Skip to content

Commit fd78d89

Browse files
zpavlinovicgopherbot
zpavlinovic
authored and
gopherbot
committed
data/reports: add GO-2025-3396
 - data/reports/GO-2025-3396.yaml Fixes #3396 Change-Id: I796a927cca620e97ed8348798a8a926fd2a9efd8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/643176 Auto-Submit: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]>
1 parent 812e71d commit fd78d89

File tree

2 files changed

+178
-0
lines changed

2 files changed

+178
-0
lines changed

‎data/osv/GO-2025-3396.json

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3396",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-52594"
8+
],
9+
"summary": "Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib",
10+
"details": "Server-Side Request Forgery (SSRF) on redirects and federation in github.com/matrix-org/gomatrixserverlib",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/matrix-org/gomatrixserverlib",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.0.0-20250116181547-c4f1e01eab0d"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {
31+
"imports": [
32+
{
33+
"path": "github.com/matrix-org/gomatrixserverlib/fclient",
34+
"symbols": [
35+
"Client.CreateMediaDownloadRequest",
36+
"Client.DoHTTPRequest",
37+
"Client.DoRequestAndParseResponse",
38+
"Client.GetServerKeys",
39+
"Client.GetVersion",
40+
"Client.LookupServerKeys",
41+
"Client.LookupUserInfo",
42+
"DNSCache.DialContext",
43+
"LookupWellKnown",
44+
"NewClient",
45+
"NewDNSCache",
46+
"NewFederationClient",
47+
"ResolveServer",
48+
"destinationTripper.RoundTrip",
49+
"destinationTripper.getTransport",
50+
"federationClient.Backfill",
51+
"federationClient.ClaimKeys",
52+
"federationClient.DoRequestAndParseResponse",
53+
"federationClient.DownloadMedia",
54+
"federationClient.ExchangeThirdPartyInvite",
55+
"federationClient.GetEvent",
56+
"federationClient.GetEventAuth",
57+
"federationClient.GetPublicRooms",
58+
"federationClient.GetPublicRoomsFiltered",
59+
"federationClient.GetUserDevices",
60+
"federationClient.LookupMissingEvents",
61+
"federationClient.LookupProfile",
62+
"federationClient.LookupRoomAlias",
63+
"federationClient.LookupState",
64+
"federationClient.LookupStateIDs",
65+
"federationClient.MSC2836EventRelationships",
66+
"federationClient.MakeJoin",
67+
"federationClient.MakeKnock",
68+
"federationClient.MakeLeave",
69+
"federationClient.P2PGetTransactionFromRelay",
70+
"federationClient.P2PSendTransactionToRelay",
71+
"federationClient.Peek",
72+
"federationClient.QueryKeys",
73+
"federationClient.RoomHierarchy",
74+
"federationClient.SendInvite",
75+
"federationClient.SendInviteV2",
76+
"federationClient.SendInviteV3",
77+
"federationClient.SendJoin",
78+
"federationClient.SendJoinPartialState",
79+
"federationClient.SendKnock",
80+
"federationClient.SendLeave",
81+
"federationClient.SendTransaction",
82+
"newDestinationTripper"
83+
]
84+
}
85+
]
86+
}
87+
}
88+
],
89+
"references": [
90+
{
91+
"type": "ADVISORY",
92+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52594"
93+
},
94+
{
95+
"type": "FIX",
96+
"url": "https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128"
97+
},
98+
{
99+
"type": "WEB",
100+
"url": "https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822"
101+
}
102+
],
103+
"database_specific": {
104+
"url": "https://pkg.go.dev/vuln/GO-2025-3396",
105+
"review_status": "REVIEWED"
106+
}
107+
}

‎data/reports/GO-2025-3396.yaml

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
id: GO-2025-3396
2+
modules:
3+
- module: github.com/matrix-org/gomatrixserverlib
4+
versions:
5+
- fixed: 0.0.0-20250116181547-c4f1e01eab0d
6+
vulnerable_at: 0.0.0-20241215094829-e86ab16eabe8
7+
packages:
8+
- package: github.com/matrix-org/gomatrixserverlib/fclient
9+
symbols:
10+
- NewClient
11+
- destinationTripper.getTransport
12+
- DNSCache.DialContext
13+
- newDestinationTripper
14+
- NewDNSCache
15+
- destinationTripper.RoundTrip
16+
derived_symbols:
17+
- Client.CreateMediaDownloadRequest
18+
- Client.DoHTTPRequest
19+
- Client.DoRequestAndParseResponse
20+
- Client.GetServerKeys
21+
- Client.GetVersion
22+
- Client.LookupServerKeys
23+
- Client.LookupUserInfo
24+
- LookupWellKnown
25+
- NewFederationClient
26+
- ResolveServer
27+
- federationClient.Backfill
28+
- federationClient.ClaimKeys
29+
- federationClient.DoRequestAndParseResponse
30+
- federationClient.DownloadMedia
31+
- federationClient.ExchangeThirdPartyInvite
32+
- federationClient.GetEvent
33+
- federationClient.GetEventAuth
34+
- federationClient.GetPublicRooms
35+
- federationClient.GetPublicRoomsFiltered
36+
- federationClient.GetUserDevices
37+
- federationClient.LookupMissingEvents
38+
- federationClient.LookupProfile
39+
- federationClient.LookupRoomAlias
40+
- federationClient.LookupState
41+
- federationClient.LookupStateIDs
42+
- federationClient.MSC2836EventRelationships
43+
- federationClient.MakeJoin
44+
- federationClient.MakeKnock
45+
- federationClient.MakeLeave
46+
- federationClient.P2PGetTransactionFromRelay
47+
- federationClient.P2PSendTransactionToRelay
48+
- federationClient.Peek
49+
- federationClient.QueryKeys
50+
- federationClient.RoomHierarchy
51+
- federationClient.SendInvite
52+
- federationClient.SendInviteV2
53+
- federationClient.SendInviteV3
54+
- federationClient.SendJoin
55+
- federationClient.SendJoinPartialState
56+
- federationClient.SendKnock
57+
- federationClient.SendLeave
58+
- federationClient.SendTransaction
59+
summary: |-
60+
Server-Side Request Forgery (SSRF) on redirects and federation in
61+
github.com/matrix-org/gomatrixserverlib
62+
cves:
63+
- CVE-2024-52594
64+
references:
65+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52594
66+
- fix: https://github.com/matrix-org/gomatrixserverlib/commit/c4f1e01eab0dd435709ad15463ed38a079ad6128
67+
- web: https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-4ff6-858j-r822
68+
source:
69+
id: CVE-2024-52594
70+
created: 2025-01-16T21:41:31.447885903Z
71+
review_status: REVIEWED

0 commit comments

Comments
 (0)