Skip to content

Commit

Permalink
Update 20240927070216 (#612)
Browse files Browse the repository at this point in the history 
feat: Updated at 20240927070216

Signed-off-by: bitnami-bot <[email protected]>
  • Loading branch information
@bitnami-bot
bitnami-bot authored Sep 27, 2024
1 parent 09b3104 commit e8a1101
Show file tree
Hide file tree
Showing 4 changed files with 255 additions and 0 deletions.
72 changes: 72 additions & 0 deletions data/gitlab/BIT-gitlab-2024-4278.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
{
"schema_version": "1.5.0",
"id": "BIT-gitlab-2024-4278",
"details": "An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.",
"aliases": [
"CVE-2024-4278"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "gitlab",
"purl": "pkg:bitnami/gitlab"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "16.5.0"
},
{
"fixed": "17.2.8"
},
{
"introduced": "17.3.0"
},
{
"fixed": "17.3.4"
}
]
},
{
"type": "SEMVER",
"events": [
{
"introduced": "17.4.0"
},
{
"last_affected": "17.4.0"
}
]
}
]
}
],
"database_specific": {
"severity": "Low",
"cpes": [
"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458484"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2466205"
}
],
"published": "2024-09-27T07:24:05.639Z",
"modified": "2024-09-27T07:55:22.197Z"
}
50 changes: 50 additions & 0 deletions data/mattermost/BIT-mattermost-2024-45843.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
{
"schema_version": "1.5.0",
"id": "BIT-mattermost-2024-45843",
"details": "Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.",
"aliases": [
"CVE-2024-45843"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mattermost",
"purl": "pkg:bitnami/mattermost"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.9"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"published": "2024-09-27T07:20:06.325Z",
"modified": "2024-09-27T07:55:22.197Z"
}
83 changes: 83 additions & 0 deletions data/mattermost/BIT-mattermost-2024-47003.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,83 @@
{
"schema_version": "1.5.0",
"id": "BIT-mattermost-2024-47003",
"details": "Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.",
"aliases": [
"CVE-2024-47003"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mattermost",
"purl": "pkg:bitnami/mattermost"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.9"
}
]
},
{
"type": "SEMVER",
"events": [
{
"introduced": "9.11.0"
},
{
"last_affected": "9.11.0"
},
{
"introduced": "9.11.0-rc1"
},
{
"last_affected": "9.11.0-rc1"
},
{
"introduced": "9.11.0-rc2"
},
{
"last_affected": "9.11.0-rc2"
},
{
"introduced": "9.11.0-rc3"
},
{
"last_affected": "9.11.0-rc3"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"cpe:2.3:a:mattermost:mattermost_server:9.11.0:-:*:*:*:*:*:*",
"cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc3:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"published": "2024-09-27T07:19:54.937Z",
"modified": "2024-09-27T07:55:22.197Z"
}
50 changes: 50 additions & 0 deletions data/mattermost/BIT-mattermost-2024-47145.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
{
"schema_version": "1.5.0",
"id": "BIT-mattermost-2024-47145",
"details": "Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.",
"aliases": [
"CVE-2024-47145"
],
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "mattermost",
"purl": "pkg:bitnami/mattermost"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "9.5.0"
},
{
"fixed": "9.5.9"
}
]
}
]
}
],
"database_specific": {
"severity": "Medium",
"cpes": [
"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*"
]
},
"references": [
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"published": "2024-09-27T07:19:43.531Z",
"modified": "2024-09-27T07:55:22.197Z"
}

0 comments on commit e8a1101

Please sign in to comment.