Skip to content

Commit 08f71b7

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 3 unreviewed reports
 - data/reports/GO-2025-3424.yaml - data/reports/GO-2025-3426.yaml - data/reports/GO-2025-3427.yaml Fixes #3424 Fixes #3426 Fixes #3427 Change-Id: I5f9d3519a0099fcfeb131fa874c355e80ff767a0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/645137 Auto-Submit: Tatiana Bradley <[email protected]> Reviewed-by: Damien Neil <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent f0cf1a6 commit 08f71b7

File tree

6 files changed

+256
-0
lines changed

6 files changed

+256
-0
lines changed

‎data/osv/GO-2025-3424.json

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3424",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-24369"
8+
],
9+
"summary": "Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x",
10+
"details": "Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/Xe/x before v1.11.0-37-gd98d70a.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/Xe/x",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {
28+
"custom_ranges": [
29+
{
30+
"type": "ECOSYSTEM",
31+
"events": [
32+
{
33+
"introduced": "0"
34+
},
35+
{
36+
"fixed": "1.11.0-37-gd98d70a"
37+
}
38+
]
39+
}
40+
]
41+
}
42+
}
43+
],
44+
"references": [
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24369"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://github.com/Xe/x/commit/7bd7b209f4f1b897de85ec8973458dc8be606a8b"
52+
},
53+
{
54+
"type": "FIX",
55+
"url": "https://github.com/Xe/x/commit/e09d0226a628f04b1d80fd83bee777894a45cd02"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://xeiaso.net/notes/2025/GHSA-56w8-8ppj-2p4f"
64+
}
65+
],
66+
"database_specific": {
67+
"url": "https://pkg.go.dev/vuln/GO-2025-3424",
68+
"review_status": "UNREVIEWED"
69+
}
70+
}

‎data/osv/GO-2025-3426.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3426",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-0750",
8+
"GHSA-hp5j-2585-qx6g"
9+
],
10+
"summary": "CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o",
11+
"details": "CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/cri-o/cri-o",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-hp5j-2585-qx6g"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0750"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://access.redhat.com/security/cve/CVE-2025-0750"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339405"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2025-3426",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2025-3427.json

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3427",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-13484",
8+
"GHSA-58fx-7v9q-3g56"
9+
],
10+
"summary": "ArgoCD Namespace Isolation Break in github.com/argoproj/argo-cd",
11+
"details": "ArgoCD Namespace Isolation Break in github.com/argoproj/argo-cd",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/argoproj/argo-cd",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/argoproj/argo-cd/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {}
46+
}
47+
],
48+
"references": [
49+
{
50+
"type": "ADVISORY",
51+
"url": "https://github.com/advisories/GHSA-58fx-7v9q-3g56"
52+
},
53+
{
54+
"type": "ADVISORY",
55+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13484"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://access.redhat.com/security/cve/CVE-2024-13484"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269376"
64+
}
65+
],
66+
"database_specific": {
67+
"url": "https://pkg.go.dev/vuln/GO-2025-3427",
68+
"review_status": "UNREVIEWED"
69+
}
70+
}

‎data/reports/GO-2025-3424.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2025-3424
2+
modules:
3+
- module: github.com/Xe/x
4+
non_go_versions:
5+
- fixed: 1.11.0-37-gd98d70a
6+
vulnerable_at: 1.11.0
7+
summary: |-
8+
Anubis has a bot protection bypass when a sophisticated attacker asks to pass a
9+
challenge of difficulty 0 in github.com/Xe/x
10+
cves:
11+
- CVE-2025-24369
12+
references:
13+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-24369
14+
- fix: https://github.com/Xe/x/commit/7bd7b209f4f1b897de85ec8973458dc8be606a8b
15+
- fix: https://github.com/Xe/x/commit/e09d0226a628f04b1d80fd83bee777894a45cd02
16+
- web: https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f
17+
- web: https://xeiaso.net/notes/2025/GHSA-56w8-8ppj-2p4f
18+
source:
19+
id: CVE-2025-24369
20+
created: 2025-01-28T17:11:12.050051-05:00
21+
review_status: UNREVIEWED

‎data/reports/GO-2025-3426.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3426
2+
modules:
3+
- module: github.com/cri-o/cri-o
4+
unsupported_versions:
5+
- last_affected: 1.33.0
6+
vulnerable_at: 1.32.0
7+
summary: CRI-O Path Traversal vulnerability in github.com/cri-o/cri-o
8+
cves:
9+
- CVE-2025-0750
10+
ghsas:
11+
- GHSA-hp5j-2585-qx6g
12+
references:
13+
- advisory: https://github.com/advisories/GHSA-hp5j-2585-qx6g
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-0750
15+
- web: https://access.redhat.com/security/cve/CVE-2025-0750
16+
- web: https://bugzilla.redhat.com/show_bug.cgi?id=2339405
17+
source:
18+
id: GHSA-hp5j-2585-qx6g
19+
created: 2025-01-28T17:11:06.765652-05:00
20+
review_status: UNREVIEWED

‎data/reports/GO-2025-3427.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: GO-2025-3427
2+
modules:
3+
- module: github.com/argoproj/argo-cd
4+
vulnerable_at: 1.8.6
5+
- module: github.com/argoproj/argo-cd/v2
6+
unsupported_versions:
7+
- last_affected: 2.10.3
8+
vulnerable_at: 2.13.3
9+
summary: ArgoCD Namespace Isolation Break in github.com/argoproj/argo-cd
10+
cves:
11+
- CVE-2024-13484
12+
ghsas:
13+
- GHSA-58fx-7v9q-3g56
14+
references:
15+
- advisory: https://github.com/advisories/GHSA-58fx-7v9q-3g56
16+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-13484
17+
- web: https://access.redhat.com/security/cve/CVE-2024-13484
18+
- web: https://bugzilla.redhat.com/show_bug.cgi?id=2269376
19+
source:
20+
id: GHSA-58fx-7v9q-3g56
21+
created: 2025-01-28T17:11:00.070853-05:00
22+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)