Skip to content

Matched advisory candidates (shard 27) #91

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
p-linnane merged 1 commit into from
Aug 13, 2026
Merged

Matched advisory candidates (shard 27) #91

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
121 changes: 121 additions & 0 deletions advisories/BREW-asitop-CVE-2019-18874.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
{
"schema_version": "1.7.3",
"id": "BREW-asitop-CVE-2019-18874",
"published": "2026-08-13T16:36:07Z",
"modified": "2026-08-13T16:36:07Z",
"upstream": [
"GHSA-qfc5-mcwq-26q8",
"CVE-2019-18874",
"PYSEC-2019-41"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "asitop",
"purl": "pkg:brew/asitop"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.24"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "5.6.6",
"resource": "psutil",
"resource_purl": "pkg:pypi/psutil@7.1.0"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "psutil",
"subject_version": "7.1.0",
"key": "pkg:pypi/psutil@7.1.0",
"resource": "psutil"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "psutil",
"subject_version": "7.1.0",
"key": "pkg:pypi/psutil@7.1.0",
"resource": "psutil"
}
]
},
"summary": "Double Free in psutil",
"details": "psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18874"
},
{
"type": "WEB",
"url": "https://github.com/giampaolo/psutil/pull/1616"
},
{
"type": "WEB",
"url": "https://github.com/giampaolo/psutil/commit/7d512c8e4442a896d56505be3e78f1156f443465"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qfc5-mcwq-26q8"
},
{
"type": "PACKAGE",
"url": "https://github.com/giampaolo/psutil"
},
{
"type": "WEB",
"url": "https://github.com/giampaolo/psutil/blob/master/HISTORY.rst#566"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/psutil/PYSEC-2019-41.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00018.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2P7QI7MOTZTFXQYU23CP3RAWXCERMOAS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLETTJYZL2SMBUI4Q2NGBMGPDPP54SRG"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4204-1"
}
]
}
133 changes: 133 additions & 0 deletions advisories/BREW-bittensor-CVE-2015-8557.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,133 @@
{
"schema_version": "1.7.3",
"id": "BREW-bittensor-CVE-2015-8557",
"published": "2026-08-13T16:38:09Z",
"modified": "2026-08-13T16:38:09Z",
"upstream": [
"GHSA-fff8-4w9p-7v76",
"CVE-2015-8557",
"PYSEC-2016-32"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "bittensor",
"purl": "pkg:brew/bittensor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.2"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "2.1",
"resource": "pygments",
"resource_purl": "pkg:pypi/pygments@2.20.0"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "pygments",
"subject_version": "2.20.0",
"key": "pkg:pypi/pygments@2.20.0",
"resource": "pygments"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "pygments",
"subject_version": "2.20.0",
"key": "pkg:pypi/pygments@2.20.0",
"resource": "pygments"
}
]
},
"summary": "Command Injection in Pygments",
"details": "The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8557"
},
{
"type": "WEB",
"url": "https://github.com/pygments/pygments/commit/db6dd826f8624179e563aaded391efe824462f51"
},
{
"type": "WEB",
"url": "https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-fff8-4w9p-7v76"
},
{
"type": "PACKAGE",
"url": "https://github.com/pygments/pygments"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2016-32.yaml"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201612-05"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Oct/4"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3445"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/12/14/17"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/12/14/6"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2862-1"
}
]
}
93 changes: 93 additions & 0 deletions advisories/BREW-bittensor-CVE-2018-1000518.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
{
"schema_version": "1.7.3",
"id": "BREW-bittensor-CVE-2018-1000518",
"published": "2026-08-13T16:38:09Z",
"modified": "2026-08-13T16:38:09Z",
"upstream": [
"GHSA-6g87-ff9q-v847",
"CVE-2018-1000518",
"PYSEC-2018-79"
],
"affected": [
{
"package": {
"ecosystem": "Homebrew",
"name": "bittensor",
"purl": "pkg:brew/bittensor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.2"
}
]
}
],
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"upstream_fixed_in": "5.0",
"resource": "websockets",
"resource_purl": "pkg:pypi/websockets@16.1.1"
}
}
],
"database_specific": {
"source": "matched",
"strategy": "registry",
"confidence": "high",
"upstream_evidence": [
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "websockets",
"subject_version": "16.1.1",
"key": "pkg:pypi/websockets@16.1.1",
"resource": "websockets"
},
{
"strategy": "registry",
"ecosystem": "PyPI",
"name": "websockets",
"subject_version": "16.1.1",
"key": "pkg:pypi/websockets@16.1.1",
"resource": "websockets"
}
]
},
"summary": "websockets is vulnerable to denial of service by memory exhaustion",
"details": "The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable via sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in version 5.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000518"
},
{
"type": "WEB",
"url": "https://github.com/aaugustin/websockets/pull/407"
},
{
"type": "PACKAGE",
"url": "https://github.com/aaugustin/websockets"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/websockets/PYSEC-2018-79.yaml"
}
]
}
Loading