From ff502561f3410bbcc93fa538cf563dfb2422861b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 30 Sep 2024 18:52:11 +0000
Subject: [PATCH] Publish Advisories

GHSA-r4xg-4wrv-w72h
GHSA-p99h-pfg6-qrfg
---
 .../GHSA-r4xg-4wrv-w72h.json                  | 32 +++++++++++++++----
 .../GHSA-p99h-pfg6-qrfg.json                  | 12 ++++---
 2 files changed, 33 insertions(+), 11 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json (50%)

diff --git a/advisories/unreviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json b/advisories/github-reviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json
similarity index 50%
rename from advisories/unreviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json
rename to advisories/github-reviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json
index f480de5532d..099c9a4a73d 100644
--- a/advisories/unreviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json
+++ b/advisories/github-reviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json
@@ -1,12 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r4xg-4wrv-w72h",
-  "modified": "2024-04-04T03:36:20Z",
+  "modified": "2024-09-30T18:51:02Z",
   "published": "2023-04-19T21:30:27Z",
+  "withdrawn": "2024-09-30T18:51:02Z",
   "aliases": [
-    "CVE-2023-30797"
+
   ],
-  "details": "\n\nNetflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.\n\n\n",
+  "summary": "Duplicate Advisory: Lemur subject to insecure random generation",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5fqv-mpj8-h7gm. This link is maintained to preserve external references.\n\n## Original Description\nNetflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.\n\n\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -14,7 +16,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "lemur"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.3.2"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -43,8 +63,8 @@
       "CWE-330"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-09-30T18:51:02Z",
     "nvd_published_at": "2023-04-19T20:15:12Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/github-reviewed/2023/12/GHSA-p99h-pfg6-qrfg/GHSA-p99h-pfg6-qrfg.json b/advisories/github-reviewed/2023/12/GHSA-p99h-pfg6-qrfg/GHSA-p99h-pfg6-qrfg.json
index c6faa76c2ff..3c230723b76 100644
--- a/advisories/github-reviewed/2023/12/GHSA-p99h-pfg6-qrfg/GHSA-p99h-pfg6-qrfg.json
+++ b/advisories/github-reviewed/2023/12/GHSA-p99h-pfg6-qrfg/GHSA-p99h-pfg6-qrfg.json
@@ -1,13 +1,14 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p99h-pfg6-qrfg",
-  "modified": "2023-12-15T03:18:45Z",
+  "modified": "2024-09-30T18:51:33Z",
   "published": "2023-12-12T03:31:45Z",
+  "withdrawn": "2024-09-30T18:51:33Z",
   "aliases": [
-    "CVE-2023-50423"
+
   ],
-  "summary": "Privilege escalation in sap-xssec",
-  "details": "SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n",
+  "summary": "Duplicate Advisory: Privilege escalation in sap-xssec",
+  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6mjg-37cp-42x5. This link is maintained to preserve external references.\n\n## Original Description\nSAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -68,7 +69,8 @@
   "database_specific": {
     "cwe_ids": [
       "CWE-269",
-      "CWE-639"
+      "CWE-639",
+      "CWE-749"
     ],
     "severity": "CRITICAL",
     "github_reviewed": true,