Skip to content

Commit e9f5b2f

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 13 reports
 - data/reports/GO-2025-3603.yaml - data/reports/GO-2025-3604.yaml - data/reports/GO-2025-3608.yaml - data/reports/GO-2025-3609.yaml - data/reports/GO-2025-3610.yaml - data/reports/GO-2025-3611.yaml - data/reports/GO-2025-3612.yaml - data/reports/GO-2025-3615.yaml - data/reports/GO-2025-3618.yaml - data/reports/GO-2025-3619.yaml - data/reports/GO-2025-3620.yaml - data/reports/GO-2025-3621.yaml - data/reports/GO-2025-3622.yaml Fixes #3603 Fixes #3604 Fixes #3608 Fixes #3609 Fixes #3610 Fixes #3611 Fixes #3612 Fixes #3615 Fixes #3618 Fixes #3619 Fixes #3620 Fixes #3621 Fixes #3622 Change-Id: Ie86f18261a2e27e719b6b83100c20a83c688d9d4 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/665975 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Neal Patel <[email protected]> Commit-Queue: Neal Patel <[email protected]>
1 parent f9410be commit e9f5b2f

26 files changed

+1617
-0
lines changed

‎data/osv/GO-2025-3603.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3603",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-1386",
8+
"GHSA-m454-3xv7-qj85"
9+
],
10+
"summary": "Query smuggling in ch-go library in github.com/ClickHouse/ch-go",
11+
"details": "Query smuggling in ch-go library in github.com/ClickHouse/ch-go",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/ClickHouse/ch-go",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.65.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1386"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/ClickHouse/ch-go/commit/0e835663df32b09b828528c07a5507686e6d975e"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3603",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3604.json

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3604",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-24866",
8+
"GHSA-xfq9-hh5x-xfq9"
9+
],
10+
"summary": "Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server",
11+
"details": "Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mattermost/mattermost-server",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "9.11.0+incompatible"
24+
},
25+
{
26+
"fixed": "9.11.9+incompatible"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/mattermost/mattermost-server/v5",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
},
50+
{
51+
"package": {
52+
"name": "github.com/mattermost/mattermost-server/v6",
53+
"ecosystem": "Go"
54+
},
55+
"ranges": [
56+
{
57+
"type": "SEMVER",
58+
"events": [
59+
{
60+
"introduced": "0"
61+
}
62+
]
63+
}
64+
],
65+
"ecosystem_specific": {}
66+
},
67+
{
68+
"package": {
69+
"name": "github.com/mattermost/mattermost/server/v8",
70+
"ecosystem": "Go"
71+
},
72+
"ranges": [
73+
{
74+
"type": "SEMVER",
75+
"events": [
76+
{
77+
"introduced": "0"
78+
}
79+
]
80+
}
81+
],
82+
"ecosystem_specific": {}
83+
}
84+
],
85+
"references": [
86+
{
87+
"type": "ADVISORY",
88+
"url": "https://github.com/advisories/GHSA-xfq9-hh5x-xfq9"
89+
},
90+
{
91+
"type": "ADVISORY",
92+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24866"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://mattermost.com/security-updates"
97+
}
98+
],
99+
"database_specific": {
100+
"url": "https://pkg.go.dev/vuln/GO-2025-3604",
101+
"review_status": "UNREVIEWED"
102+
}
103+
}

‎data/osv/GO-2025-3608.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3608",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-32445",
8+
"GHSA-hmp7-x699-cvhq"
9+
],
10+
"summary": "Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events",
11+
"details": "Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR in github.com/argoproj/argo-events",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/argoproj/argo-events",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.9.6"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32445"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/argoproj/argo-events/commit/18412293a699f559848b00e6e459c9ce2de0d3e2"
46+
},
47+
{
48+
"type": "FIX",
49+
"url": "https://github.com/argoproj/argo-events/pull/3528"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2025-3608",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2025-3609.json

+122
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3609",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-32093",
8+
"GHSA-322v-vh2g-qvpv"
9+
],
10+
"summary": "Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server",
11+
"details": "Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mattermost/mattermost-server",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "9.11.0+incompatible"
24+
},
25+
{
26+
"fixed": "9.11.10+incompatible"
27+
},
28+
{
29+
"introduced": "10.4.0+incompatible"
30+
},
31+
{
32+
"fixed": "10.4.4+incompatible"
33+
},
34+
{
35+
"introduced": "10.5.0+incompatible"
36+
},
37+
{
38+
"fixed": "10.5.2+incompatible"
39+
}
40+
]
41+
}
42+
],
43+
"ecosystem_specific": {}
44+
},
45+
{
46+
"package": {
47+
"name": "github.com/mattermost/mattermost-server/v5",
48+
"ecosystem": "Go"
49+
},
50+
"ranges": [
51+
{
52+
"type": "SEMVER",
53+
"events": [
54+
{
55+
"introduced": "0"
56+
}
57+
]
58+
}
59+
],
60+
"ecosystem_specific": {}
61+
},
62+
{
63+
"package": {
64+
"name": "github.com/mattermost/mattermost-server/v6",
65+
"ecosystem": "Go"
66+
},
67+
"ranges": [
68+
{
69+
"type": "SEMVER",
70+
"events": [
71+
{
72+
"introduced": "0"
73+
}
74+
]
75+
}
76+
],
77+
"ecosystem_specific": {}
78+
},
79+
{
80+
"package": {
81+
"name": "github.com/mattermost/mattermost/server/v8",
82+
"ecosystem": "Go"
83+
},
84+
"ranges": [
85+
{
86+
"type": "SEMVER",
87+
"events": [
88+
{
89+
"introduced": "0"
90+
},
91+
{
92+
"fixed": "8.0.0-20250227102013-aa4623a93199"
93+
}
94+
]
95+
}
96+
],
97+
"ecosystem_specific": {}
98+
}
99+
],
100+
"references": [
101+
{
102+
"type": "ADVISORY",
103+
"url": "https://github.com/advisories/GHSA-322v-vh2g-qvpv"
104+
},
105+
{
106+
"type": "ADVISORY",
107+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32093"
108+
},
109+
{
110+
"type": "WEB",
111+
"url": "https://github.com/mattermost/mattermost/commit/aa4623a9319943d9f54383b22b55e7d06a324e20"
112+
},
113+
{
114+
"type": "WEB",
115+
"url": "https://mattermost.com/security-updates"
116+
}
117+
],
118+
"database_specific": {
119+
"url": "https://pkg.go.dev/vuln/GO-2025-3609",
120+
"review_status": "UNREVIEWED"
121+
}
122+
}

0 commit comments

Comments
 (0)