Skip to content

Commit 9e81317

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 3 unreviewed reports
 - data/reports/GO-2025-3456.yaml - data/reports/GO-2025-3457.yaml - data/reports/GO-2025-3458.yaml Fixes #3456 Fixes #3457 Fixes #3458 Change-Id: I27243df631acfadbef2c77f5c66d05c80e0417fd Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/647795 Auto-Submit: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]>
1 parent 702896b commit 9e81317

6 files changed

+259
-0
lines changed

‎data/osv/GO-2025-3456.json

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3456",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-24786",
8+
"GHSA-9r4c-jwx3-3j76"
9+
],
10+
"summary": "WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core",
11+
"details": "WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/clidey/whodb/core",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.0-20250127172032-547336ac73c8"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24786"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/clidey/whodb/commit/547336ac73c8d17929c18c3941c0d5b0099753cc"
54+
}
55+
],
56+
"database_specific": {
57+
"url": "https://pkg.go.dev/vuln/GO-2025-3456",
58+
"review_status": "UNREVIEWED"
59+
}
60+
}

‎data/osv/GO-2025-3457.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3457",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-24787",
8+
"GHSA-c7w4-9wv8-7x7c"
9+
],
10+
"summary": "WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core",
11+
"details": "WhoDB allows parameter injection in DB connection URIs leading to local file inclusion in github.com/clidey/whodb/core",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/clidey/whodb/core",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.0-20250127202645-8d67b767e005"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/clidey/whodb/security/advisories/GHSA-c7w4-9wv8-7x7c"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24787"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/clidey/whodb/commit/8d67b767e00552e5eba2b1537179b74bfa662ee1"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/go-sql-driver/mysql/blob/7403860363ca112af503b4612568c3096fecb466/infile.go#L128"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2025-3457",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2025-3458.json

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3458",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-24366",
8+
"GHSA-vj7w-3m8c-6vpx"
9+
],
10+
"summary": "SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo",
11+
"details": "SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/drakkan/sftpgo",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0.9.5"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
},
41+
{
42+
"package": {
43+
"name": "github.com/drakkan/sftpgo/v2",
44+
"ecosystem": "Go"
45+
},
46+
"ranges": [
47+
{
48+
"type": "SEMVER",
49+
"events": [
50+
{
51+
"introduced": "0"
52+
},
53+
{
54+
"fixed": "2.6.5"
55+
}
56+
]
57+
}
58+
],
59+
"ecosystem_specific": {}
60+
}
61+
],
62+
"references": [
63+
{
64+
"type": "ADVISORY",
65+
"url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-vj7w-3m8c-6vpx"
66+
},
67+
{
68+
"type": "FIX",
69+
"url": "https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1"
70+
}
71+
],
72+
"database_specific": {
73+
"url": "https://pkg.go.dev/vuln/GO-2025-3458",
74+
"review_status": "UNREVIEWED"
75+
}
76+
}

‎data/reports/GO-2025-3456.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: GO-2025-3456
2+
modules:
3+
- module: github.com/clidey/whodb/core
4+
versions:
5+
- fixed: 0.0.0-20250127172032-547336ac73c8
6+
summary: WhoDB has a path traversal opening Sqlite3 database in github.com/clidey/whodb/core
7+
cves:
8+
- CVE-2025-24786
9+
ghsas:
10+
- GHSA-9r4c-jwx3-3j76
11+
references:
12+
- advisory: https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76
13+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-24786
14+
- web: https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20
15+
- web: https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26
16+
- web: https://github.com/clidey/whodb/commit/547336ac73c8d17929c18c3941c0d5b0099753cc
17+
notes:
18+
- fix: 'github.com/clidey/whodb/core: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
19+
source:
20+
id: GHSA-9r4c-jwx3-3j76
21+
created: 2025-02-07T16:10:07.101671-05:00
22+
review_status: UNREVIEWED

‎data/reports/GO-2025-3457.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: GO-2025-3457
2+
modules:
3+
- module: github.com/clidey/whodb/core
4+
versions:
5+
- fixed: 0.0.0-20250127202645-8d67b767e005
6+
summary: |-
7+
WhoDB allows parameter injection in DB connection URIs leading to local file
8+
inclusion in github.com/clidey/whodb/core
9+
cves:
10+
- CVE-2025-24787
11+
ghsas:
12+
- GHSA-c7w4-9wv8-7x7c
13+
references:
14+
- advisory: https://github.com/clidey/whodb/security/advisories/GHSA-c7w4-9wv8-7x7c
15+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-24787
16+
- web: https://github.com/clidey/whodb/commit/8d67b767e00552e5eba2b1537179b74bfa662ee1
17+
- web: https://github.com/go-sql-driver/mysql/blob/7403860363ca112af503b4612568c3096fecb466/infile.go#L128
18+
notes:
19+
- fix: 'github.com/clidey/whodb/core: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
20+
source:
21+
id: GHSA-c7w4-9wv8-7x7c
22+
created: 2025-02-07T16:10:01.801889-05:00
23+
review_status: UNREVIEWED

‎data/reports/GO-2025-3458.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: GO-2025-3458
2+
modules:
3+
- module: github.com/drakkan/sftpgo
4+
non_go_versions:
5+
- introduced: 0.9.5
6+
vulnerable_at: 1.2.2
7+
- module: github.com/drakkan/sftpgo/v2
8+
versions:
9+
- fixed: 2.6.5
10+
vulnerable_at: 2.6.4
11+
summary: SFTPGo has insufficient sanitization of user provided rsync command in github.com/drakkan/sftpgo
12+
cves:
13+
- CVE-2025-24366
14+
ghsas:
15+
- GHSA-vj7w-3m8c-6vpx
16+
references:
17+
- advisory: https://github.com/drakkan/sftpgo/security/advisories/GHSA-vj7w-3m8c-6vpx
18+
- fix: https://github.com/drakkan/sftpgo/commit/b347ab6051f6c501da205c09315fe99cd1fa3ba1
19+
source:
20+
id: GHSA-vj7w-3m8c-6vpx
21+
created: 2025-02-07T16:09:57.042068-05:00
22+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)