Updated info in sup advisories

jasnow · postmodern · commit cb0b06ff6d8f · 2023-06-23T09:36:19.000-07:00
diff --git a/gems/sup/CVE-2013-4478.yml b/gems/sup/CVE-2013-4478.yml
@@ -3,8 +3,8 @@ gem: sup
 cve: 2013-4478
 osvdb: 99074
 ghsa: 5f2p-6vjv-2q2m
-url: http://www.phenoelit.org/stuff/whatsup.txt
-title: Sup MUA Email Attachment Content Type Handling Arbitrary Command Execution
+url: https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html
+title: Sup wrongly handled the filename of attachments
 date: 2013-10-29
 description: |
   Sup MUA contains a flaw that is triggered when handling email attachment
@@ -13,3 +13,14 @@ cvss_v2: 6.8
 patched_versions:
   - "~> 0.13.2.1"
   - ">= 0.14.1.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-4478
+    - https://github.com/sup-heliotrope/sup/blob/develop/History.txt
+    - https://www.openwall.com/lists/oss-security/2013/10/30/2
+    - https://web.archive.org/web/20140524012714/http://rubyforge.org/pipermail/sup-talk/2013-August/004993.html
+    - https://github.com/sup-heliotrope/sup/commit/8b46cdbfc14e07ca07d403aa28b0e7bc1c544785
+    - https://www.mend.io/vulnerability-database/CVE-2013-4478
+    - https://security-tracker.debian.org/tracker/CVE-2013-4478
+    - https://lwn.net/Articles/575351
+    - https://github.com/advisories/GHSA-5f2p-6vjv-2q2m
diff --git a/gems/sup/CVE-2013-4479.yml b/gems/sup/CVE-2013-4479.yml
@@ -3,8 +3,8 @@ gem: sup
 cve: 2013-4479
 osvdb: 99074
 ghsa: hh2x-7mf9-78fr
-url: http://www.phenoelit.org/stuff/whatsup.txt
-title: Sup MUA Email Attachment Content Type Handling Arbitrary Command Execution
+url: https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html
+title: Sup did not sanitize the content-type of attachments
 date: 2013-10-29
 description: |
   Sup MUA contains a flaw that is triggered when handling email attachment
@@ -13,3 +13,14 @@ cvss_v2: 6.8
 patched_versions:
   - "~> 0.13.2.1"
   - ">= 0.14.1.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-4479
+    - https://web.archive.org/web/20140524005344/http://rubyforge.org/pipermail/sup-talk/2013-October/004996.html
+    - https://seclists.org/fulldisclosure/2013/Oct/272
+    - https://seclists.org/fulldisclosure/2013/Oct/att-272/whatsup.txt
+    - https://www.openwall.com/lists/oss-security/2013/10/30/2
+    - https://github.com/sup-heliotrope/sup/commit/ca0302e0c716682d2de22e9136400c704cc93e42
+    - https://security-tracker.debian.org/tracker/CVE-2013-4479
+    - https://lwn.net/Articles/575351
+    - https://github.com/advisories/GHSA-hh2x-7mf9-78fr
