rename to advisories/github-reviewed/2022/05/GHSA-vwp5-w4rq-g4cc/GHSA-vwp5-w4rq-g4cc.json index 4f3e3f56543..30f58347dbe 100644 --- a/advisories/unreviewed/2022/05/GHSA-vwp5-w4rq-g4cc/GHSA-vwp5-w4rq-g4cc.json +++ b/advisories/github-reviewed/2022/05/GHSA-vwp5-w4rq-g4cc/GHSA-vwp5-w4rq-g4cc.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vwp5-w4rq-g4cc", - "modified": "2022-05-13T01:38:23Z", + "modified": "2024-11-22T20:19:16Z", "published": "2022-05-13T01:38:23Z", "aliases": [ "CVE-2017-1002153" ], + "summary": "Koji blacklisted paths workaround", "details": "Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "koji" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.15.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1002153" }, + { + "type": "PACKAGE", + "url": "https://github.com/koji-project/koji" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/koji/PYSEC-2017-144.yaml" + }, { "type": "WEB", "url": "https://pagure.io/koji/issue/563" @@ -31,8 +58,8 @@ "CWE-20" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:19:16Z", "nvd_published_at": "2017-10-06T17:29:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-xv7j-2v4w-cjvh/GHSA-xv7j-2v4w-cjvh.json b/advisories/github-reviewed/2022/05/GHSA-xv7j-2v4w-cjvh/GHSA-xv7j-2v4w-cjvh.json similarity index 75% rename from advisories/unreviewed/2022/05/GHSA-xv7j-2v4w-cjvh/GHSA-xv7j-2v4w-cjvh.json rename to advisories/github-reviewed/2022/05/GHSA-xv7j-2v4w-cjvh/GHSA-xv7j-2v4w-cjvh.json index 7f7ed02fb5a..dc05444a64b 100644 --- a/advisories/unreviewed/2022/05/GHSA-xv7j-2v4w-cjvh/GHSA-xv7j-2v4w-cjvh.json +++ b/advisories/github-reviewed/2022/05/GHSA-xv7j-2v4w-cjvh/GHSA-xv7j-2v4w-cjvh.json @@ -1,17 +1,36 @@ { "schema_version": "1.4.0", "id": "GHSA-xv7j-2v4w-cjvh", - "modified": "2022-05-05T02:48:35Z", + "modified": "2024-11-22T20:19:01Z", "published": "2022-05-05T02:48:35Z", "aliases": [ "CVE-2013-0212" ], + "summary": "OpenStack Glance logs user name and password in cleartext ", "details": "store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.", "severity": [ ], "affected": [ - + { + "package": { + "ecosystem": "PyPI", + "name": "glance" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2012.1" + }, + { + "fixed": "2012.2.3" + } + ] + } + ] + } ], "references": [ { @@ -46,6 +65,14 @@ "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=902964" }, + { + "type": "PACKAGE", + "url": "https://github.com/openstack/glance" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-37.yaml" + }, { "type": "WEB", "url": "https://launchpad.net/glance/+milestone/2012.2.3" @@ -58,14 +85,6 @@ "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0209.html" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/51957" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/51990" - }, { "type": "WEB", "url": "http://ubuntu.com/usn/usn-1710-1" @@ -80,8 +99,8 @@ "CWE-200" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-11-22T20:19:01Z", "nvd_published_at": "2013-02-24T21:55:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2023/01/GHSA-jgh8-vchw-q3g7/GHSA-jgh8-vchw-q3g7.json b/advisories/github-reviewed/2023/01/GHSA-jgh8-vchw-q3g7/GHSA-jgh8-vchw-q3g7.json index b6cab875bf2..55af5a8bcdc 100644 --- a/advisories/github-reviewed/2023/01/GHSA-jgh8-vchw-q3g7/GHSA-jgh8-vchw-q3g7.json +++ b/advisories/github-reviewed/2023/01/GHSA-jgh8-vchw-q3g7/GHSA-jgh8-vchw-q3g7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jgh8-vchw-q3g7", - "modified": "2023-02-02T18:27:22Z", + "modified": "2024-11-22T20:19:32Z", "published": "2023-01-27T01:04:27Z", "aliases": [ "CVE-2023-24622" @@ -44,6 +44,10 @@ { "type": "PACKAGE", "url": "https://github.com/IncludeSecurity/safeurl-python" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/safeurl-python/PYSEC-2023-298.yaml" } ], "database_specific": { diff --git a/advisories/github-reviewed/2023/02/GHSA-47p5-p3jw-w78w/GHSA-47p5-p3jw-w78w.json b/advisories/github-reviewed/2023/02/GHSA-47p5-p3jw-w78w/GHSA-47p5-p3jw-w78w.json index 6f51f73c7c1..9a2208cdc7e 100644 --- a/advisories/github-reviewed/2023/02/GHSA-47p5-p3jw-w78w/GHSA-47p5-p3jw-w78w.json +++ b/advisories/github-reviewed/2023/02/GHSA-47p5-p3jw-w78w/GHSA-47p5-p3jw-w78w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-47p5-p3jw-w78w", - "modified": "2023-03-03T00:02:15Z", + "modified": "2024-11-22T20:19:51Z", "published": "2023-02-17T18:30:23Z", "aliases": [ "CVE-2021-33926" @@ -44,6 +44,10 @@ "type": "PACKAGE", "url": "https://github.com/plone/Plone" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2023-289.yaml" + }, { "type": "WEB", "url": "https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf"