/
fixed.payload.json
196 lines (196 loc) · 9.28 KB
/
fixed.payload.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
{
"action": "fixed",
"alert": {
"number": 1,
"state": "fixed",
"dependency": {
"package": { "ecosystem": "pip", "name": "ansible" },
"manifest_path": "path/to/requirements.txt",
"scope": "runtime"
},
"security_advisory": {
"ghsa_id": "GHSA-8f4m-hccc-8qph",
"cve_id": "CVE-2021-20191",
"summary": "Insertion of Sensitive Information into Log File in ansible",
"description": "A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.",
"vulnerabilities": [
{
"package": { "ecosystem": "pip", "name": "ansible" },
"severity": "medium",
"vulnerable_version_range": ">= 2.9.0, < 2.9.18",
"first_patched_version": { "identifier": "2.9.18" }
},
{
"package": { "ecosystem": "pip", "name": "ansible" },
"severity": "medium",
"vulnerable_version_range": "< 2.8.19",
"first_patched_version": { "identifier": "2.8.19" }
},
{
"package": { "ecosystem": "pip", "name": "ansible" },
"severity": "medium",
"vulnerable_version_range": ">= 2.10.0, < 2.10.7",
"first_patched_version": { "identifier": "2.10.7" }
}
],
"severity": "medium",
"cvss": {
"vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"score": 5.5
},
"cwes": [
{
"cwe_id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
}
],
"identifiers": [
{ "type": "GHSA", "value": "GHSA-8f4m-hccc-8qph" },
{ "type": "CVE", "value": "CVE-2021-20191" }
],
"references": [
{ "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20191" },
{ "url": "https://access.redhat.com/security/cve/cve-2021-20191" },
{ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1916813" }
],
"published_at": "2021-06-01T17:38:00Z",
"updated_at": "2021-08-12T23:06:00Z",
"withdrawn_at": null
},
"security_vulnerability": {
"package": { "ecosystem": "pip", "name": "ansible" },
"severity": "medium",
"vulnerable_version_range": "< 2.8.19",
"first_patched_version": { "identifier": "2.8.19" }
},
"url": "https://api.github.com/repos/octocat/hello-world/dependabot/alerts/1",
"html_url": "https://github.com/octocat/hello-world/security/dependabot/1",
"created_at": "2022-06-14T15:21:52Z",
"updated_at": "2022-06-15T13:55:40Z",
"dismissed_at": null,
"dismissed_by": null,
"dismissed_reason": null,
"dismissed_comment": null,
"fixed_at": "2022-06-15T13:55:40Z"
},
"repository": {
"id": 1296269,
"node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5",
"name": "hello-world",
"full_name": "octocat/hello-world",
"private": false,
"owner": {
"login": "octocat",
"id": 1,
"node_id": "MDQ6VXNlcjE=",
"avatar_url": "https://github.com/images/error/octocat_happy.gif",
"gravatar_id": "",
"url": "https://api.github.com/users/octocat",
"html_url": "https://github.com/octocat",
"followers_url": "https://api.github.com/users/octocat/followers",
"following_url": "https://api.github.com/users/octocat/following{/other_user}",
"gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
"starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
"organizations_url": "https://api.github.com/users/octocat/orgs",
"repos_url": "https://api.github.com/users/octocat/repos",
"events_url": "https://api.github.com/users/octocat/events{/privacy}",
"received_events_url": "https://api.github.com/users/octocat/received_events",
"type": "User",
"site_admin": false
},
"html_url": "https://github.com/octocat/hello-world",
"description": null,
"fork": false,
"url": "https://api.github.com/repos/octocat/hello-world",
"archive_url": "https://api.github.com/repos/octocat/hello-world/{archive_format}{/ref}",
"assignees_url": "https://api.github.com/repos/octocat/hello-world/assignees{/user}",
"blobs_url": "https://api.github.com/repos/octocat/hello-world/git/blobs{/sha}",
"branches_url": "https://api.github.com/repos/octocat/hello-world/branches{/branch}",
"collaborators_url": "https://api.github.com/repos/octocat/hello-world/collaborators{/collaborator}",
"comments_url": "https://api.github.com/repos/octocat/hello-world/comments{/number}",
"commits_url": "https://api.github.com/repos/octocat/hello-world/commits{/sha}",
"compare_url": "https://api.github.com/repos/octocat/hello-world/compare/{base}...{head}",
"contents_url": "https://api.github.com/repos/octocat/hello-world/contents/{+path}",
"contributors_url": "https://api.github.com/repos/octocat/hello-world/contributors",
"deployments_url": "https://api.github.com/repos/octocat/hello-world/deployments",
"downloads_url": "https://api.github.com/repos/octocat/hello-world/downloads",
"events_url": "https://api.github.com/repos/octocat/hello-world/events",
"forks_url": "https://api.github.com/repos/octocat/hello-world/forks",
"git_commits_url": "https://api.github.com/repos/octocat/hello-world/git/commits{/sha}",
"git_refs_url": "https://api.github.com/repos/octocat/hello-world/git/refs{/sha}",
"git_tags_url": "https://api.github.com/repos/octocat/hello-world/git/tags{/sha}",
"issue_comment_url": "https://api.github.com/repos/octocat/hello-world/issues/comments{/number}",
"issue_events_url": "https://api.github.com/repos/octocat/hello-world/issues/events{/number}",
"issues_url": "https://api.github.com/repos/octocat/hello-world/issues{/number}",
"keys_url": "https://api.github.com/repos/octocat/hello-world/keys{/key_id}",
"labels_url": "https://api.github.com/repos/octocat/hello-world/labels{/name}",
"languages_url": "https://api.github.com/repos/octocat/hello-world/languages",
"merges_url": "https://api.github.com/repos/octocat/hello-world/merges",
"milestones_url": "https://api.github.com/repos/octocat/hello-world/milestones{/number}",
"notifications_url": "https://api.github.com/repos/octocat/hello-world/notifications{?since,all,participating}",
"pulls_url": "https://api.github.com/repos/octocat/hello-world/pulls{/number}",
"releases_url": "https://api.github.com/repos/octocat/hello-world/releases{/id}",
"stargazers_url": "https://api.github.com/repos/octocat/hello-world/stargazers",
"statuses_url": "https://api.github.com/repos/octocat/hello-world/statuses/{sha}",
"subscribers_url": "https://api.github.com/repos/octocat/hello-world/subscribers",
"subscription_url": "https://api.github.com/repos/octocat/hello-world/subscription",
"tags_url": "https://api.github.com/repos/octocat/hello-world/tags",
"teams_url": "https://api.github.com/repos/octocat/hello-world/teams",
"trees_url": "https://api.github.com/repos/octocat/hello-world/git/trees{/sha}",
"hooks_url": "https://api.github.com/repos/octocat/hello-world/hooks",
"created_at": "2022-06-07T14:08:11Z",
"updated_at": "2022-06-09T16:29:20Z",
"pushed_at": "2022-06-08T15:58:49Z",
"git_url": "git://github.com/octocat/hello-world.git",
"ssh_url": "git@github.com:octocat/hello-world.git",
"clone_url": "https://github.com/octocat/hello-world.git",
"svn_url": "https://github.com/octocat/hello-world",
"homepage": null,
"size": 0,
"stargazers_count": 0,
"watchers_count": 0,
"language": "Python",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"forks_count": 0,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 0,
"license": null,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"topics": [],
"visibility": "public",
"forks": 0,
"open_issues": 0,
"watchers": 0,
"default_branch": "main",
"custom_properties": {}
},
"sender": {
"login": "github",
"id": 9919,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjk5MTk=",
"avatar_url": "https://avatars.githubusercontent.com/u/9919?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/github",
"html_url": "https://github.com/github",
"followers_url": "https://api.github.com/users/github/followers",
"following_url": "https://api.github.com/users/github/following{/other_user}",
"gists_url": "https://api.github.com/users/github/gists{/gist_id}",
"starred_url": "https://api.github.com/users/github/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/github/subscriptions",
"organizations_url": "https://api.github.com/users/github/orgs",
"repos_url": "https://api.github.com/users/github/repos",
"events_url": "https://api.github.com/users/github/events{/privacy}",
"received_events_url": "https://api.github.com/users/github/received_events",
"type": "Organization",
"site_admin": false
}
}