[GHSA-w293-vg96-wgc3] undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

[auapwllc-dev]

This pull request updates the GitHub Security Advisory metadata for GHSA-w293-vg96-wgc3. The main changes involve revising the CVSS vector, removing the CWE identifier, and making a minor update to the modified timestamp.

Security metadata updates:

• Updated the CVSS v3 score vector to reflect different attack and impact characteristics, changing from AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N to AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H.
• Removed the CWE-295 identifier from the cwe_ids array, leaving it empty.

Other changes:

• Updated the modified timestamp by one second to reflect the latest change. [GHSA-h6w7-qmcm-q6xr] RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() #10337 [GHSA-h6w7-qmcm-q6xr] RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() #10337 @auapwllc-dev @github @jonmagic

[github]

Hi there @mcollina! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟡 Changes recommended

The proposed CVSS vector and CWE list conflict with authoritative advisory metadata.

2 open findings

• Retain the authoritative CVSS 3.1 vector · New
• Retain CWE-295 certificate validation classification · New

What changed in this PR

Updates security metadata for the undici TLS certificate validation advisory.

Changes:

• Revises the CVSS v3 vector.
• Removes the CWE classification.
• Advances the modification timestamp.

File	Description
GHSA-w293-vg96-wgc3.json	Updates advisory scoring and classification metadata.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.