Skip to content

Commit 1d9f679

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 2 needs review reports
 - data/reports/GO-2025-3442.yaml - data/reports/GO-2025-3443.yaml Updates #3442 Updates #3443 Change-Id: Ibe6157196ab26ebf3c22e512eb4cde28f9338546 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/646596 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]> Reviewed-by: Damien Neil <[email protected]> Reviewed-by: Neal Patel <[email protected]>
1 parent f230a55 commit 1d9f679

File tree

4 files changed

+172
-0
lines changed

4 files changed

+172
-0
lines changed

‎data/osv/GO-2025-3442.json

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3442",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-24371",
8+
"GHSA-22qq-3xwm-r5x4"
9+
],
10+
"summary": "CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft",
11+
"details": "CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/cometbft/cometbft",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.38.17"
27+
},
28+
{
29+
"introduced": "1.0.0-alpha.1"
30+
},
31+
{
32+
"fixed": "1.0.1"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24371"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://github.com/cometbft/cometbft/commit/0ee80cd609c7ae9fe856bdd1c6d38553fdae90ce"
52+
},
53+
{
54+
"type": "FIX",
55+
"url": "https://github.com/cometbft/cometbft/commit/2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/cometbft/cometbft/releases/tag/v0.38.17"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/cometbft/cometbft/releases/tag/v1.0.1"
64+
}
65+
],
66+
"database_specific": {
67+
"url": "https://pkg.go.dev/vuln/GO-2025-3442",
68+
"review_status": "UNREVIEWED"
69+
}
70+
}

‎data/osv/GO-2025-3443.json

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3443",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-r3r4-g7hq-pq4f"
8+
],
9+
"summary": "CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts in github.com/cometbft/cometbft",
10+
"details": "CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts in github.com/cometbft/cometbft",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cometbft/cometbft",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.38.17"
26+
},
27+
{
28+
"introduced": "1.0.0-alpha.1"
29+
},
30+
{
31+
"fixed": "1.0.1"
32+
}
33+
]
34+
}
35+
],
36+
"ecosystem_specific": {}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "ADVISORY",
42+
"url": "https://github.com/cometbft/cometbft/security/advisories/GHSA-r3r4-g7hq-pq4f"
43+
},
44+
{
45+
"type": "FIX",
46+
"url": "https://github.com/cometbft/cometbft/commit/415c0da223bb7694608913f725fa45bd7a7a46bf"
47+
},
48+
{
49+
"type": "FIX",
50+
"url": "https://github.com/cometbft/cometbft/commit/f943aabc7b9201ea1089ff3381479929435ce424"
51+
}
52+
],
53+
"database_specific": {
54+
"url": "https://pkg.go.dev/vuln/GO-2025-3443",
55+
"review_status": "UNREVIEWED"
56+
}
57+
}

‎data/reports/GO-2025-3442.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: GO-2025-3442
2+
modules:
3+
- module: github.com/cometbft/cometbft
4+
versions:
5+
- fixed: 0.38.17
6+
- introduced: 1.0.0-alpha.1
7+
- fixed: 1.0.1
8+
vulnerable_at: 1.0.0
9+
summary: CometBFT allows a malicious peer to make node stuck in blocksync in github.com/cometbft/cometbft
10+
cves:
11+
- CVE-2025-24371
12+
ghsas:
13+
- GHSA-22qq-3xwm-r5x4
14+
references:
15+
- advisory: https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4
16+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-24371
17+
- fix: https://github.com/cometbft/cometbft/commit/0ee80cd609c7ae9fe856bdd1c6d38553fdae90ce
18+
- fix: https://github.com/cometbft/cometbft/commit/2cebfde06ae5073c0b296a9d2ca6ab4b95397ea5
19+
- web: https://github.com/cometbft/cometbft/releases/tag/v0.38.17
20+
- web: https://github.com/cometbft/cometbft/releases/tag/v1.0.1
21+
source:
22+
id: GHSA-22qq-3xwm-r5x4
23+
created: 2025-02-04T13:46:44.220823-05:00
24+
review_status: NEEDS_REVIEW

‎data/reports/GO-2025-3443.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2025-3443
2+
modules:
3+
- module: github.com/cometbft/cometbft
4+
versions:
5+
- fixed: 0.38.17
6+
- introduced: 1.0.0-alpha.1
7+
- fixed: 1.0.1
8+
vulnerable_at: 1.0.0
9+
summary: |-
10+
CometBFT allows a malicious peer to stall the network by disseminating seemingly
11+
valid block parts in github.com/cometbft/cometbft
12+
ghsas:
13+
- GHSA-r3r4-g7hq-pq4f
14+
references:
15+
- advisory: https://github.com/cometbft/cometbft/security/advisories/GHSA-r3r4-g7hq-pq4f
16+
- fix: https://github.com/cometbft/cometbft/commit/415c0da223bb7694608913f725fa45bd7a7a46bf
17+
- fix: https://github.com/cometbft/cometbft/commit/f943aabc7b9201ea1089ff3381479929435ce424
18+
source:
19+
id: GHSA-r3r4-g7hq-pq4f
20+
created: 2025-02-04T13:46:41.019336-05:00
21+
review_status: NEEDS_REVIEW

0 commit comments

Comments
 (0)