714 lines
24 KiB
JSON
714 lines
24 KiB
JSON
[
|
|
{
|
|
"id": "GHSA-wv4w-6qv2-qqfg",
|
|
"summary": "Python Social Auth - Django has unsafe account association ",
|
|
"details": "### Impact\n\nUpon authentication, the user could be associated by e-mail even if the \u0060associate_by_email\u0060 pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn\u0027t require unique e-mail addresses.\n\n### Patches\n\n* https://github.com/python-social-auth/social-app-django/pull/803\n\n### Workarounds\n\nReview the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.",
|
|
"aliases": [
|
|
"CVE-2025-61783"
|
|
],
|
|
"modified": "2025-10-09T17:57:29.916841Z",
|
|
"published": "2025-10-09T17:08:05Z",
|
|
"database_specific": {
|
|
"github_reviewed_at": "2025-10-09T17:08:05Z",
|
|
"severity": "MODERATE",
|
|
"cwe_ids": [
|
|
"CWE-290"
|
|
],
|
|
"github_reviewed": true,
|
|
"nvd_published_at": null
|
|
},
|
|
"references": [
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/python-social-auth/social-app-django/issues/220"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/python-social-auth/social-app-django/issues/231"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/python-social-auth/social-app-django/issues/634"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/python-social-auth/social-app-django/pull/803"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c"
|
|
},
|
|
{
|
|
"type": "PACKAGE",
|
|
"url": "https://github.com/python-social-auth/social-app-django"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"name": "social-auth-app-django",
|
|
"ecosystem": "PyPI",
|
|
"purl": "pkg:pypi/social-auth-app-django"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "0"
|
|
},
|
|
{
|
|
"fixed": "5.6.0"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"0.0.1",
|
|
"0.1.0",
|
|
"1.0.0",
|
|
"1.0.1",
|
|
"1.1.0",
|
|
"1.2.0",
|
|
"2.0.0",
|
|
"2.1.0",
|
|
"3.0.0",
|
|
"3.1.0",
|
|
"3.3.0",
|
|
"3.4.0",
|
|
"4.0.0",
|
|
"5.0.0",
|
|
"5.1.0",
|
|
"5.2.0",
|
|
"5.3.0",
|
|
"5.4.0",
|
|
"5.4.1",
|
|
"5.4.2",
|
|
"5.4.3",
|
|
"5.5.0",
|
|
"5.5.1"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-wv4w-6qv2-qqfg/GHSA-wv4w-6qv2-qqfg.json"
|
|
}
|
|
}
|
|
],
|
|
"schema_version": "1.7.3",
|
|
"severity": [
|
|
{
|
|
"type": "CVSS_V4",
|
|
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "GHSA-cjjf-27cc-pvmv",
|
|
"summary": "pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters",
|
|
"details": "### Summary\npyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click\u0027N\u0027Load (CNL) Blueprint. This flaw allowed untrusted user input to be processed unsafely, which could be exploited by an attacker to inject arbitrary content into the web UI or manipulate request handling. The vulnerability could lead to client-side code execution (XSS) or other unintended behaviors when a malicious payload is submitted.\n\nuser-supplied parameters from HTTP requests were not adequately validated or sanitized before being passed into the application logic and response generation. This allowed crafted input to alter the expected execution flow.\n CNL (Click\u0027N\u0027Load) blueprint exposed unsafe handling of untrusted parameters in HTTP requests. The application did not consistently enforce input validation or encoding, making it possible for an attacker to craft malicious requests.\n\n### PoC\n\n1. Run a vulnerable version of pyLoad prior to commit [\u0060f9d27f2\u0060](https://github.com/pyload/pyload/pull/4624).\n2. Start the web UI and access the Captcha or CNL endpoints.\n3. Submit a crafted request containing malicious JavaScript payloads in unvalidated parameters (\u0060/flash/addcrypted2?jk=function(){alert(1)}\u0026crypted=12345\u0060).\n4. Observe that the payload is reflected and executed in the client\u2019s browser, demonstrating cross-site scripting (XSS).\n\nExample request:\n\n\u0060\u0060\u0060http\nGET /flash/addcrypted2?jk=function(){alert(1)}\u0026crypted=12345 HTTP/1.1\nHost: 127.0.0.1:8000\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 107\n\u0060\u0060\u0060\n\n### Impact\n\nExploiting this vulnerability allows an attacker to inject and execute arbitrary JavaScript within the browser session of a user accessing the pyLoad Web UI. In practice, this means an attacker could impersonate an administrator, steal authentication cookies or tokens, and perform unauthorized actions on behalf of the victim. Because the affected endpoints are part of the core interface, a successful attack undermines the trust and security of the entire application, potentially leading to a full compromise of the management interface and the data it controls. The impact is particularly severe in cases where the Web UI is exposed over a network without additional access restrictions, as it enables remote attackers to directly target users with crafted links or requests that trigger the vulnerability.",
|
|
"aliases": [
|
|
"CVE-2025-61773"
|
|
],
|
|
"modified": "2025-10-09T15:59:13.250015Z",
|
|
"published": "2025-10-09T15:19:48Z",
|
|
"database_specific": {
|
|
"github_reviewed_at": "2025-10-09T15:19:48Z",
|
|
"github_reviewed": true,
|
|
"cwe_ids": [
|
|
"CWE-116",
|
|
"CWE-74",
|
|
"CWE-79",
|
|
"CWE-94"
|
|
],
|
|
"severity": "HIGH",
|
|
"nvd_published_at": null
|
|
},
|
|
"references": [
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-cjjf-27cc-pvmv"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/pyload/pyload/pull/4624"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/pyload/pyload/commit/5823327d0b797161c7195a1f660266d30a69f0ca"
|
|
},
|
|
{
|
|
"type": "PACKAGE",
|
|
"url": "https://github.com/pyload/pyload"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"name": "pyload-ng",
|
|
"ecosystem": "PyPI",
|
|
"purl": "pkg:pypi/pyload-ng"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "0"
|
|
},
|
|
{
|
|
"fixed": "0.5.0b3.dev91"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"0.5.0a5.dev528",
|
|
"0.5.0a5.dev532",
|
|
"0.5.0a5.dev535",
|
|
"0.5.0a5.dev536",
|
|
"0.5.0a5.dev537",
|
|
"0.5.0a5.dev539",
|
|
"0.5.0a5.dev540",
|
|
"0.5.0a5.dev545",
|
|
"0.5.0a5.dev562",
|
|
"0.5.0a5.dev564",
|
|
"0.5.0a5.dev565",
|
|
"0.5.0a6.dev570",
|
|
"0.5.0a6.dev578",
|
|
"0.5.0a6.dev587",
|
|
"0.5.0a7.dev596",
|
|
"0.5.0a8.dev602",
|
|
"0.5.0a9.dev615",
|
|
"0.5.0a9.dev629",
|
|
"0.5.0a9.dev632",
|
|
"0.5.0a9.dev641",
|
|
"0.5.0a9.dev643",
|
|
"0.5.0a9.dev655",
|
|
"0.5.0a9.dev806",
|
|
"0.5.0b1.dev1",
|
|
"0.5.0b1.dev2",
|
|
"0.5.0b1.dev3",
|
|
"0.5.0b1.dev4",
|
|
"0.5.0b1.dev5",
|
|
"0.5.0b2.dev10",
|
|
"0.5.0b2.dev11",
|
|
"0.5.0b2.dev12",
|
|
"0.5.0b2.dev9",
|
|
"0.5.0b3.dev13",
|
|
"0.5.0b3.dev14",
|
|
"0.5.0b3.dev17",
|
|
"0.5.0b3.dev18",
|
|
"0.5.0b3.dev19",
|
|
"0.5.0b3.dev20",
|
|
"0.5.0b3.dev21",
|
|
"0.5.0b3.dev22",
|
|
"0.5.0b3.dev24",
|
|
"0.5.0b3.dev26",
|
|
"0.5.0b3.dev27",
|
|
"0.5.0b3.dev28",
|
|
"0.5.0b3.dev29",
|
|
"0.5.0b3.dev30",
|
|
"0.5.0b3.dev31",
|
|
"0.5.0b3.dev32",
|
|
"0.5.0b3.dev33",
|
|
"0.5.0b3.dev34",
|
|
"0.5.0b3.dev35",
|
|
"0.5.0b3.dev38",
|
|
"0.5.0b3.dev39",
|
|
"0.5.0b3.dev40",
|
|
"0.5.0b3.dev41",
|
|
"0.5.0b3.dev42",
|
|
"0.5.0b3.dev43",
|
|
"0.5.0b3.dev44",
|
|
"0.5.0b3.dev45",
|
|
"0.5.0b3.dev46",
|
|
"0.5.0b3.dev47",
|
|
"0.5.0b3.dev48",
|
|
"0.5.0b3.dev49",
|
|
"0.5.0b3.dev50",
|
|
"0.5.0b3.dev51",
|
|
"0.5.0b3.dev52",
|
|
"0.5.0b3.dev53",
|
|
"0.5.0b3.dev54",
|
|
"0.5.0b3.dev57",
|
|
"0.5.0b3.dev60",
|
|
"0.5.0b3.dev62",
|
|
"0.5.0b3.dev64",
|
|
"0.5.0b3.dev65",
|
|
"0.5.0b3.dev66",
|
|
"0.5.0b3.dev67",
|
|
"0.5.0b3.dev68",
|
|
"0.5.0b3.dev69",
|
|
"0.5.0b3.dev70",
|
|
"0.5.0b3.dev71",
|
|
"0.5.0b3.dev72",
|
|
"0.5.0b3.dev73",
|
|
"0.5.0b3.dev74",
|
|
"0.5.0b3.dev75",
|
|
"0.5.0b3.dev76",
|
|
"0.5.0b3.dev77",
|
|
"0.5.0b3.dev78",
|
|
"0.5.0b3.dev79",
|
|
"0.5.0b3.dev80",
|
|
"0.5.0b3.dev81",
|
|
"0.5.0b3.dev82",
|
|
"0.5.0b3.dev85",
|
|
"0.5.0b3.dev87",
|
|
"0.5.0b3.dev88",
|
|
"0.5.0b3.dev89",
|
|
"0.5.0b3.dev90"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-cjjf-27cc-pvmv/GHSA-cjjf-27cc-pvmv.json"
|
|
}
|
|
}
|
|
],
|
|
"schema_version": "1.7.3",
|
|
"severity": [
|
|
{
|
|
"type": "CVSS_V3",
|
|
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "GHSA-77vh-xpmg-72qh",
|
|
"summary": "Clarify \u0060mediaType\u0060 handling",
|
|
"details": "### Impact\nIn the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index.\n\n### Patches\nThe Image Specification will be updated to recommend that both manifest and index documents contain a \u0060mediaType\u0060 field to identify the type of document.\nRelease [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates.\n\n### Workarounds\nSoftware attempting to deserialize an ambiguous document may reject the document if it contains both \u201Cmanifests\u201D and \u201Clayers\u201D fields or \u201Cmanifests\u201D and \u201Cconfig\u201D fields.\n\n### References\nhttps://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/opencontainers/image-spec\n* Email us at [security@opencontainers.org](mailto:security@opencontainers.org)\n* https://github.com/opencontainers/image-spec/commits/v1.0.2\n",
|
|
"modified": "2021-11-24T19:43:35Z",
|
|
"published": "2021-11-18T16:02:41Z",
|
|
"related": [
|
|
"CGA-j36r-723f-8c29"
|
|
],
|
|
"database_specific": {
|
|
"github_reviewed": true,
|
|
"nvd_published_at": null,
|
|
"github_reviewed_at": "2021-11-17T23:13:41Z",
|
|
"cwe_ids": [
|
|
"CWE-843"
|
|
],
|
|
"severity": "LOW"
|
|
},
|
|
"references": [
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c"
|
|
},
|
|
{
|
|
"type": "PACKAGE",
|
|
"url": "https://github.com/opencontainers/image-spec"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://github.com/opencontainers/image-spec/releases/tag/v1.0.2"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"name": "github.com/opencontainers/image-spec",
|
|
"ecosystem": "Go",
|
|
"purl": "pkg:golang/github.com/opencontainers/image-spec"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "SEMVER",
|
|
"events": [
|
|
{
|
|
"introduced": "0"
|
|
},
|
|
{
|
|
"fixed": "1.0.2"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-77vh-xpmg-72qh/GHSA-77vh-xpmg-72qh.json"
|
|
}
|
|
}
|
|
],
|
|
"schema_version": "1.7.3",
|
|
"severity": [
|
|
{
|
|
"type": "CVSS_V3",
|
|
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "GHSA-7rjr-3q55-vv33",
|
|
"summary": "Incomplete fix for Apache Log4j vulnerability",
|
|
"details": "# Impact\n\nThe fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. \n\n## Affected packages\nOnly the \u0060org.apache.logging.log4j:log4j-core\u0060 package is directly affected by this vulnerability. The \u0060org.apache.logging.log4j:log4j-api\u0060 should be kept at the same version as the \u0060org.apache.logging.log4j:log4j-core\u0060 package to ensure compatability if in use.\n\n# Mitigation\n\nLog4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (\u003C 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).\n\nLog4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property \u0060log4j2.formatMsgNoLookups\u0060 to \u0060true\u0060 do NOT mitigate this specific vulnerability.",
|
|
"aliases": [
|
|
"CVE-2021-45046"
|
|
],
|
|
"modified": "2025-05-09T13:13:16.169374Z",
|
|
"published": "2021-12-14T18:01:28Z",
|
|
"database_specific": {
|
|
"github_reviewed_at": "2021-12-14T17:55:00Z",
|
|
"cwe_ids": [
|
|
"CWE-502",
|
|
"CWE-917"
|
|
],
|
|
"github_reviewed": true,
|
|
"severity": "CRITICAL",
|
|
"nvd_published_at": "2021-12-14T19:15:00Z"
|
|
},
|
|
"references": [
|
|
{
|
|
"type": "ADVISORY",
|
|
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.kb.cert.org/vuls/id/930724"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.debian.org/security/2021/dsa-5022"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://security.gentoo.org/glsa/202310-16"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://logging.apache.org/log4j/2.x/security.html"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY"
|
|
},
|
|
{
|
|
"type": "ADVISORY",
|
|
"url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "http://www.openwall.com/lists/oss-security/2021/12/14/4"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "http://www.openwall.com/lists/oss-security/2021/12/15/3"
|
|
},
|
|
{
|
|
"type": "WEB",
|
|
"url": "http://www.openwall.com/lists/oss-security/2021/12/18/1"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"name": "org.apache.logging.log4j:log4j-core",
|
|
"ecosystem": "Maven",
|
|
"purl": "pkg:maven/org.apache.logging.log4j/log4j-core"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "2.13.0"
|
|
},
|
|
{
|
|
"fixed": "2.16.0"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"2.13.0",
|
|
"2.13.1",
|
|
"2.13.2",
|
|
"2.13.3",
|
|
"2.14.0",
|
|
"2.14.1",
|
|
"2.15.0"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
|
|
}
|
|
},
|
|
{
|
|
"package": {
|
|
"name": "org.apache.logging.log4j:log4j-core",
|
|
"ecosystem": "Maven",
|
|
"purl": "pkg:maven/org.apache.logging.log4j/log4j-core"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "0"
|
|
},
|
|
{
|
|
"fixed": "2.12.2"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"2.0",
|
|
"2.0-alpha1",
|
|
"2.0-alpha2",
|
|
"2.0-beta1",
|
|
"2.0-beta2",
|
|
"2.0-beta3",
|
|
"2.0-beta4",
|
|
"2.0-beta5",
|
|
"2.0-beta6",
|
|
"2.0-beta7",
|
|
"2.0-beta8",
|
|
"2.0-beta9",
|
|
"2.0-rc1",
|
|
"2.0-rc2",
|
|
"2.0.1",
|
|
"2.0.2",
|
|
"2.1",
|
|
"2.10.0",
|
|
"2.11.0",
|
|
"2.11.1",
|
|
"2.11.2",
|
|
"2.12.0",
|
|
"2.12.1",
|
|
"2.2",
|
|
"2.3",
|
|
"2.3.1",
|
|
"2.3.2",
|
|
"2.4",
|
|
"2.4.1",
|
|
"2.5",
|
|
"2.6",
|
|
"2.6.1",
|
|
"2.6.2",
|
|
"2.7",
|
|
"2.8",
|
|
"2.8.1",
|
|
"2.8.2",
|
|
"2.9.0",
|
|
"2.9.1"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
|
|
}
|
|
},
|
|
{
|
|
"package": {
|
|
"name": "org.ops4j.pax.logging:pax-logging-log4j2",
|
|
"ecosystem": "Maven",
|
|
"purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "1.8.0"
|
|
},
|
|
{
|
|
"fixed": "1.9.2"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"1.8.0",
|
|
"1.8.1",
|
|
"1.8.2",
|
|
"1.8.3",
|
|
"1.8.4",
|
|
"1.8.5",
|
|
"1.8.6",
|
|
"1.8.7",
|
|
"1.9.0",
|
|
"1.9.1"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
|
|
}
|
|
},
|
|
{
|
|
"package": {
|
|
"name": "org.ops4j.pax.logging:pax-logging-log4j2",
|
|
"ecosystem": "Maven",
|
|
"purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "1.10.0"
|
|
},
|
|
{
|
|
"fixed": "1.10.8"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"1.10.0",
|
|
"1.10.1",
|
|
"1.10.2",
|
|
"1.10.3",
|
|
"1.10.4",
|
|
"1.10.5",
|
|
"1.10.6",
|
|
"1.10.7"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
|
|
}
|
|
},
|
|
{
|
|
"package": {
|
|
"name": "org.ops4j.pax.logging:pax-logging-log4j2",
|
|
"ecosystem": "Maven",
|
|
"purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "1.11.0"
|
|
},
|
|
{
|
|
"fixed": "1.11.11"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"1.11.0",
|
|
"1.11.1",
|
|
"1.11.10",
|
|
"1.11.2",
|
|
"1.11.3",
|
|
"1.11.4",
|
|
"1.11.5",
|
|
"1.11.6",
|
|
"1.11.7",
|
|
"1.11.8",
|
|
"1.11.9"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
|
|
}
|
|
},
|
|
{
|
|
"package": {
|
|
"name": "org.ops4j.pax.logging:pax-logging-log4j2",
|
|
"ecosystem": "Maven",
|
|
"purl": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "2.0.0"
|
|
},
|
|
{
|
|
"fixed": "2.0.12"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"2.0.0",
|
|
"2.0.1",
|
|
"2.0.10",
|
|
"2.0.11",
|
|
"2.0.2",
|
|
"2.0.3",
|
|
"2.0.4",
|
|
"2.0.5",
|
|
"2.0.6",
|
|
"2.0.7",
|
|
"2.0.8",
|
|
"2.0.9"
|
|
],
|
|
"database_specific": {
|
|
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"
|
|
}
|
|
}
|
|
],
|
|
"schema_version": "1.7.3",
|
|
"severity": [
|
|
{
|
|
"type": "CVSS_V3",
|
|
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
|
|
}
|
|
]
|
|
}
|
|
] |