Skip to content

Commit

Permalink
updated serverity to match json schema w/ burnettk
Browse files Browse the repository at this point in the history
  • Loading branch information
@jasquat
jasquat committed Aug 15, 2024
1 parent b0815e5 commit 30a1424
Showing 1 changed file with 14 additions and 29 deletions.
43 changes: 14 additions & 29 deletions wait-for-ecr-scan-and-get-sarif/tests/expected_ubuntu_unit_test_output.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
"text": " Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a "
},
"defaultConfiguration": {
"level": "untriaged"
"level": "none"
},
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html",
"help": {
Expand All @@ -28,11 +28,7 @@
"properties": {
"precision": "very-high",
"security-severity": null,
"tags": [
"vulnerability",
"security",
"UNTRIAGED"
]
"tags": ["vulnerability", "security", "UNTRIAGED"]
}
},
{
Expand All @@ -45,7 +41,7 @@
"text": " Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was ne"
},
"defaultConfiguration": {
"level": "untriaged"
"level": "none"
},
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html",
"help": {
Expand All @@ -55,11 +51,7 @@
"properties": {
"precision": "very-high",
"security-severity": null,
"tags": [
"vulnerability",
"security",
"UNTRIAGED"
]
"tags": ["vulnerability", "security", "UNTRIAGED"]
}
},
{
Expand All @@ -72,7 +64,7 @@
"text": " Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this iss"
},
"defaultConfiguration": {
"level": "untriaged"
"level": "none"
},
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html",
"help": {
Expand All @@ -82,11 +74,7 @@
"properties": {
"precision": "very-high",
"security-severity": null,
"tags": [
"vulnerability",
"security",
"UNTRIAGED"
]
"tags": ["vulnerability", "security", "UNTRIAGED"]
}
},
{
Expand All @@ -99,7 +87,7 @@
"text": " Use After Free with SSL_free_buffers"
},
"defaultConfiguration": {
"level": "untriaged"
"level": "none"
},
"helpUri": "https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html",
"help": {
Expand All @@ -109,11 +97,7 @@
"properties": {
"precision": "very-high",
"security-severity": null,
"tags": [
"vulnerability",
"security",
"UNTRIAGED"
]
"tags": ["vulnerability", "security", "UNTRIAGED"]
}
}
]
Expand All @@ -123,7 +107,7 @@
{
"ruleId": "CVE-2024-4603",
"ruleIndex": 0,
"level": "untriaged",
"level": "none",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-4603\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-4603](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html)"
},
Expand All @@ -150,7 +134,7 @@
{
"ruleId": "CVE-2024-5535",
"ruleIndex": 1,
"level": "untriaged",
"level": "none",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-5535\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-5535](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html)"
},
Expand All @@ -177,7 +161,7 @@
{
"ruleId": "CVE-2024-2511",
"ruleIndex": 2,
"level": "untriaged",
"level": "none",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-2511\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-2511](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html)"
},
Expand All @@ -204,7 +188,7 @@
{
"ruleId": "CVE-2024-4741",
"ruleIndex": 3,
"level": "untriaged",
"level": "none",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-4741\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-4741](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html)"
},
Expand All @@ -231,4 +215,5 @@
]
}
]
}
}

0 comments on commit 30a1424

Please sign in to comment.