Vulnerability-Lookup

CVE-2024-40639 (GCVE-0-2024-40639)

Vulnerability from cvelistv5 – Published: 2024-07-17 17:42 – Updated: 2024-07-17 19:13

This CVE is a duplicate of another CVE.

Replaced by CVE-2024-21527

Show details on NVD website

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-07-17T19:13:46.766Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE is a duplicate of another CVE."
        }
      ],
      "replacedBy": [
        "CVE-2024-21527"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-40639",
    "datePublished": "2024-07-17T17:42:47.782Z",
    "dateRejected": "2024-07-17T19:13:46.766Z",
    "dateReserved": "2024-07-08T16:13:15.511Z",
    "dateUpdated": "2024-07-17T19:13:46.766Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Rejected reason: This CVE is a duplicate of another CVE.\"}]",
      "id": "CVE-2024-40639",
      "lastModified": "2024-07-17T20:15:06.603",
      "published": "2024-07-17T18:15:04.563",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Rejected"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40639\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-17T18:15:04.563\",\"lastModified\":\"2024-07-17T20:15:06.603\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE is a duplicate of another CVE.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"This CVE is a duplicate of another CVE.\"}], \"replacedBy\": [\"CVE-2024-21527\"], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-17T19:13:46.766Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40639\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"REJECTED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-07-08T16:13:15.511Z\", \"datePublished\": \"2024-07-17T17:42:47.782Z\", \"dateUpdated\": \"2024-07-17T19:13:46.766Z\", \"dateRejected\": \"2024-07-17T19:13:46.766Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-PFPX-3HGC-PC2G

Vulnerability from github – Published: 2024-07-17 18:31 – Updated: 2024-07-17 18:31

Details

Gotenberg provides a developer-friendly API to interact with powerful tools like Chromium and LibreOffice for converting numerous document formats (HTML, Markdown, Word, Excel, etc.) into PDF files, and more! Prior to version 8.1.0, the default value for the flag --chromium-deny-list allowed to display some internal files from the Gotenberg container. Version 8.1.0 provides a new default value fixing the issue. Prior to version 8.1.0, Gotenberg uses the standard regexp Go library, which does not support negative lookahead. Therefore, the new default value for the --chromium-deny-list is not applicable. However, one could find an alternative using either or both --chromium-deny-list and --chromium-allow-list flags. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity ?

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-40639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-17T18:15:04Z",
    "severity": "HIGH"
  },
  "details": "Gotenberg provides a developer-friendly API to interact with powerful tools like Chromium and LibreOffice for converting numerous document formats (HTML, Markdown, Word, Excel, etc.) into PDF files, and more! Prior to version 8.1.0, the default value for the flag `--chromium-deny-list` allowed to display some internal files from the Gotenberg container. Version 8.1.0 provides a new default value fixing the issue. Prior to version 8.1.0, Gotenberg uses the standard `regexp` Go library, which does not support negative lookahead. Therefore, the new default value for the `--chromium-deny-list` is not applicable. However, one could find an alternative using either or both `--chromium-deny-list` and `--chromium-allow-list` flags. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
  "id": "GHSA-pfpx-3hgc-pc2g",
  "modified": "2024-07-17T18:31:01Z",
  "published": "2024-07-17T18:31:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rh2x-ccvw-q7r3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40639"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2024-40639

Vulnerability from fkie_nvd - Published: 2024-07-17 18:15 - Updated: 2024-07-17 20:15

Severity ?

Summary

Rejected reason: This CVE is a duplicate of another CVE.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE is a duplicate of another CVE."
    }
  ],
  "id": "CVE-2024-40639",
  "lastModified": "2024-07-17T20:15:06.603",
  "metrics": {},
  "published": "2024-07-17T18:15:04.563",
  "references": [],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Rejected"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-40639 (GCVE-0-2024-40639)

GHSA-PFPX-3HGC-PC2G

FKIE_CVE-2024-40639

Tags

Sightings

Nomenclature