Skip to content

Commit 4517b66

Browse files
tatianabtatianab
committed
data/reports: add 5 unreviewed reports
 - data/reports/GO-2024-3323.yaml - data/reports/GO-2024-3324.yaml - data/reports/GO-2024-3325.yaml - data/reports/GO-2024-3326.yaml - data/reports/GO-2024-3327.yaml Fixes #3323 Fixes #3324 Fixes #3325 Fixes #3326 Fixes #3327 Change-Id: Id66d8abedbc619bdf08e3d66e23f64b2d29610fe Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/635223 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]>
1 parent 7056d3e commit 4517b66

10 files changed

+322
-0
lines changed

‎data/osv/GO-2024-3323.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3323",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-55658",
8+
"GHSA-25w9-wqfq-gwqx"
9+
],
10+
"summary": "SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel",
11+
"details": "SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/siyuan-note/siyuan/kernel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71"
39+
}
40+
],
41+
"database_specific": {
42+
"url": "https://pkg.go.dev/vuln/GO-2024-3323",
43+
"review_status": "UNREVIEWED"
44+
}
45+
}

‎data/osv/GO-2024-3324.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3324",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-55660",
8+
"GHSA-4pjc-pwgq-q9jp"
9+
],
10+
"summary": "SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel",
11+
"details": "SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/siyuan-note/siyuan/kernel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71"
39+
}
40+
],
41+
"database_specific": {
42+
"url": "https://pkg.go.dev/vuln/GO-2024-3324",
43+
"review_status": "UNREVIEWED"
44+
}
45+
}

‎data/osv/GO-2024-3325.json

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3325",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-c7xh-gjv4-4jgv"
8+
],
9+
"summary": "kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp",
10+
"details": "kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/kcp-dev/kcp",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.26.1"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/kcp-dev/kcp/security/advisories/GHSA-c7xh-gjv4-4jgv"
37+
},
38+
{
39+
"type": "FIX",
40+
"url": "https://github.com/kcp-dev/kcp/commit/24ab5d4dc35ddff98a2e5fdc236e1681f03283ec"
41+
},
42+
{
43+
"type": "FIX",
44+
"url": "https://github.com/kcp-dev/kcp/pull/3206"
45+
}
46+
],
47+
"database_specific": {
48+
"url": "https://pkg.go.dev/vuln/GO-2024-3325",
49+
"review_status": "UNREVIEWED"
50+
}
51+
}

‎data/osv/GO-2024-3326.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3326",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-55659",
8+
"GHSA-fqj6-whhx-47p7"
9+
],
10+
"summary": "SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel",
11+
"details": "SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/siyuan-note/siyuan/kernel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71"
39+
}
40+
],
41+
"database_specific": {
42+
"url": "https://pkg.go.dev/vuln/GO-2024-3326",
43+
"review_status": "UNREVIEWED"
44+
}
45+
}

‎data/osv/GO-2024-3327.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3327",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-55657",
8+
"GHSA-xx68-37v4-4596"
9+
],
10+
"summary": "SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel",
11+
"details": "SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/siyuan-note/siyuan/kernel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xx68-37v4-4596"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71"
39+
}
40+
],
41+
"database_specific": {
42+
"url": "https://pkg.go.dev/vuln/GO-2024-3327",
43+
"review_status": "UNREVIEWED"
44+
}
45+
}

‎data/reports/GO-2024-3323.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2024-3323
2+
modules:
3+
- module: github.com/siyuan-note/siyuan/kernel
4+
unsupported_versions:
5+
- last_affected: 0.0.0-20241210012039-5129ad926a21
6+
vulnerable_at: 0.0.0-20241210012039-5129ad926a21
7+
summary: |-
8+
SiYuan has an arbitrary file read and path traversal via
9+
/api/export/exportResources in github.com/siyuan-note/siyuan/kernel
10+
cves:
11+
- CVE-2024-55658
12+
ghsas:
13+
- GHSA-25w9-wqfq-gwqx
14+
references:
15+
- advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx
16+
- web: https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
17+
source:
18+
id: GHSA-25w9-wqfq-gwqx
19+
created: 2024-12-11T16:19:40.86191-05:00
20+
review_status: UNREVIEWED

‎data/reports/GO-2024-3324.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2024-3324
2+
modules:
3+
- module: github.com/siyuan-note/siyuan/kernel
4+
unsupported_versions:
5+
- last_affected: 0.0.0-20241210012039-5129ad926a21
6+
vulnerable_at: 0.0.0-20241210012039-5129ad926a21
7+
summary: SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
8+
cves:
9+
- CVE-2024-55660
10+
ghsas:
11+
- GHSA-4pjc-pwgq-q9jp
12+
references:
13+
- advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp
14+
- web: https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
15+
source:
16+
id: GHSA-4pjc-pwgq-q9jp
17+
created: 2024-12-11T16:19:37.997496-05:00
18+
review_status: UNREVIEWED

‎data/reports/GO-2024-3325.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: GO-2024-3325
2+
modules:
3+
- module: github.com/kcp-dev/kcp
4+
versions:
5+
- fixed: 0.26.1
6+
vulnerable_at: 0.26.0
7+
summary: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
8+
ghsas:
9+
- GHSA-c7xh-gjv4-4jgv
10+
references:
11+
- advisory: https://github.com/kcp-dev/kcp/security/advisories/GHSA-c7xh-gjv4-4jgv
12+
- fix: https://github.com/kcp-dev/kcp/commit/24ab5d4dc35ddff98a2e5fdc236e1681f03283ec
13+
- fix: https://github.com/kcp-dev/kcp/pull/3206
14+
source:
15+
id: GHSA-c7xh-gjv4-4jgv
16+
created: 2024-12-11T16:19:33.742126-05:00
17+
review_status: UNREVIEWED

‎data/reports/GO-2024-3326.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2024-3326
2+
modules:
3+
- module: github.com/siyuan-note/siyuan/kernel
4+
unsupported_versions:
5+
- last_affected: 0.0.0-20241210012039-5129ad926a21
6+
vulnerable_at: 0.0.0-20241210012039-5129ad926a21
7+
summary: SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
8+
cves:
9+
- CVE-2024-55659
10+
ghsas:
11+
- GHSA-fqj6-whhx-47p7
12+
references:
13+
- advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7
14+
- web: https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
15+
source:
16+
id: GHSA-fqj6-whhx-47p7
17+
created: 2024-12-11T16:19:31.153727-05:00
18+
review_status: UNREVIEWED

‎data/reports/GO-2024-3327.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2024-3327
2+
modules:
3+
- module: github.com/siyuan-note/siyuan/kernel
4+
unsupported_versions:
5+
- last_affected: 0.0.0-20241210012039-5129ad926a21
6+
vulnerable_at: 0.0.0-20241210012039-5129ad926a21
7+
summary: SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
8+
cves:
9+
- CVE-2024-55657
10+
ghsas:
11+
- GHSA-xx68-37v4-4596
12+
references:
13+
- advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xx68-37v4-4596
14+
- web: https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
15+
source:
16+
id: GHSA-xx68-37v4-4596
17+
created: 2024-12-11T16:19:27.888293-05:00
18+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)