Skip to content

Commit e67c5e3

Browse files
zpavlinovicgopherbot
zpavlinovic
authored and
gopherbot
committed
data/reports: add 5 reports
 - data/reports/GO-2025-3397.yaml - data/reports/GO-2025-3398.yaml - data/reports/GO-2025-3399.yaml - data/reports/GO-2025-3400.yaml - data/reports/GO-2025-3401.yaml Fixes #3397 Fixes #3398 Fixes #3399 Fixes #3400 Fixes #3401 Change-Id: I398589c537648b827d78fe884001d702b03cf17e Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/642605 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]> Auto-Submit: Zvonimir Pavlinovic <[email protected]>
1 parent a5f9df8 commit e67c5e3

10 files changed

+333
-0
lines changed

‎data/osv/GO-2025-3397.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3397",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-36402",
8+
"GHSA-8vmr-h7h5-cqhg"
9+
],
10+
"summary": "matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo",
11+
"details": "matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content in github.com/t2bot/matrix-media-repo",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/t2bot/matrix-media-repo",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.3.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/matrix-org/matrix-spec-proposals/pull/3916"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2025-3397",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

‎data/osv/GO-2025-3398.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3398",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-52791",
8+
"GHSA-gp86-q8hg-fpxj"
9+
],
10+
"summary": "matrix-media-repo (MMR) allows a denial of service through memory exhaustion in github.com/t2bot/matrix-media-repo",
11+
"details": "matrix-media-repo (MMR) allows a denial of service through memory exhaustion in github.com/t2bot/matrix-media-repo",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/t2bot/matrix-media-repo",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.3.8"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2025-3398",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

‎data/osv/GO-2025-3399.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3399",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-52602",
8+
"GHSA-r6jg-jfv6-2fjv"
9+
],
10+
"summary": "Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation in github.com/t2bot/matrix-media-repo",
11+
"details": "Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation in github.com/t2bot/matrix-media-repo",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/t2bot/matrix-media-repo",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.3.8"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2025-3399",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

‎data/osv/GO-2025-3400.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3400",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-56515",
8+
"GHSA-rcxc-wjgw-579r"
9+
],
10+
"summary": "Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo",
11+
"details": "Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/t2bot/matrix-media-repo",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.3.8"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2025-3400",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

‎data/osv/GO-2025-3401.json

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3401",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-36403",
8+
"GHSA-vc2m-hw89-qjxf"
9+
],
10+
"summary": "matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo",
11+
"details": "matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/t2bot/matrix-media-repo",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.3.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-vc2m-hw89-qjxf"
38+
}
39+
],
40+
"database_specific": {
41+
"url": "https://pkg.go.dev/vuln/GO-2025-3401",
42+
"review_status": "UNREVIEWED"
43+
}
44+
}

‎data/reports/GO-2025-3397.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3397
2+
modules:
3+
- module: github.com/t2bot/matrix-media-repo
4+
versions:
5+
- fixed: 1.3.5
6+
vulnerable_at: 1.3.4
7+
summary: |-
8+
matrix-media-repo (MMR) allows unauthenticated writes to the media repository,
9+
which may allow planting of problematic content in github.com/t2bot/matrix-media-repo
10+
cves:
11+
- CVE-2024-36402
12+
ghsas:
13+
- GHSA-8vmr-h7h5-cqhg
14+
references:
15+
- advisory: https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-8vmr-h7h5-cqhg
16+
- web: https://github.com/matrix-org/matrix-spec-proposals/pull/3916
17+
source:
18+
id: GHSA-8vmr-h7h5-cqhg
19+
created: 2025-01-16T21:30:59.197777983Z
20+
review_status: UNREVIEWED

‎data/reports/GO-2025-3398.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2025-3398
2+
modules:
3+
- module: github.com/t2bot/matrix-media-repo
4+
versions:
5+
- fixed: 1.3.8
6+
vulnerable_at: 1.3.7
7+
summary: matrix-media-repo (MMR) allows a denial of service through memory exhaustion in github.com/t2bot/matrix-media-repo
8+
cves:
9+
- CVE-2024-52791
10+
ghsas:
11+
- GHSA-gp86-q8hg-fpxj
12+
references:
13+
- advisory: https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-gp86-q8hg-fpxj
14+
- web: https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8
15+
source:
16+
id: GHSA-gp86-q8hg-fpxj
17+
created: 2025-01-16T21:30:55.53433568Z
18+
review_status: UNREVIEWED

‎data/reports/GO-2025-3399.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3399
2+
modules:
3+
- module: github.com/t2bot/matrix-media-repo
4+
versions:
5+
- fixed: 1.3.8
6+
vulnerable_at: 1.3.7
7+
summary: |-
8+
Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects
9+
and federation in github.com/t2bot/matrix-media-repo
10+
cves:
11+
- CVE-2024-52602
12+
ghsas:
13+
- GHSA-r6jg-jfv6-2fjv
14+
references:
15+
- advisory: https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv
16+
- web: https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8
17+
source:
18+
id: GHSA-r6jg-jfv6-2fjv
19+
created: 2025-01-16T21:30:51.885337875Z
20+
review_status: UNREVIEWED

‎data/reports/GO-2025-3400.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3400
2+
modules:
3+
- module: github.com/t2bot/matrix-media-repo
4+
versions:
5+
- fixed: 1.3.8
6+
vulnerable_at: 1.3.7
7+
summary: |-
8+
Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed,
9+
invoking potentially further untrusted decoders in github.com/t2bot/matrix-media-repo
10+
cves:
11+
- CVE-2024-56515
12+
ghsas:
13+
- GHSA-rcxc-wjgw-579r
14+
references:
15+
- advisory: https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-rcxc-wjgw-579r
16+
- web: https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8
17+
source:
18+
id: GHSA-rcxc-wjgw-579r
19+
created: 2025-01-16T21:30:47.989848281Z
20+
review_status: UNREVIEWED

‎data/reports/GO-2025-3401.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2025-3401
2+
modules:
3+
- module: github.com/t2bot/matrix-media-repo
4+
versions:
5+
- fixed: 1.3.5
6+
vulnerable_at: 1.3.4
7+
summary: |-
8+
matrix-media-repo (MMR) allows denial of service/high operating costs through
9+
unauthenticated downloads in github.com/t2bot/matrix-media-repo
10+
cves:
11+
- CVE-2024-36403
12+
ghsas:
13+
- GHSA-vc2m-hw89-qjxf
14+
references:
15+
- advisory: https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-vc2m-hw89-qjxf
16+
source:
17+
id: GHSA-vc2m-hw89-qjxf
18+
created: 2025-01-16T21:30:44.369927323Z
19+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)