Skip to content

Commit 3ff7d8e

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 2 needs review reports
 - data/reports/GO-2024-3101.yaml - data/reports/GO-2024-3344.yaml Updates #3101 Updates #3344 Change-Id: I2f7e53dcc3408324888151bf28d19d6e2d950fba Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/637957 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent 83c1120 commit 3ff7d8e

File tree

4 files changed

+167
-0
lines changed

4 files changed

+167
-0
lines changed

‎data/osv/GO-2024-3101.json

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3101",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-75qh-gg76-p2w4"
8+
],
9+
"summary": "CWA-2023-004: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm",
10+
"details": "CWA-2023-004: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/CosmWasm/wasmvm",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.2.5"
26+
},
27+
{
28+
"introduced": "1.3.0"
29+
},
30+
{
31+
"fixed": "1.3.1"
32+
},
33+
{
34+
"introduced": "1.4.0"
35+
},
36+
{
37+
"fixed": "1.4.2"
38+
},
39+
{
40+
"introduced": "1.5.0"
41+
},
42+
{
43+
"fixed": "1.5.1"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/advisories/GHSA-75qh-gg76-p2w4"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://forum.cosmos.network/t/high-severity-security-patch-upcoming-on-wed-10th-cwa-2023-004-brought-to-you-by-certik-and-confio/12840"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0366.html"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://www.certik.com/resources/blog/risk-and-security-enhancement-for-app-chains-an-in-depth-writeup-of-cwa-2023"
71+
}
72+
],
73+
"database_specific": {
74+
"url": "https://pkg.go.dev/vuln/GO-2024-3101",
75+
"review_status": "UNREVIEWED"
76+
}
77+
}

‎data/osv/GO-2024-3344.json

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3344",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-32gq-x56h-299c"
8+
],
9+
"summary": "age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age",
10+
"details": "age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "filippo.io/age",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.2.1"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/FiloSottile/age/commit/482cf6fc9babd3ab06f6606762aac10447222201"
41+
}
42+
],
43+
"database_specific": {
44+
"url": "https://pkg.go.dev/vuln/GO-2024-3344",
45+
"review_status": "UNREVIEWED"
46+
}
47+
}

‎data/reports/GO-2024-3101.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: GO-2024-3101
2+
modules:
3+
- module: github.com/CosmWasm/wasmvm
4+
versions:
5+
- fixed: 1.2.5
6+
- introduced: 1.3.0
7+
- fixed: 1.3.1
8+
- introduced: 1.4.0
9+
- fixed: 1.4.2
10+
- introduced: 1.5.0
11+
- fixed: 1.5.1
12+
vulnerable_at: 1.5.0
13+
summary: 'CWA-2023-004: Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm'
14+
ghsas:
15+
- GHSA-75qh-gg76-p2w4
16+
references:
17+
- advisory: https://github.com/advisories/GHSA-75qh-gg76-p2w4
18+
- web: https://forum.cosmos.network/t/high-severity-security-patch-upcoming-on-wed-10th-cwa-2023-004-brought-to-you-by-certik-and-confio/12840
19+
- web: https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md
20+
- web: https://rustsec.org/advisories/RUSTSEC-2024-0366.html
21+
- web: https://www.certik.com/resources/blog/risk-and-security-enhancement-for-app-chains-an-in-depth-writeup-of-cwa-2023
22+
source:
23+
id: GHSA-75qh-gg76-p2w4
24+
created: 2024-12-20T10:04:11.705159-10:00
25+
review_status: NEEDS_REVIEW

‎data/reports/GO-2024-3344.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2024-3344
2+
modules:
3+
- module: filippo.io/age
4+
versions:
5+
- fixed: 1.2.1
6+
vulnerable_at: 1.2.0
7+
summary: |-
8+
age vulnerable to malicious plugin names, recipients, or identities causing
9+
arbitrary binary execution in filippo.io/age
10+
ghsas:
11+
- GHSA-32gq-x56h-299c
12+
references:
13+
- advisory: https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c
14+
- web: https://github.com/FiloSottile/age/commit/482cf6fc9babd3ab06f6606762aac10447222201
15+
source:
16+
id: GHSA-32gq-x56h-299c
17+
created: 2024-12-20T10:03:46.400782-10:00
18+
review_status: NEEDS_REVIEW

0 commit comments

Comments
 (0)