Skip to content

Commit 0073ceb

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 7 unreviewed reports
 - data/reports/GO-2024-3284.yaml - data/reports/GO-2024-3286.yaml - data/reports/GO-2024-3287.yaml - data/reports/GO-2024-3288.yaml - data/reports/GO-2024-3289.yaml - data/reports/GO-2024-3290.yaml - data/reports/GO-2024-3291.yaml Fixes #3284 Fixes #3286 Fixes #3287 Fixes #3288 Fixes #3289 Fixes #3290 Fixes #3291 Change-Id: I3f9c602c3b0cb612717f991bef1e379b383c19b8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/632255 Reviewed-by: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent 0d6d8f5 commit 0073ceb

14 files changed

+565
-0
lines changed

‎data/osv/GO-2024-3284.json

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3284",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-37820",
8+
"GHSA-9g6g-xqv5-8g5w"
9+
],
10+
"summary": "PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb",
11+
"details": "PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/pingcap/tidb before v8.2.0.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/pingcap/tidb",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "8.2.0"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/advisories/GHSA-9g6g-xqv5-8g5w"
49+
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37820"
53+
},
54+
{
55+
"type": "FIX",
56+
"url": "https://github.com/pingcap/tidb/commit/3d68bd21240c610c6307713e2bd54a5e71c32608"
57+
},
58+
{
59+
"type": "REPORT",
60+
"url": "https://github.com/pingcap/tidb/issues/53580"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://gist.github.com/ycybfhb/a9c1e14ce281f2f553adca84d384b761"
65+
}
66+
],
67+
"database_specific": {
68+
"url": "https://pkg.go.dev/vuln/GO-2024-3284",
69+
"review_status": "UNREVIEWED"
70+
}
71+
}

‎data/osv/GO-2024-3286.json

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3286",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-10220",
8+
"GHSA-27wf-5967-98gx"
9+
],
10+
"summary": "Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes",
11+
"details": "Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "k8s.io/kubernetes",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.28.12"
27+
},
28+
{
29+
"introduced": "1.29.0"
30+
},
31+
{
32+
"fixed": "1.29.7"
33+
},
34+
{
35+
"introduced": "1.30.0"
36+
},
37+
{
38+
"fixed": "1.30.3"
39+
}
40+
]
41+
}
42+
],
43+
"ecosystem_specific": {}
44+
}
45+
],
46+
"references": [
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://github.com/advisories/GHSA-27wf-5967-98gx"
50+
},
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10220"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "http://www.openwall.com/lists/oss-security/2024/11/20/1"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/kubernetes/kubernetes/issues/128885"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko"
70+
}
71+
],
72+
"database_specific": {
73+
"url": "https://pkg.go.dev/vuln/GO-2024-3286",
74+
"review_status": "UNREVIEWED"
75+
}
76+
}

‎data/osv/GO-2024-3287.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3287",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-45719",
8+
"GHSA-mr95-vfcf-fx9p"
9+
],
10+
"summary": "Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer",
11+
"details": "Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/apache/incubator-answer",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.4.1"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-mr95-vfcf-fx9p"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45719"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "http://www.openwall.com/lists/oss-security/2024/11/22/1"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://lists.apache.org/thread/sz2d0z39k01nbx3r9pj65t76o1hy9491"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2024-3287",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2024-3288.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3288",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-7f6p-phw2-8253"
8+
],
9+
"summary": "Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig",
10+
"details": "Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/taurusgroup/multi-party-sig",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://github.com/taurushq-io/multi-party-sig/security/advisories/GHSA-7f6p-phw2-8253"
34+
},
35+
{
36+
"type": "WEB",
37+
"url": "https://eprint.iacr.org/2018/499.pdf"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/taurushq-io/multi-party-sig/blob/4d84aafb57b437da1b933db9a265fb7ce4e7c138/internal/ot/extended.go#L188"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/taurushq-io/multi-party-sig/blob/9e4400fccee89be6195d0a12dd0ed052288d5040/internal/ot/extended.go#L114"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/taurushq-io/multi-party-sig/tree/otfix"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2024-3288",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2024-3289.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3289",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-6538",
8+
"GHSA-v3w7-g6p2-mpx7"
9+
],
10+
"summary": "OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console",
11+
"details": "OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/openshift/console",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-v3w7-g6p2-mpx7"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6538"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://access.redhat.com/security/cve/CVE-2024-6538"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296057"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2024-3289",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2024-3290.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3290",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-52529",
8+
"GHSA-xg58-75qf-9r67"
9+
],
10+
"summary": "Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium",
11+
"details": "Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/cilium/cilium",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.16.0"
24+
},
25+
{
26+
"fixed": "1.16.4"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-xg58-75qf-9r67"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52529"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/cilium/cilium/pull/35150"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2024-3290",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

0 commit comments

Comments
 (0)