update mbedtls entries

Signed-off-by: Weston Steimel <[email protected]>
anchore · Oct 18, 2024 · 8ece59d · 8ece59d
1 parent 79029f2
commit 8ece59d
Show file tree

Hide file tree

Showing 5 changed files with 46 additions and 4 deletions.
diff --git a/data/anchore/2024/CVE-2024-28755.json b/data/anchore/2024/CVE-2024-28755.json
@@ -15,7 +15,8 @@
     "affected": [
       {
         "cpes": [
-          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*"
+          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*",
+          "cpe:2.3:a:mbed-tls:mbedtls:*:*:*:*:*:*:*:*"
         ],
         "product": "Mbed TLS",
         "repo": "https://github.com/Mbed-TLS/mbedtls",

diff --git a/data/anchore/2024/CVE-2024-28836.json b/data/anchore/2024/CVE-2024-28836.json
@@ -13,7 +13,8 @@
     "affected": [
       {
         "cpes": [
-          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*"
+          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*",
+          "cpe:2.3:a:mbed-tls:mbedtls:*:*:*:*:*:*:*:*"
         ],
         "product": "Mbed TLS",
         "repo": "https://github.com/Mbed-TLS/mbedtls",

diff --git a/data/anchore/2024/CVE-2024-28960.json b/data/anchore/2024/CVE-2024-28960.json
@@ -15,7 +15,8 @@
     "affected": [
       {
         "cpes": [
-          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*"
+          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*",
+          "cpe:2.3:a:mbed-tls:mbedtls:*:*:*:*:*:*:*:*"
         ],
         "product": "Mbed TLS",
         "repo": "https://github.com/Mbed-TLS/mbedtls",

diff --git a/data/anchore/2024/CVE-2024-30166.json b/data/anchore/2024/CVE-2024-30166.json
@@ -13,7 +13,8 @@
     "affected": [
       {
         "cpes": [
-          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*"
+          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*",
+          "cpe:2.3:a:mbed-tls:mbedtls:*:*:*:*:*:*:*:*"
         ],
         "product": "Mbed TLS",
         "repo": "https://github.com/Mbed-TLS/mbedtls",

diff --git a/data/anchore/2024/CVE-2024-49195.json b/data/anchore/2024/CVE-2024-49195.json
@@ -0,0 +1,38 @@
+{
+  "additionalMetadata": {
+    "cna": "mitre",
+    "cveId": "CVE-2024-49195",
+    "description": "Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair",
+    "needsReview": true,
+    "reason": "Added CPE configurations because not yet analyzed by NVD.",
+    "references": [
+      "https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-10-1/",
+      "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/"
+    ]
+  },
+  "adp": {
+    "affected": [
+      {
+        "cpes": [
+          "cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*",
+          "cpe:2.3:a:mbed-tls:mbedtls:*:*:*:*:*:*:*:*"
+        ],
+        "product": "mbedtls",
+        "repo": "https://github.com/Mbed-TLS/mbedtls",
+        "vendor": "mbed-tls",
+        "versions": [
+          {
+            "lessThan": "3.6.2",
+            "status": "affected",
+            "version": "3.5.0",
+            "versionType": "custom"
+          }
+        ]
+      }
+    ],
+    "providerMetadata": {
+      "orgId": "00000000-0000-4000-8000-000000000000",
+      "shortName": "anchoreadp"
+    }
+  }
+}