Skip to content

Commit 5153d9b

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 4 reports
 - data/reports/GO-2025-3527.yaml - data/reports/GO-2025-3528.yaml - data/reports/GO-2025-3529.yaml - data/reports/GO-2025-3530.yaml Fixes #3527 Fixes #3528 Fixes #3529 Fixes #3530 Change-Id: I9fecefd23b84996e5bcda75c65362327043092eb Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/658855 Reviewed-by: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Neal Patel <[email protected]>
1 parent d8177bd commit 5153d9b

8 files changed

+343
-0
lines changed

‎data/osv/GO-2025-3527.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3527",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-0495",
8+
"GHSA-m4gq-fm9h-8q75"
9+
],
10+
"summary": "buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx",
11+
"details": "buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/docker/buildx",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.21.3"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/docker/buildx/security/advisories/GHSA-m4gq-fm9h-8q75"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0495"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/docker/buildx/commit/18ccba072076ddbfb0aeedd6746d7719b0729b58"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3527",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3528.json

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3528",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-40635",
8+
"GHSA-265r-hfxg-fhmg"
9+
],
10+
"summary": "containerd has an integer overflow in User ID handling in github.com/containerd/containerd",
11+
"details": "containerd has an integer overflow in User ID handling in github.com/containerd/containerd",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/containerd/containerd",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.6.38"
27+
},
28+
{
29+
"introduced": "1.7.0-beta.0"
30+
},
31+
{
32+
"fixed": "1.7.27"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
},
39+
{
40+
"package": {
41+
"name": "github.com/containerd/containerd/v2",
42+
"ecosystem": "Go"
43+
},
44+
"ranges": [
45+
{
46+
"type": "SEMVER",
47+
"events": [
48+
{
49+
"introduced": "0"
50+
},
51+
{
52+
"fixed": "2.0.4"
53+
}
54+
]
55+
}
56+
],
57+
"ecosystem_specific": {}
58+
}
59+
],
60+
"references": [
61+
{
62+
"type": "ADVISORY",
63+
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg"
64+
},
65+
{
66+
"type": "FIX",
67+
"url": "https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da"
68+
},
69+
{
70+
"type": "FIX",
71+
"url": "https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20"
72+
},
73+
{
74+
"type": "FIX",
75+
"url": "https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a"
76+
}
77+
],
78+
"database_specific": {
79+
"url": "https://pkg.go.dev/vuln/GO-2025-3528",
80+
"review_status": "UNREVIEWED"
81+
}
82+
}

‎data/osv/GO-2025-3529.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3529",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-2241",
8+
"GHSA-c339-mwfc-fmr2"
9+
],
10+
"summary": "Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive",
11+
"details": "Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/openshift/hive",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-c339-mwfc-fmr2"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2241"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://access.redhat.com/security/cve/CVE-2025-2241"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351350"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2025-3529",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2025-3530.json

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3530",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-29781",
8+
"GHSA-c98h-7hp9-v9hq"
9+
],
10+
"summary": "Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis",
11+
"details": "Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/metal3-io/baremetal-operator/apis",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.8.1"
27+
},
28+
{
29+
"introduced": "0.9.0"
30+
},
31+
{
32+
"fixed": "0.9.1"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/metal3-io/baremetal-operator/pull/2321"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/metal3-io/baremetal-operator/pull/2322"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md"
60+
}
61+
],
62+
"database_specific": {
63+
"url": "https://pkg.go.dev/vuln/GO-2025-3530",
64+
"review_status": "UNREVIEWED"
65+
}
66+
}

‎data/reports/GO-2025-3527.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2025-3527
2+
modules:
3+
- module: github.com/docker/buildx
4+
versions:
5+
- fixed: 0.21.3
6+
vulnerable_at: 0.21.2
7+
summary: buildx allows a possible credential leakage to telemetry endpoint in github.com/docker/buildx
8+
cves:
9+
- CVE-2025-0495
10+
ghsas:
11+
- GHSA-m4gq-fm9h-8q75
12+
references:
13+
- advisory: https://github.com/docker/buildx/security/advisories/GHSA-m4gq-fm9h-8q75
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-0495
15+
- fix: https://github.com/docker/buildx/commit/18ccba072076ddbfb0aeedd6746d7719b0729b58
16+
source:
17+
id: GHSA-m4gq-fm9h-8q75
18+
created: 2025-03-18T12:19:18.62408-04:00
19+
review_status: UNREVIEWED

‎data/reports/GO-2025-3528.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: GO-2025-3528
2+
modules:
3+
- module: github.com/containerd/containerd
4+
versions:
5+
- fixed: 1.6.38
6+
- introduced: 1.7.0-beta.0
7+
- fixed: 1.7.27
8+
vulnerable_at: 1.7.26
9+
- module: github.com/containerd/containerd/v2
10+
versions:
11+
- fixed: 2.0.4
12+
vulnerable_at: 2.0.3
13+
summary: containerd has an integer overflow in User ID handling in github.com/containerd/containerd
14+
cves:
15+
- CVE-2024-40635
16+
ghsas:
17+
- GHSA-265r-hfxg-fhmg
18+
references:
19+
- advisory: https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg
20+
- fix: https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da
21+
- fix: https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
22+
- fix: https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
23+
source:
24+
id: GHSA-265r-hfxg-fhmg
25+
created: 2025-03-18T12:19:26.864701-04:00
26+
review_status: UNREVIEWED

‎data/reports/GO-2025-3529.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3529
2+
modules:
3+
- module: github.com/openshift/hive
4+
unsupported_versions:
5+
- last_affected: 1.1.16
6+
vulnerable_at: 1.1.16
7+
summary: Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
8+
cves:
9+
- CVE-2025-2241
10+
ghsas:
11+
- GHSA-c339-mwfc-fmr2
12+
references:
13+
- advisory: https://github.com/advisories/GHSA-c339-mwfc-fmr2
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-2241
15+
- web: https://access.redhat.com/security/cve/CVE-2025-2241
16+
- web: https://bugzilla.redhat.com/show_bug.cgi?id=2351350
17+
source:
18+
id: GHSA-c339-mwfc-fmr2
19+
created: 2025-03-18T12:19:35.546967-04:00
20+
review_status: UNREVIEWED

‎data/reports/GO-2025-3530.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: GO-2025-3530
2+
modules:
3+
- module: github.com/metal3-io/baremetal-operator/apis
4+
versions:
5+
- fixed: 0.8.1
6+
- introduced: 0.9.0
7+
- fixed: 0.9.1
8+
vulnerable_at: 0.9.0
9+
summary: |-
10+
Bare Metal Operator (BMO) can expose any secret from other namespaces via
11+
BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis
12+
cves:
13+
- CVE-2025-29781
14+
ghsas:
15+
- GHSA-c98h-7hp9-v9hq
16+
references:
17+
- advisory: https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-c98h-7hp9-v9hq
18+
- web: https://github.com/metal3-io/baremetal-operator/commit/19f8443b1fe182f76dd81b43122e8dd102f8b94c
19+
- web: https://github.com/metal3-io/baremetal-operator/pull/2321
20+
- web: https://github.com/metal3-io/baremetal-operator/pull/2322
21+
- web: https://github.com/metal3-io/metal3-docs/blob/main/design/baremetal-operator/bmc-events.md
22+
source:
23+
id: GHSA-c98h-7hp9-v9hq
24+
created: 2025-03-18T12:19:45.05457-04:00
25+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)