Skip to content

Commit 2122bde

Browse files
tatianabtatianab
committed
internal/{report, symbols}: various fixes to support automation
Adds a few general improvements to make it more likely that automation will succeed with no lint/fix errors for UNREVIEWED reports. Specifically: - For CVEs: - don't populate a package if it is the same as the module path - fix incorrect classification of vulns as affecting stdlib if their packages don't contain a "." (usually this is a mistake) - Auto-convert "versions" to "non_go_versions" if none of the versions exist according to the proxy - Make error messages for symbol population more specific so it is more clear what caused the error - Add an advisory referencing the source ID if not present - Improve classification of advisories by checking if a CVE/GHSA alias is actually referenced - Relax lint checks for unreviewed reports: - Unreviewed report summaries do not need to conform to style - Unreviewed reports must have at least one advisory, but may have more Change-Id: I3762202d4eeb60cff3dc407c3f9ab9a208a91134 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/583476 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]>
1 parent 4404374 commit 2122bde

File tree

98 files changed

+784
-302
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+784
-302
lines changed

‎internal/cve4/testdata/cve/TestToReport/CVE-2020-9283.txtar

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ references:
2626
- web: https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
2727
- web: https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
2828
- web: https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
29+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2020-9283
2930
source:
3031
id: CVE-2020-9283
3132
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2021-27919.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ references:
2222
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/
2323
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/
2424
- web: https://security.gentoo.org/glsa/202208-02
25+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-27919
26+
notes:
27+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
2528
source:
2629
id: CVE-2021-27919
2730
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2021-3115.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ references:
2424
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
2525
- web: https://security.netapp.com/advisory/ntap-20210219-0001/
2626
- web: https://security.gentoo.org/glsa/202208-02
27+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-3115
28+
notes:
29+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
2730
source:
2831
id: CVE-2021-3115
2932
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2022-39213.txtar

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,10 @@ description: |-
2929
cves:
3030
- CVE-2022-39213
3131
references:
32-
- advisory: https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx
32+
- web: https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx
3333
- fix: https://github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4
3434
- web: https://github.com/pandatix/go-cvss/blob/master/SECURITY.md
35+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-39213
3536
source:
3637
id: CVE-2022-39213
3738
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2023-29407.txtar

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ references:
2323
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
2424
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/
2525
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
26+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-29407
2627
cve_metadata:
2728
id: CVE-2023-29407
2829
cwe: 'CWE-834: Excessive Iteration'

‎internal/cve4/testdata/cve/TestToReport/CVE-2023-44378.txtar

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,10 @@ description: |-
2424
cves:
2525
- CVE-2023-44378
2626
references:
27-
- advisory: https://github.com/Consensys/gnark/security/advisories/GHSA-498w-5j49-vqjg
27+
- web: https://github.com/Consensys/gnark/security/advisories/GHSA-498w-5j49-vqjg
2828
- report: https://github.com/zkopru-network/zkopru/issues/116
2929
- fix: https://github.com/Consensys/gnark/commit/59a4087261a6c73f13e80d695c17b398c3d0934f
30+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-44378
3031
source:
3132
id: CVE-2023-44378
3233
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2023-45141.txtar

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ description: |-
2626
cves:
2727
- CVE-2023-45141
2828
references:
29-
- advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p
29+
- web: https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p
30+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45141
3031
source:
3132
id: CVE-2023-45141
3233
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2023-45283.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,12 @@ references:
3434
- fix: https://go.dev/cl/541175
3535
- web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
3636
- web: http://www.openwall.com/lists/oss-security/2023/12/05/2
37+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45283
3738
cve_metadata:
3839
id: CVE-2023-45283
3940
cwe: 'CWE-41: Improper Resolution of Path Equivalence'
41+
notes:
42+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
4043
source:
4144
id: CVE-2023-45283
4245
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2023-45285.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,12 @@ references:
2121
- web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
2222
- report: https://go.dev/issue/63845
2323
- fix: https://go.dev/cl/540257
24+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45285
2425
cve_metadata:
2526
id: CVE-2023-45285
2627
cwe: 'CWE-636: Not Failing Securely (''Failing Open'')'
28+
notes:
29+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
2730
source:
2831
id: CVE-2023-45285
2932
created: 1999-01-01T00:00:00Z

‎internal/cve4/testdata/cve/TestToReport/CVE-2023-45286.txtar

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Expected output of TestToReport/CVE-2023-45286.
88
id: GO-ID-PENDING
99
modules:
1010
- module: github.com/go-resty/resty/v2
11-
vulnerable_at: 2.12.0
11+
vulnerable_at: 2.13.1
1212
packages:
1313
- package: github.com/go-resty/resty/v2
1414
summary: CVE-2023-45286 in github.com/go-resty/resty/v2
@@ -26,6 +26,7 @@ references:
2626
- report: https://github.com/go-resty/resty/issues/743
2727
- report: https://github.com/go-resty/resty/issues/739
2828
- fix: https://github.com/go-resty/resty/pull/745
29+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45286
2930
cve_metadata:
3031
id: CVE-2023-45286
3132
cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'

‎internal/cve4/testdata/proxy/TestToReport.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@
88
"status_code": 200
99
},
1010
"github.com/go-resty/resty/v2/@latest": {
11-
"body": "{\"Version\":\"v2.12.0\",\"Time\":\"2024-03-17T20:50:19Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://github.com/go-resty/resty\",\"Ref\":\"refs/tags/v2.12.0\",\"Hash\":\"89d25d9d1aed90c422d5dd816e6788ac4e893def\"}}",
11+
"body": "{\"Version\":\"v2.13.1\",\"Time\":\"2024-05-11T01:40:23Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://github.com/go-resty/resty\",\"Ref\":\"refs/tags/v2.13.1\",\"Hash\":\"baf7c1219b781803557018eba206ad8fa544941f\"}}",
1212
"status_code": 200
1313
},
1414
"github.com/go-resty/resty/v2/@v/list": {
15-
"body": "v2.3.0\nv2.2.0\nv2.9.1\nv2.6.0\nv2.0.0-rc.3\nv2.3.0-rc.1\nv2.0.0-rc.1\nv2.0.0-rc.4\nv2.0.0\nv2.4.0\nv2.10.0-rc.1\nv2.12.0\nv2.8.0\nv2.7.0\nv2.10.0-rc.3\nv2.1.0\nv2.10.0\nv2.11.0\nv2.9.0\nv2.0.0-rc.2\nv2.3.0-rc.2\nv2.5.0\nv2.10.0-rc.2\n",
15+
"body": "v2.3.0\nv2.13.1\nv2.2.0\nv2.9.1\nv2.6.0\nv2.0.0-rc.3\nv2.13.0\nv2.3.0-rc.1\nv2.0.0-rc.1\nv2.0.0-rc.4\nv2.0.0\nv2.4.0\nv2.10.0-rc.1\nv2.12.0\nv2.8.0\nv2.7.0\nv2.10.0-rc.3\nv2.1.0\nv2.10.0\nv2.11.0\nv2.9.0\nv2.0.0-rc.2\nv2.3.0-rc.2\nv2.5.0\nv2.10.0-rc.2\n",
1616
"status_code": 200
1717
},
1818
"github.com/gofiber/fiber/@latest": {

‎internal/cve5/report.go

Lines changed: 30 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"strings"
1212

1313
"golang.org/x/vulndb/internal/derrors"
14+
"golang.org/x/vulndb/internal/idstr"
1415
"golang.org/x/vulndb/internal/report"
1516
"golang.org/x/vulndb/internal/stdlib"
1617
"golang.org/x/vulndb/internal/version"
@@ -86,7 +87,7 @@ func FromReport(r *report.Report) (_ *CVERecord, err error) {
8687
c.References = append(c.References, Reference{URL: ref.URL})
8788
}
8889
c.References = append(c.References, Reference{
89-
URL: report.GoAdvisory(r.ID),
90+
URL: idstr.GoAdvisory(r.ID),
9091
})
9192
for _, ref := range r.CVEMetadata.References {
9293
c.References = append(c.References, Reference{URL: ref})
@@ -262,32 +263,37 @@ func affectedToModule(a *Affected, modulePath string) *report.Module {
262263
pkgPath = modulePath
263264
}
264265

265-
if stdlib.Contains(pkgPath) {
266+
if stdlib.Contains(modulePath) && stdlib.Contains(pkgPath) {
266267
if strings.HasPrefix(pkgPath, stdlib.ToolchainModulePath) {
267268
modulePath = stdlib.ToolchainModulePath
268269
} else {
269270
modulePath = stdlib.ModulePath
270271
}
271272
}
272273

273-
var symbols []string
274-
for _, s := range a.ProgramRoutines {
275-
symbols = append(symbols, s.Name)
276-
}
277-
278274
vs, uvs := convertVersions(a.Versions, a.DefaultStatus)
279275

280-
return &report.Module{
281-
Module: modulePath,
282-
Versions: vs,
283-
UnsupportedVersions: uvs,
284-
Packages: []*report.Package{
276+
// Add a package if we have any meaningful package-level data.
277+
var pkgs []*report.Package
278+
if pkgPath != modulePath || len(a.ProgramRoutines) != 0 || len(a.Platforms) != 0 {
279+
var symbols []string
280+
for _, s := range a.ProgramRoutines {
281+
symbols = append(symbols, s.Name)
282+
}
283+
pkgs = []*report.Package{
285284
{
286285
Package: pkgPath,
287286
Symbols: symbols,
288287
GOOS: a.Platforms,
289288
},
290-
},
289+
}
290+
}
291+
292+
return &report.Module{
293+
Module: modulePath,
294+
Versions: vs,
295+
UnsupportedVersions: uvs,
296+
Packages: pkgs,
291297
}
292298
}
293299

@@ -315,19 +321,21 @@ var (
315321
)
316322

317323
func toVersionRange(cvr *VersionRange, defaultStatus VersionStatus) (*report.VersionRange, bool) {
324+
intro, fixed := version.TrimPrefix(string(cvr.Introduced)), version.TrimPrefix(string(cvr.Fixed))
325+
318326
// Handle special cases where the info is not quite correctly encoded but
319327
// we can still figure out the intent.
320328

321329
// Case one: introduced version is of the form "<= X, < Y".
322-
if m := introducedFixedRE.FindStringSubmatch(string(cvr.Introduced)); len(m) == 3 {
330+
if m := introducedFixedRE.FindStringSubmatch(intro); len(m) == 3 {
323331
return &report.VersionRange{
324332
Introduced: m[1],
325333
Fixed: m[2],
326334
}, true
327335
}
328336

329337
// Case two: introduced version is of the form "< Y".
330-
if m := fixedRE.FindStringSubmatch(string(cvr.Introduced)); len(m) == 2 {
338+
if m := fixedRE.FindStringSubmatch(intro); len(m) == 2 {
331339
return &report.VersionRange{
332340
Fixed: m[1],
333341
}, true
@@ -336,21 +344,20 @@ func toVersionRange(cvr *VersionRange, defaultStatus VersionStatus) (*report.Ver
336344
// For now, don't attempt to fix any other messed up cases.
337345
if cvr.VersionType != typeSemver ||
338346
cvr.LessThanOrEqual != "" ||
339-
!version.IsValid(string(cvr.Introduced)) ||
340-
!version.IsValid(string(cvr.Fixed)) ||
347+
!version.IsValid(intro) ||
348+
!version.IsValid(fixed) ||
341349
cvr.Status != StatusAffected ||
342350
defaultStatus != StatusUnaffected {
343351
return nil, false
344352
}
345353

346-
introduced := string(cvr.Introduced)
347-
if introduced == "0" {
348-
introduced = ""
354+
if intro == "0" {
355+
intro = ""
349356
}
350357

351358
return &report.VersionRange{
352-
Introduced: introduced,
353-
Fixed: string(cvr.Fixed),
359+
Introduced: intro,
360+
Fixed: fixed,
354361
}, true
355362
}
356363

@@ -360,7 +367,7 @@ func toUnsupported(cvr *VersionRange, defaultStatus VersionStatus) report.Unsupp
360367
case cvr.Fixed != "":
361368
version = fmt.Sprintf("%s from %s before %s", cvr.Status, cvr.Introduced, cvr.Fixed)
362369
case cvr.LessThanOrEqual != "":
363-
version = fmt.Sprintf("%s from %s to %s", cvr.Status, cvr.Introduced, cvr.Fixed)
370+
version = fmt.Sprintf("%s from %s to %s", cvr.Status, cvr.Introduced, cvr.LessThanOrEqual)
364371
default:
365372
version = fmt.Sprintf("%s at %s", cvr.Status, cvr.Introduced)
366373
}

‎internal/cve5/testdata/cve/TestToReport/CVE-2020-9283.txtar

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@ id: GO-ID-PENDING
99
modules:
1010
- module: golang.org/x/crypto
1111
vulnerable_at: 0.23.0
12-
packages:
13-
- package: golang.org/x/crypto
1412
summary: CVE-2020-9283 in golang.org/x/crypto
1513
description: |-
1614
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a
@@ -26,6 +24,7 @@ references:
2624
- web: https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
2725
- web: https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
2826
- web: https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html
27+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2020-9283
2928
source:
3029
id: CVE-2020-9283
3130
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2021-27919.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ references:
2222
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/
2323
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/
2424
- web: https://security.gentoo.org/glsa/202208-02
25+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-27919
26+
notes:
27+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
2528
source:
2629
id: CVE-2021-27919
2730
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2021-3115.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ references:
2424
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
2525
- web: https://security.netapp.com/advisory/ntap-20210219-0001/
2626
- web: https://security.gentoo.org/glsa/202208-02
27+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-3115
28+
notes:
29+
- fix: 'cmd: could not add vulnerable_at: not implemented for std/cmd'
2730
source:
2831
id: CVE-2021-3115
2932
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2022-39213.txtar

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ modules:
1212
- introduced: 0.2.0
1313
fixed: 0.4.0
1414
vulnerable_at: 0.3.0
15-
packages:
16-
- package: github.com/pandatix/go-cvss
1715
summary: Out-of-bounds Read in go-cvss in github.com/pandatix/go-cvss
1816
description: |-
1917
go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS).
@@ -32,9 +30,10 @@ description: |-
3230
cves:
3331
- CVE-2022-39213
3432
references:
35-
- advisory: https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx
33+
- web: https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx
3634
- fix: https://github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4
3735
- web: https://github.com/pandatix/go-cvss/blob/master/SECURITY.md
36+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-39213
3837
source:
3938
id: CVE-2022-39213
4039
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2023-29407.txtar

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ references:
3333
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/
3434
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/
3535
- web: https://lists.fedoraproject.org/archives/list/[email protected]/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
36+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-29407
3637
cve_metadata:
3738
id: CVE-2023-29407
3839
cwe: 'CWE-834: Excessive Iteration'

‎internal/cve5/testdata/cve/TestToReport/CVE-2023-44378.txtar

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ modules:
1111
versions:
1212
- fixed: 0.9.0
1313
vulnerable_at: 0.9.0-alpha
14-
packages:
15-
- package: github.com/consensys/gnark
1614
summary: |-
1715
gnark vulnerable to unsoundness in variable comparison/non-unique binary
1816
decomposition in github.com/consensys/gnark
@@ -28,9 +26,10 @@ description: |-
2826
cves:
2927
- CVE-2023-44378
3028
references:
31-
- advisory: https://github.com/Consensys/gnark/security/advisories/GHSA-498w-5j49-vqjg
29+
- web: https://github.com/Consensys/gnark/security/advisories/GHSA-498w-5j49-vqjg
3230
- report: https://github.com/zkopru-network/zkopru/issues/116
3331
- fix: https://github.com/Consensys/gnark/commit/59a4087261a6c73f13e80d695c17b398c3d0934f
32+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-44378
3433
source:
3534
id: CVE-2023-44378
3635
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2023-45141.txtar

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,9 @@ Expected output of TestToReport/CVE-2023-45141.
88
id: GO-ID-PENDING
99
modules:
1010
- module: github.com/gofiber/fiber
11-
versions:
11+
non_go_versions:
1212
- fixed: 2.50.0
13-
packages:
14-
- package: github.com/gofiber/fiber
13+
vulnerable_at: 1.14.6
1514
summary: CSRF Token Validation Vulnerability in fiber in github.com/gofiber/fiber
1615
description: |-
1716
Fiber is an express inspired web framework written in Go. A Cross-Site Request
@@ -27,7 +26,8 @@ description: |-
2726
cves:
2827
- CVE-2023-45141
2928
references:
30-
- advisory: https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p
29+
- web: https://github.com/gofiber/fiber/security/advisories/GHSA-mv73-f69x-444p
30+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45141
3131
source:
3232
id: CVE-2023-45141
3333
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2023-45283.txtar

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,11 +93,15 @@ references:
9393
- fix: https://go.dev/cl/541175
9494
- web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
9595
- web: http://www.openwall.com/lists/oss-security/2023/12/05/2
96+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45283
9697
cve_metadata:
9798
id: CVE-2023-45283
9899
cwe: 'CWE-41: Improper Resolution of Path Equivalence'
99100
notes:
100101
- fix: 'module merge error: could not merge versions of module std: range events must be in strictly ascending order (found 1.20.11>=1.20.11)'
102+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
103+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
104+
- fix: 'std: could not add vulnerable_at: not implemented for std/cmd'
101105
source:
102106
id: CVE-2023-45283
103107
created: 1999-01-01T00:00:00Z

‎internal/cve5/testdata/cve/TestToReport/CVE-2023-45285.txtar

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,12 @@ references:
2727
- web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
2828
- report: https://go.dev/issue/63845
2929
- fix: https://go.dev/cl/540257
30+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-45285
3031
cve_metadata:
3132
id: CVE-2023-45285
3233
cwe: 'CWE-636: Not Failing Securely (''Failing Open'')'
34+
notes:
35+
- fix: 'cmd: could not add vulnerable_at: not implemented for std/cmd'
3336
source:
3437
id: CVE-2023-45285
3538
created: 1999-01-01T00:00:00Z

0 commit comments

Comments
 (0)