TRIAGE.json

{
   "bomFormat": "CycloneDX",
   "specVersion": "1.4",
   "version": 1,
   "vulnerabilities": [
      {
         "id": "CVE-2019-11922",
         "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11922"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2019-11922&vector=CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1"
               },
               "score": 8.1,
               "severity": "high",
               "method": "CVSSv3",
               "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
            }
         ],
         "description": "A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "false positive because the python API for zstandard has lower version numbers than the main zstandard library"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/facebook#zstandard:0.22.0"
            }
         ]
      },
      {
         "id": "CVE-2021-24031",
         "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24031"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2021-24031&vector=CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N&version=3.1"
               },
               "score": 5.5,
               "severity": "medium",
               "method": "CVSSv3",
               "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
            }
         ],
         "description": "In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "false positive because the python API for zstandard has lower version numbers than the main zstandard library"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/facebook#zstandard:0.22.0"
            }
         ]
      },
      {
         "id": "CVE-2023-49092",
         "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49092"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-49092&vector=CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1"
               },
               "score": 5.9,
               "severity": "medium",
               "method": "CVSSv3",
               "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
            }
         ],
         "description": "RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "RSA detected is rust library."
         },
         "affects": [
            {
               "ref": "urn:cbt:1/rustcrypto#rsa:4.7.2"
            }
         ]
      },
      {
         "id": "GHSA-h588-76vg-prgj",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=GHSA-h588-76vg-prgj"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=GHSA-h588-76vg-prgj&vector=unknown&version=2.0"
               },
               "score": "unknown",
               "severity": "unknown",
               "method": "CVSSvunknown",
               "vector": "unknown"
            }
         ],
         "description": "`DecimalArray` does not perform bound checks on accessing values and offsets",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "arrow is reporting CVEs found for another product named arrow"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#arrow:1.2.3"
            }
         ]
      },
      {
         "id": "GHSA-qgrp-8f3v-q85p",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=GHSA-qgrp-8f3v-q85p"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=GHSA-qgrp-8f3v-q85p&vector=unknown&version=2.0"
               },
               "score": "unknown",
               "severity": "unknown",
               "method": "CVSSvunknown",
               "vector": "unknown"
            }
         ],
         "description": "`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "arrow is reporting CVEs found for another product named arrow"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#arrow:1.2.3"
            }
         ]
      },
      {
         "id": "GHSA-r7cj-wmwv-hfw5",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=GHSA-r7cj-wmwv-hfw5"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=GHSA-r7cj-wmwv-hfw5&vector=unknown&version=2.0"
               },
               "score": "unknown",
               "severity": "unknown",
               "method": "CVSSvunknown",
               "vector": "unknown"
            }
         ],
         "description": "`BinaryArray` does not perform bound checks on reading values and offsets",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "arrow is reporting CVEs found for another product named arrow"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#arrow:1.2.3"
            }
         ]
      },
      {
         "id": "RUSTSEC-2021-0116",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=RUSTSEC-2021-0116"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=RUSTSEC-2021-0116&vector=unknown&version=2.0"
               },
               "score": "unknown",
               "severity": "unknown",
               "method": "CVSSvunknown",
               "vector": "unknown"
            }
         ],
         "description": "`BinaryArray` does not perform bound checks on reading values and offsets",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "arrow is reporting CVEs found for another product named arrow"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#arrow:1.2.3"
            }
         ]
      },
      {
         "id": "RUSTSEC-2021-0117",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=RUSTSEC-2021-0117"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=RUSTSEC-2021-0117&vector=unknown&version=2.0"
               },
               "score": "unknown",
               "severity": "unknown",
               "method": "CVSSvunknown",
               "vector": "unknown"
            }
         ],
         "description": "`DecimalArray` does not perform bound checks on accessing values and offsets",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "arrow is reporting CVEs found for another product named arrow"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#arrow:1.2.3"
            }
         ]
      },
      {
         "id": "RUSTSEC-2021-0118",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=RUSTSEC-2021-0118"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?name=RUSTSEC-2021-0118&vector=unknown&version=2.0"
               },
               "score": "unknown",
               "severity": "unknown",
               "method": "CVSSvunknown",
               "vector": "unknown"
            }
         ],
         "description": "`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "arrow is reporting CVEs found for another product named arrow"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#arrow:1.2.3"
            }
         ]
      },
      {
         "id": "CVE-2022-42969",
         "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42969"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-42969&vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1"
               },
               "score": 7.5,
               "severity": "high",
               "method": "CVSSv3",
               "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            }
         ],
         "description": "The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "in_triage",
            "response": [],
            "detail": "NewFound"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/pytest#py:1.11.0"
            }
         ]
      },
      {
         "id": "CVE-2022-42969",
         "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42969"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-42969&vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1"
               },
               "score": 7.5,
               "severity": "high",
               "method": "CVSSv3",
               "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
            }
         ],
         "description": "The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "in_triage",
            "response": [],
            "detail": "NewFound"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/unknown#py:1.11.0"
            }
         ]
      },
      {
         "id": "CVE-2022-23602",
         "source": {
            "name": "NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23602"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2022-23602&vector=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N&version=3.1"
               },
               "score": 8.1,
               "severity": "high",
               "method": "CVSSv3",
               "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
            }
         ],
         "description": "Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum's post \"preview\" endpoint. Even if NimForum is running as a non-critical user, the forum.json secrets can be stolen. Version 2.2.0 of NimForum includes patches for this vulnerability. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "false_positive",
            "response": [],
            "detail": "docutils is reporting CVEs found for another product with the same name"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/nim-lang#docutils:0.20.1"
            }
         ]
      },
      {
         "id": "CVE-2020-28463",
         "source": {
            "name": "OSV",
            "url": "https://osv.dev/list?ecosystem=&q=CVE-2020-28463"
         },
         "ratings": [
            {
               "source": {
                  "name": "NVD",
                  "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2020-28463&vector=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N&version=3.1"
               },
               "score": 6.5,
               "severity": "medium",
               "method": "CVSSv3",
               "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
            }
         ],
         "description": "Server-side Request Forgery (SSRF) via img tags in reportlab",
         "recommendation": "",
         "advisories": [],
         "created": "NOT_KNOWN",
         "published": "NOT_KNOWN",
         "updated": "",
         "analysis": {
            "state": "not_affected",
            "response": [],
            "detail": "Applied the appropriate mitigations to avoid malicious images"
         },
         "affects": [
            {
               "ref": "urn:cbt:1/reportlab#reportlab:4.1.0"
            }
         ]
      }
   ]
}