Skip to content

Commit 83c1120

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 6 unreviewed reports
 - data/reports/GO-2024-3109.yaml - data/reports/GO-2024-3342.yaml - data/reports/GO-2024-3343.yaml - data/reports/GO-2024-3349.yaml - data/reports/GO-2024-3350.yaml - data/reports/GO-2024-3354.yaml Fixes #3109 Fixes #3342 Fixes #3343 Fixes #3349 Fixes #3350 Fixes #3354 Change-Id: I147491bcc57baf150f3c25a10c8fbe3d30d781a1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/637956 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent 230cf22 commit 83c1120

12 files changed

+549
-0
lines changed

‎data/osv/GO-2024-3109.json

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3109",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-43803",
8+
"GHSA-pqfh-xh7w-7h3p"
9+
],
10+
"summary": "The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator",
11+
"details": "The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/metal3-io/baremetal-operator",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.5.2"
27+
},
28+
{
29+
"introduced": "0.6.0"
30+
},
31+
{
32+
"fixed": "0.6.2"
33+
},
34+
{
35+
"introduced": "0.7.0-rc.0"
36+
},
37+
{
38+
"fixed": "0.8.0"
39+
}
40+
]
41+
}
42+
],
43+
"ecosystem_specific": {}
44+
}
45+
],
46+
"references": [
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-pqfh-xh7w-7h3p"
50+
},
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43803"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/metal3-io/baremetal-operator/commit/3af4882e9c5fadc1a7550f53daea21dccd271f74"
58+
},
59+
{
60+
"type": "FIX",
61+
"url": "https://github.com/metal3-io/baremetal-operator/commit/bedae7b997d16f36e772806681569bb8eb4dadbb"
62+
},
63+
{
64+
"type": "FIX",
65+
"url": "https://github.com/metal3-io/baremetal-operator/commit/c2b5a557641bc273367635124047d6c958aa15f7"
66+
},
67+
{
68+
"type": "FIX",
69+
"url": "https://github.com/metal3-io/baremetal-operator/pull/1929"
70+
},
71+
{
72+
"type": "FIX",
73+
"url": "https://github.com/metal3-io/baremetal-operator/pull/1930"
74+
},
75+
{
76+
"type": "FIX",
77+
"url": "https://github.com/metal3-io/baremetal-operator/pull/1931"
78+
}
79+
],
80+
"database_specific": {
81+
"url": "https://pkg.go.dev/vuln/GO-2024-3109",
82+
"review_status": "UNREVIEWED"
83+
}
84+
}

‎data/osv/GO-2024-3342.json

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3342",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-hxr6-2p24-hf98"
8+
],
9+
"summary": "Traefik affected by CVE-2024-53259 in github.com/traefik/traefik",
10+
"details": "Traefik affected by CVE-2024-53259 in github.com/traefik/traefik",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/traefik/traefik",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/traefik/traefik/v2",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
},
41+
{
42+
"fixed": "2.11.15"
43+
}
44+
]
45+
}
46+
],
47+
"ecosystem_specific": {}
48+
},
49+
{
50+
"package": {
51+
"name": "github.com/traefik/traefik/v3",
52+
"ecosystem": "Go"
53+
},
54+
"ranges": [
55+
{
56+
"type": "SEMVER",
57+
"events": [
58+
{
59+
"introduced": "0"
60+
},
61+
{
62+
"fixed": "3.2.2"
63+
}
64+
]
65+
}
66+
],
67+
"ecosystem_specific": {}
68+
}
69+
],
70+
"references": [
71+
{
72+
"type": "ADVISORY",
73+
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-hxr6-2p24-hf98"
74+
},
75+
{
76+
"type": "WEB",
77+
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.15"
78+
},
79+
{
80+
"type": "WEB",
81+
"url": "https://github.com/traefik/traefik/releases/tag/v3.2.2"
82+
}
83+
],
84+
"database_specific": {
85+
"url": "https://pkg.go.dev/vuln/GO-2024-3342",
86+
"review_status": "UNREVIEWED"
87+
}
88+
}

‎data/osv/GO-2024-3343.json

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3343",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-9779",
8+
"GHSA-jhh6-6fhp-q2xp"
9+
],
10+
"summary": "Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm",
11+
"details": "Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "open-cluster-management.io/ocm",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.13.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-jhh6-6fhp-q2xp"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9779"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://access.redhat.com/security/cve/CVE-2024-9779"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317916"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/open-cluster-management-io/ocm/pull/325"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/open-cluster-management-io/registration-operator/issues/361"
62+
}
63+
],
64+
"database_specific": {
65+
"url": "https://pkg.go.dev/vuln/GO-2024-3343",
66+
"review_status": "UNREVIEWED"
67+
}
68+
}

‎data/osv/GO-2024-3349.json

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3349",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-25131",
8+
"GHSA-77c2-c35q-254w"
9+
],
10+
"summary": "OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather",
11+
"details": "OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/openshift/must-gather before v0.0.0-20240604173837-d1557bc283dd.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/openshift/must-gather",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "0.0.0-20240604173837-d1557bc283dd"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/advisories/GHSA-77c2-c35q-254w"
49+
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25131"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/security/cve/CVE-2024-25131"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258856"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/openshift/must-gather-operator/pull/135"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/openshift/must-gather-operator/pull/138"
69+
}
70+
],
71+
"database_specific": {
72+
"url": "https://pkg.go.dev/vuln/GO-2024-3349",
73+
"review_status": "UNREVIEWED"
74+
}
75+
}

‎data/osv/GO-2024-3350.json

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3350",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-5pf6-cq2v-23ww"
8+
],
9+
"summary": "WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core",
10+
"details": "WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/clidey/whodb/core",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://github.com/clidey/whodb/security/advisories/GHSA-5pf6-cq2v-23ww"
34+
},
35+
{
36+
"type": "WEB",
37+
"url": "https://github.com/clidey/whodb/commit/e8b608d35422e1a2bfffe8ed26f0211ea80cb439"
38+
}
39+
],
40+
"database_specific": {
41+
"url": "https://pkg.go.dev/vuln/GO-2024-3350",
42+
"review_status": "UNREVIEWED"
43+
}
44+
}

0 commit comments

Comments
 (0)