Skip to content

Commit 061fd45

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 7 reports
 - data/reports/GO-2025-3508.yaml - data/reports/GO-2025-3509.yaml - data/reports/GO-2025-3510.yaml - data/reports/GO-2025-3511.yaml - data/reports/GO-2025-3512.yaml - data/reports/GO-2025-3514.yaml - data/reports/GO-2025-3515.yaml Fixes #3508 Fixes #3509 Fixes #3510 Fixes #3511 Fixes #3512 Fixes #3514 Fixes #3515 Change-Id: I47e0e0ed27716c87e93329e4c230a10848457115 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/657255 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Neal Patel <[email protected]> Commit-Queue: Neal Patel <[email protected]>
1 parent 46851c8 commit 061fd45

14 files changed

+655
-0
lines changed

‎data/osv/GO-2025-3508.json

+93
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3508",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-52812",
8+
"GHSA-6hrw-x7pr-4mp8"
9+
],
10+
"summary": "LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper",
11+
"details": "LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/lf-edge/ekuiper",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/lf-edge/ekuiper/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.0.8"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52812"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794"
75+
},
76+
{
77+
"type": "WEB",
78+
"url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809"
79+
},
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8"
87+
}
88+
],
89+
"database_specific": {
90+
"url": "https://pkg.go.dev/vuln/GO-2025-3508",
91+
"review_status": "UNREVIEWED"
92+
}
93+
}

‎data/osv/GO-2025-3509.json

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3509",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27616",
8+
"GHSA-9m63-33q3-xq5x"
9+
],
10+
"summary": "Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server",
11+
"details": "Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/go-vela/server",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.25.3"
27+
},
28+
{
29+
"introduced": "0.26.0"
30+
},
31+
{
32+
"fixed": "0.26.3"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27616"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5"
52+
},
53+
{
54+
"type": "FIX",
55+
"url": "https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/go-vela/server/releases/tag/v0.25.3"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/go-vela/server/releases/tag/v0.26.3"
64+
}
65+
],
66+
"database_specific": {
67+
"url": "https://pkg.go.dev/vuln/GO-2025-3509",
68+
"review_status": "UNREVIEWED"
69+
}
70+
}

‎data/osv/GO-2025-3510.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3510",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-1296",
8+
"GHSA-c3q9-q986-vrwh"
9+
],
10+
"summary": "Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs in github.com/hashicorp/nomad",
11+
"details": "Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs in github.com/hashicorp/nomad",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/hashicorp/nomad",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-c3q9-q986-vrwh"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1296"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/hashicorp/nomad/commit/dc482bf9058faf7a192486eb52caa1d42646f6b3"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://discuss.hashicorp.com/t/hcsec-2025-04-nomad-exposes-sensitive-workload-identity-and-client-secret-token-in-audit-logs/73737"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2025-3510",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2025-3511.json

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3511",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27403",
8+
"GHSA-44f7-5fj5-h4px"
9+
],
10+
"summary": "Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify",
11+
"details": "Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries in github.com/deislabs/ratify",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/deislabs/ratify",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.2.3"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/ratify-project/ratify",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "1.3.0"
44+
},
45+
{
46+
"fixed": "1.3.2"
47+
}
48+
]
49+
}
50+
],
51+
"ecosystem_specific": {}
52+
}
53+
],
54+
"references": [
55+
{
56+
"type": "ADVISORY",
57+
"url": "https://github.com/ratify-project/ratify/security/advisories/GHSA-44f7-5fj5-h4px"
58+
},
59+
{
60+
"type": "ADVISORY",
61+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27403"
62+
},
63+
{
64+
"type": "FIX",
65+
"url": "https://github.com/ratify-project/ratify/commit/0ec0c08490e3d672ae64b1a220c90d5484f1c93f"
66+
},
67+
{
68+
"type": "FIX",
69+
"url": "https://github.com/ratify-project/ratify/commit/84c7c48fa76bb9a1c9583635d1e90bc25b1a546c"
70+
}
71+
],
72+
"database_specific": {
73+
"url": "https://pkg.go.dev/vuln/GO-2025-3511",
74+
"review_status": "UNREVIEWED"
75+
}
76+
}

‎data/osv/GO-2025-3512.json

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3512",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-1725",
8+
"GHSA-fg9q-5cw2-p6r9"
9+
],
10+
"summary": "kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver",
11+
"details": "kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/kubevirt/csi-driver before v0.0.0-202403081943-cc28dcbb0afc14.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/kubevirt/csi-driver",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "0.0.0-202403081943-cc28dcbb0afc14"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/advisories/GHSA-fg9q-5cw2-p6r9"
49+
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1725"
53+
},
54+
{
55+
"type": "FIX",
56+
"url": "https://github.com/kubevirt/csi-driver/commit/cc28dcbb0afca0a7cb8a73bc998ab49f864ed560"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://access.redhat.com/errata/RHSA-2024:1559"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://access.redhat.com/errata/RHSA-2024:1891"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://access.redhat.com/errata/RHSA-2024:2047"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://access.redhat.com/security/cve/CVE-2024-1725"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398"
77+
}
78+
],
79+
"database_specific": {
80+
"url": "https://pkg.go.dev/vuln/GO-2025-3512",
81+
"review_status": "UNREVIEWED"
82+
}
83+
}

0 commit comments

Comments
 (0)