8-30-24 cve update (#3757)

* 8-30-24 cve update

* ci: auto-formatting prettier issues

---------

Co-authored-by: frederickjoi <[email protected]>

docs/docs-content/security-bulletins/reports/cve-2024-35325.md

@@ -14,24 +14,27 @@ tags: ["security", "cve"]
 
 ## Last Update
 
-8/27/2024
+8/30/2024
 
 ## NIST CVE Summary
 
 A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file
 /src/libyaml/src/api.c. The manipulation leads to a double-free.
 
+NIST Rejected reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security
+issue. Notes: none.
+
 ## Our Official Summary
 
-Waiting on a fix from third party mongodb vendor.
+Not applicable.
 
 ## CVE Severity
 
 [9.8](https://nvd.nist.gov/vuln/detail/CVE-2024-35325)
 
 ## Status
 
-Ongoing
+Resolved
 
 ## Affected Products & Versions
 
@@ -41,3 +44,4 @@ Ongoing
 
 - 1.0 08/27/2024 Initial Publication
 - 2.0 08/27/2024 Added Palette VerteX 4.4.14 to Affected Products
+- 3.0 08/30/2024 NIST reclassified CVE- not a security issue

docs/docs-content/security-bulletins/reports/cve-2024-37370.md

@@ -0,0 +1,45 @@
+---
+sidebar_label: "CVE-2024-37370"
+title: "CVE-2024-37370"
+description: "Lifecycle of CVE-2024-37370"
+hide_table_of_contents: true
+sidebar_class_name: "hide-from-sidebar"
+toc_max_heading_level: 2
+tags: ["security", "cve"]
+---
+
+## CVE Details
+
+[CVE-2024-37370](https://nvd.nist.gov/vuln/detail/CVE-2024-37370)
+
+## Last Update
+
+8/30/2024
+
+## NIST CVE Summary
+
+In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS
+krb5 wrap token, causing the unwrapped token to appear truncated to the application.
+
+## Our Official Summary
+
+This CVE is a message token handling issue reported on kerboros libraries. This affects krb5 packages in versions less
+than 1.21.3-1. Exploitation of this flaw could cause system crashes. Risk of this specific vulnerability for spectro
+cloud components is low. Working on removing/upgrading libraries to fix the issue.
+
+## CVE Severity
+
+[7.5](https://nvd.nist.gov/vuln/detail/CVE-2024-37370)
+
+## Status
+
+Ongoing
+
+## Affected Products & Versions
+
+- Palette VerteX 4.4.14
+
+## Revision History
+
+- 1.0 08/30/2024 Initial Publication
+- 2.0 08/30/2024 Added Palette VerteX 4.4.14 to Affected Products

docs/docs-content/security-bulletins/reports/cve-2024-37371.md

@@ -0,0 +1,46 @@
+---
+sidebar_label: "CVE-2024-37371"
+title: "CVE-2024-37371"
+description: "Lifecycle of CVE-2024-37371"
+hide_table_of_contents: true
+sidebar_class_name: "hide-from-sidebar"
+toc_max_heading_level: 2
+tags: ["security", "cve"]
+---
+
+## CVE Details
+
+[CVE-2024-37371](https://nvd.nist.gov/vuln/detail/CVE-2024-37371)
+
+## Last Update
+
+8/30/2024
+
+## NIST CVE Summary
+
+In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling
+by sending message tokens with invalid length fields.
+
+## Our Official Summary
+
+This CVE is a memory corruption vulnerability reported on kerboros libraries. Attackers could potentially exploit a flaw
+within Kerberos' handling of GSS (Generic Security Service) message tokens to cause invalid memory reads, potentially
+leading to system crashes. Risk of this specific vulnerability for spectro cloud components is low. Working on
+removing/upgrading libraries to fix the issue.
+
+## CVE Severity
+
+[9.1](https://nvd.nist.gov/vuln/detail/CVE-2024-37371)
+
+## Status
+
+Ongoing
+
+## Affected Products & Versions
+
+- Palette VerteX 4.4.14
+
+## Revision History
+
+- 1.0 08/30/2024 Initial Publication
+- 2.0 08/30/2024 Added Palette VerteX 4.4.14 to Affected Products

docs/docs-content/security-bulletins/reports/cve-2024-6197.md

@@ -14,7 +14,7 @@ tags: ["security", "cve"]
 
 ## Last Update
 
-8/27/2024
+8/30/2024
 
 ## NIST CVE Summary
 
@@ -28,7 +28,9 @@ special circumstances.
 
 ## Our Official Summary
 
-Spectro Cloud Offcial Summary coming soon.
+This CVE is reported on nginx-ingress-controller image on the libcurl's ASN1 parser. The vulnerable code path can be
+triggered by a malicious operation offering an especially crafted TLS certificate. Problem is fixed in curl
+version >=8.9.0. Investigating a possible fix.
 
 ## CVE Severity