Skip to content

Commit 0cf3970

Browse files
tatianabTatiana Bradley
tatianab
authored and
Tatiana Bradley
committed
x/vulndb: add newly reserved CVE IDs to reports without a CVE ID
Adds cve_metadata with a CVE ID and CWE ID for each report that did not have a CVE ID. Note: we still need to publish CVE records for each of these reports. Change-Id: I762370deb6c721fa413058b7d153b565371bff1c Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/420035 Reviewed-by: Julie Qiu <[email protected]> Run-TryBot: Tatiana Bradley <[email protected]> TryBot-Result: Gopher Robot <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]>
1 parent d66b9fe commit 0cf3970

30 files changed

+82
-12
lines changed

‎reports/GO-2020-0001.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@ links:
1414
pr: https://github.com/gin-gonic/gin/pull/2237
1515
commit: https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d
1616
cve_metadata:
17-
id: CVE-9999-0001
18-
cwe: 'CWE-20: Improper Input Validation'
17+
id: CVE-2020-36567
18+
cwe: "CWE-117 Improper Output Neutralization for Logs"
1919
description: |
2020
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0
2121
allows remote attackers to inject arbitrary log lines.

‎reports/GO-2020-0003.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ links:
1414
context:
1515
- https://github.com/revel/revel/issues/1424
1616
cve_metadata:
17-
id: CVE-9999-0002
17+
id: CVE-2020-36568
1818
cwe: 'CWE-400: Uncontrolled Resource Consumption'
1919
description: |
2020
Unsanitized input in the query parser in github.com/revel/revel before v1.0.0

‎reports/GO-2020-0004.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ links:
2323
pr: https://github.com/nanobox-io/golang-nanoauth/pull/5
2424
commit: https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
2525
cve_metadata:
26-
id: CVE-9999-0003
26+
id: CVE-2020-36569
2727
cwe: 'CWE-305: Authentication Bypass by Primary Weakness'
2828
description: |
2929
Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between

‎reports/GO-2020-0020.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ description: |
1010
header, which bypasses the expected behavior of the Same Origin Policy.
1111
published: 2021-04-14T20:04:52Z
1212
credit: Evan J Johnson
13+
cve_metadata:
14+
id: CVE-2017-20146
15+
cwe: "CWE 284: Improper Access Control"
1316
links:
1417
pr: https://github.com/gorilla/handlers/pull/116
1518
commit: https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145

‎reports/GO-2020-0022.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ description: |
1010
if called with untrusted user input.
1111
published: 2021-04-14T20:04:52Z
1212
credit: Yann Collet
13+
cve_metadata:
14+
id: CVE-2014-125026
15+
cwe: "CWE 94: Improper Control of Generation of Code ('Code Injection')"
1316
links:
1417
commit: https://github.com/cloudflare/golz4/commit/199f5f7878062ca17a98e079f2dbe1205e2ed898
1518
context:

‎reports/GO-2020-0023.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ description: |
1010
over a low latency connection, an attacker may use this to determine
1111
the expected HMAC.
1212
published: 2021-04-14T20:04:52Z
13+
cve_metadata:
14+
id: CVE-2015-10004
15+
cwe: "CWE 208: Information Exposure Through Timing Discrepancy"
1316
links:
1417
commit: https://github.com/robbert229/jwt/commit/ca1404ee6e83fcbafb66b09ed0d543850a15b654
1518
context:

‎reports/GO-2020-0024.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,8 @@ description: |
1818
call themselves, leading to an infinite loop which will crash the
1919
program due to a stack overflow.
2020
published: 2021-04-14T20:04:52Z
21+
cve_metadata:
22+
id: CVE-2013-10005
23+
cwe: "CWE 400: Uncontrolled Resource Consumption"
2124
links:
2225
commit: https://github.com/btcsuite/go-socks/commit/233bccbb1abe02f05750f7ace66f5bffdb13defc

‎reports/GO-2020-0025.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ description: |
1616
paths can cause files to be written (or overwritten) outside of the
1717
target directory.
1818
published: 2021-04-14T20:04:52Z
19+
cve_metadata:
20+
id: CVE-2018-25046
21+
cwe: 'CWE 29: Path Traversal: "\..\filename"'
1922
links:
2023
commit: https://github.com/cloudfoundry/archiver/commit/09b5706aa9367972c09144a450bb4523049ee840
2124
context:

‎reports/GO-2020-0029.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ description: |
1010
a user to bypass IP based restrictions, or obfuscate their true source.
1111
published: 2021-04-14T20:04:52Z
1212
credit: '@nl5887'
13+
cves:
14+
- CVE-2020-28483
1315
links:
1416
pr: https://github.com/gin-gonic/gin/pull/182
1517
commit: https://github.com/gin-gonic/gin/commit/0099840c98ae1473c5ff0f18bc93a8e13ceed829

‎reports/GO-2020-0032.yaml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,8 @@ links:
2424
pr: https://github.com/goadesign/goa/pull/2388
2525
commit: https://github.com/goadesign/goa/commit/70b5a199d0f813d74423993832c424e1fc73fb39
2626
cve_metadata:
27-
id: CVE-9999-0012
28-
cwe: 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path
29-
Traversal'')'
27+
id: CVE-2019-25073
28+
cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory('Path Traversal')"
3029
description: |
3130
Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or
3231
v1.4.3 allow remote attackers to read files outside of the intended directory.

‎reports/GO-2020-0033.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ description: |
1414
the target directory that the server has permission to read.
1515
published: 2021-04-14T20:04:52Z
1616
credit: '@snyff'
17+
cve_metadata:
18+
id: CVE-2020-36559
19+
cwe: "CWE 23: Relative Path Traversal"
1720
links:
1821
pr: https://github.com/go-aah/aah/pull/267
1922
commit: https://github.com/go-aah/aah/commit/881dc9f71d1f7a4e8a9a39df9c5c081d3a2da1ec

‎reports/GO-2020-0034.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ description: |
99
paths can cause files to be written (or overwritten) outside of the
1010
target directory.
1111
published: 2021-04-14T20:04:52Z
12+
cve_metadata:
13+
id: CVE-2020-36560
14+
cwe: 'CWE 29: Path Traversal: "\..\filename"'
1215
links:
1316
pr: https://github.com/artdarek/go-unzip/pull/2
1417
commit: https://github.com/artdarek/go-unzip/commit/4975cbe0a719dc50b12da8585f1f207c82f7dfe0

‎reports/GO-2020-0035.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ description: |
99
paths can cause files to be written (or overwritten) outside of the
1010
target directory.
1111
published: 2021-04-14T20:04:52Z
12+
cve_metadata:
13+
id: CVE-2020-36561
14+
cwe: 'CWE 29: Path Traversal: "\..\filename"'
1215
links:
1316
pr: https://github.com/yi-ge/unzip/pull/1
1417
commit: https://github.com/yi-ge/unzip/commit/2adbaa4891b9690853ef10216189189f5ad7dc73

‎reports/GO-2020-0037.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ description: |
1212
resources, which may be used as a denial of service vector.
1313
published: 2021-04-14T20:04:52Z
1414
credit: '@guagualvcha'
15+
cve_metadata:
16+
id: CVE-2019-25072
17+
cwe: "CWE-400: Uncontrolled Resource Consumption"
1518
links:
1619
pr: https://github.com/tendermint/tendermint/pull/3430
1720
commit: https://github.com/tendermint/tendermint/commit/03085c2da23b179c4a51f59a03cb40aa4e85a613

‎reports/GO-2020-0040.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ description: |
55
cause panics, which may be used as a denial of service vector.
66
published: 2021-04-14T20:04:52Z
77
credit: '@hMihaiDavid'
8+
cve_metadata:
9+
id: CVE-2020-36562
10+
cwe: "CWE-400: Uncontrolled Resource Consumption"
811
links:
912
context:
1013
- https://github.com/shiyanhui/dht/issues/57

‎reports/GO-2020-0045.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ description: |
1313
allowing an attacker to bypass CSRF protections which relatively few requests.
1414
published: 2021-04-14T20:04:52Z
1515
credit: '@elithrar'
16+
cve_metadata:
17+
id: CVE-2016-15005
18+
cwe: "CWE 338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
1619
links:
1720
pr: https://github.com/dinever/golf/pull/24
1821
commit: https://github.com/dinever/golf/commit/3776f338be48b5bc5e8cf9faff7851fc52a3f1fe

‎reports/GO-2020-0047.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ description: |
99
SHA-1, which may allow an attacker to craft inputs which cause hash
1010
collisions depending on their control over the input.
1111
published: 2021-04-14T20:04:52Z
12+
cve_metadata:
13+
id: CVE-2020-36563
14+
cwe: "CWE 328: Use of Weak Hash"
1215
links:
1316
context:
1417
- https://github.com/RobotsAndPencils/go-saml/pull/38

‎reports/GO-2020-0049.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ description: |
1313
to be considered valid.
1414
published: 2021-04-14T20:04:52Z
1515
credit: '@aeneasr'
16+
cve_metadata:
17+
id: CVE-2020-36564
18+
cwe: "CWE 345: Insufficient Verification of Data Authenticity"
1619
links:
1720
pr: https://github.com/justinas/nosurf/pull/60
1821
commit: https://github.com/justinas/nosurf/commit/4d86df7a4affa1fa50ab39fb09aac56c3ce9c314

‎reports/GO-2021-0051.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ description: |
1010
the target directory that the server has permission to read.
1111
published: 2021-04-14T20:04:52Z
1212
credit: '@little-cui (Apache ServiceComb)'
13+
cve_metadata:
14+
id: CVE-2020-36565
15+
cwe: "CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
1316
os:
1417
- windows
1518
links:

‎reports/GO-2021-0058.yaml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,3 @@ ghsas:
3030
- GHSA-4hq8-gmxx-h6w9
3131
links:
3232
commit: https://github.com/crewjam/saml/commit/da4f1a0612c0a8dd0452cf8b3c7a6518f6b4d053
33-
context:
34-
- https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9

‎reports/GO-2021-0061.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ description: |
1919
Due to unbounded alias chasing, a maliciously crafted YAML file
2020
can cause the system to consume significant system resources. If
2121
parsing user input, this may be used as a denial of service vector.
22+
cve_metadata:
23+
id: CVE-2021-4235
24+
cwe: "CWE 400: Uncontrolled Resource Consumption"
2225
published: 2021-04-14T20:04:52Z
2326
credit: '@simonferquel'
2427
links:

‎reports/GO-2021-0106.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ description: |
99
paths can cause files to be written (or overwritten) outside of the
1010
target directory.
1111
published: 2021-07-28T18:08:05Z
12+
cve_metadata:
13+
id: CVE-2020-36566
14+
cwe: "CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
1215
links:
1316
commit: https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
1417
context:

‎reports/GO-2021-0107.yaml

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,14 @@ packages:
77
versions:
88
- fixed: 1.5.2
99
description: |
10-
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a
10+
Web Sockets do not execute any AuthenticateMethod methods which may be set,leading to a
1111
nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or
1212
authentication bypass.
1313
published: 2021-07-28T18:08:05Z
14+
cve_metadata:
15+
id: CVE-2021-4236
16+
cwe: 'CWE-400: Uncontrolled Resource Consumption'
17+
ghsas:
18+
- GHSA-5gjg-jgh4-gppm
1419
links:
1520
commit: https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f
16-
context:
17-
- https://github.com/advisories/GHSA-5gjg-jgh4-gppm

‎reports/GO-2022-0384.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ description: |
2121
2222
For further details, see
2323
https://github.com/advisories/GHSA-56hp-xqp3-w2jf.
24+
cves:
25+
- CVE-2021-32690
2426
ghsas:
2527
- GHSA-56hp-xqp3-w2jf
2628
links:

‎reports/GO-2022-0385.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ description: |
1515
This issue only affects WebSockets with an AuthenticateMethod hook.
1616
Request handlers that do not explicitly use WebSockets are not
1717
vulnerable.
18+
cve_metadata:
19+
id: CVE-2021-4237
20+
cwe: "CWE 287: Improper Authentication"
1821
ghsas:
1922
- GHSA-5gjg-jgh4-gppm
2023
links:

‎reports/GO-2022-0391.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ description: |
2424
the plaintext, if the hash is readable to the attacker.
2525
2626
AWS now blocks this metadata field, but older SDK versions still send it.
27+
cve_metadata:
28+
id: CVE-2022-2582
29+
cwe: "CWE 311: Missing Encryption of Sensitive Data"
2730
ghsas:
2831
- GHSA-76wf-9vgp-pj7w
2932
links:

‎reports/GO-2022-0400.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,8 @@ packages:
1010
description: A race condition can cause incorrect HTTP request routing.
1111
ghsas:
1212
- GHSA-h2x7-2ff6-v32p
13+
cve_metadata:
14+
id: CVE-2022-2583
15+
cwe: "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
1316
links:
1417
commit: https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812

‎reports/GO-2022-0411.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,8 @@ description: |
1515
reduces the amount of entropy in short strings generated by these functions.
1616
ghsas:
1717
- GHSA-xg2h-wx96-xgxr
18+
cve_metadata:
19+
id: CVE-2021-4238
20+
cwe: "CWE 330: Use of Insufficiently Random Values"
1821
links:
1922
commit: https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1

‎reports/GO-2022-0422.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,8 @@ packages:
1212
description: The dag-pb codec can panic when decoding invalid blocks.
1313
ghsas:
1414
- GHSA-g3vv-g2j5-45f2
15+
cve_metadata:
16+
id: CVE-2022-2584
17+
cwe: "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
1518
links:
1619
commit: https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57

‎reports/GO-2022-0425.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,8 @@ published: 2022-02-15T01:57:18Z
2929
last_modified: 2022-04-12T22:48:22Z
3030
ghsas:
3131
- GHSA-g9mp-8g3h-3c5c
32+
cve_metadata:
33+
id: CVE-2021-4239
34+
cwe: "CWE 400: Uncontrolled Resource Consumption"
3235
links:
3336
pr: https://github.com/flynn/noise/pull/44

0 commit comments

Comments
 (0)