Skip to content

Commit 6b8d768

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: review 3 reports, add 2 reports
 - data/reports/GO-2024-2491.yaml - data/reports/GO-2024-2698.yaml - data/reports/GO-2024-2785.yaml - data/reports/GO-2024-2912.yaml - data/reports/GO-2024-2918.yaml Updates #2491 Updates #2698 Updates #2785 Fixes #2912 Fixes #2918 Change-Id: I296bb2155b7a3ad7b8f8e7e3f1cc829a159c6cc8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/595960 Auto-Submit: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]>
1 parent 76e28a5 commit 6b8d768

10 files changed

+343
-61
lines changed

‎data/osv/GO-2024-2491.json

+36-27
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
"CVE-2024-21626",
88
"GHSA-xr7r-f8xq-vfvv"
99
],
10-
"summary": "runc vulnerable to container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
11-
"details": "runc vulnerable to container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
10+
"summary": "Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
11+
"details": "Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
1212
"affected": [
1313
{
1414
"package": {
@@ -28,53 +28,62 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/opencontainers/runc/libcontainer/utils",
35+
"symbols": [
36+
"CloseExecFrom"
37+
]
38+
},
39+
{
40+
"path": "github.com/opencontainers/runc/libcontainer/cgroups",
41+
"symbols": [
42+
"openFile",
43+
"prepareOpenat2"
44+
]
45+
},
46+
{
47+
"path": "github.com/opencontainers/runc/libcontainer",
48+
"symbols": [
49+
"Container.start",
50+
"Init",
51+
"finalizeNamespace",
52+
"linuxSetnsInit.Init",
53+
"linuxStandardInit.Init"
54+
]
55+
}
56+
]
57+
}
3258
}
3359
],
3460
"references": [
3561
{
3662
"type": "ADVISORY",
3763
"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv"
3864
},
39-
{
40-
"type": "ADVISORY",
41-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21626"
42-
},
4365
{
4466
"type": "FIX",
4567
"url": "https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf"
4668
},
4769
{
4870
"type": "WEB",
4971
"url": "http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html"
50-
},
51-
{
52-
"type": "WEB",
53-
"url": "http://www.openwall.com/lists/oss-security/2024/02/01/1"
54-
},
55-
{
56-
"type": "WEB",
57-
"url": "http://www.openwall.com/lists/oss-security/2024/02/02/3"
58-
},
59-
{
60-
"type": "WEB",
61-
"url": "https://github.com/opencontainers/runc/releases/tag/v1.1.12"
62-
},
72+
}
73+
],
74+
"credits": [
6375
{
64-
"type": "WEB",
65-
"url": "https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html"
76+
"name": "Rory McNamara from Snyk"
6677
},
6778
{
68-
"type": "WEB",
69-
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J"
79+
"name": "@lifubang from acmcoder"
7080
},
7181
{
72-
"type": "WEB",
73-
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL"
82+
"name": "Aleksa Sarai from SUSE"
7483
}
7584
],
7685
"database_specific": {
7786
"url": "https://pkg.go.dev/vuln/GO-2024-2491",
78-
"review_status": "UNREVIEWED"
87+
"review_status": "REVIEWED"
7988
}
8089
}

‎data/osv/GO-2024-2698.json

+2-6
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"GHSA-rhh4-rh7c-7r5v"
99
],
1010
"summary": "Archiver Path Traversal vulnerability in github.com/mholt/archiver",
11-
"details": "Archiver Path Traversal vulnerability in github.com/mholt/archiver",
11+
"details": "A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.",
1212
"affected": [
1313
{
1414
"package": {
@@ -50,10 +50,6 @@
5050
"type": "ADVISORY",
5151
"url": "https://github.com/advisories/GHSA-rhh4-rh7c-7r5v"
5252
},
53-
{
54-
"type": "ADVISORY",
55-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0406"
56-
},
5753
{
5854
"type": "WEB",
5955
"url": "https://access.redhat.com/security/cve/CVE-2024-0406"
@@ -65,6 +61,6 @@
6561
],
6662
"database_specific": {
6763
"url": "https://pkg.go.dev/vuln/GO-2024-2698",
68-
"review_status": "UNREVIEWED"
64+
"review_status": "REVIEWED"
6965
}
7066
}

‎data/osv/GO-2024-2785.json

+23-7
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"GHSA-m9w6-wp3h-vq8g"
99
],
1010
"summary": "CoreDNS may return invalid cache entries in github.com/coredns/coredns",
11-
"details": "CoreDNS may return invalid cache entries in github.com/coredns/coredns",
11+
"details": "A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.",
1212
"affected": [
1313
{
1414
"package": {
@@ -28,18 +28,30 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/coredns/coredns/plugin/cache",
35+
"symbols": [
36+
"Cache.ServeDNS",
37+
"Cache.exists",
38+
"Cache.getIgnoreTTL",
39+
"ResponseWriter.WriteMsg",
40+
"hash",
41+
"key",
42+
"newPrefetchResponseWriter",
43+
"verifyStaleResponseWriter.WriteMsg"
44+
]
45+
}
46+
]
47+
}
3248
}
3349
],
3450
"references": [
3551
{
3652
"type": "ADVISORY",
3753
"url": "https://github.com/advisories/GHSA-m9w6-wp3h-vq8g"
3854
},
39-
{
40-
"type": "ADVISORY",
41-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0874"
42-
},
4355
{
4456
"type": "FIX",
4557
"url": "https://github.com/coredns/coredns/commit/997c7f953962d47c242273f0e41398fdfb5b0151"
@@ -52,6 +64,10 @@
5264
"type": "REPORT",
5365
"url": "https://github.com/coredns/coredns/issues/6186"
5466
},
67+
{
68+
"type": "WEB",
69+
"url": "https://access.redhat.com/errata/RHSA-2024:0041"
70+
},
5571
{
5672
"type": "WEB",
5773
"url": "https://access.redhat.com/security/cve/CVE-2024-0874"
@@ -63,6 +79,6 @@
6379
],
6480
"database_specific": {
6581
"url": "https://pkg.go.dev/vuln/GO-2024-2785",
66-
"review_status": "UNREVIEWED"
82+
"review_status": "REVIEWED"
6783
}
6884
}

‎data/osv/GO-2024-2912.json

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2912",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2021-41092",
8+
"GHSA-99pg-grm5-qq3v"
9+
],
10+
"summary": "Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli",
11+
"details": "Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/docker/cli",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "20.10.9+incompatible"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/docker/cli/command",
35+
"symbols": [
36+
"GetDefaultAuthConfig",
37+
"RegistryAuthenticationPrivilegedFunc"
38+
]
39+
},
40+
{
41+
"path": "github.com/docker/cli/command/registry",
42+
"symbols": [
43+
"runLogin"
44+
]
45+
}
46+
]
47+
}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b"
58+
}
59+
],
60+
"database_specific": {
61+
"url": "https://pkg.go.dev/vuln/GO-2024-2912",
62+
"review_status": "REVIEWED"
63+
}
64+
}

‎data/osv/GO-2024-2918.json

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2918",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-35255",
8+
"GHSA-m5vv-6r4h-3vj9"
9+
],
10+
"summary": "Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
11+
"details": "Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.6.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/Azure/azure-sdk-for-go/sdk/azidentity",
35+
"symbols": [
36+
"AzurePipelinesCredential.GetToken",
37+
"ChainedTokenCredential.GetToken",
38+
"ClientAssertionCredential.GetToken",
39+
"ClientCertificateCredential.GetToken",
40+
"ClientSecretCredential.GetToken",
41+
"DefaultAzureCredential.GetToken",
42+
"EnvironmentCredential.GetToken",
43+
"ManagedIdentityCredential.GetToken",
44+
"NewDefaultAzureCredential",
45+
"NewManagedIdentityCredential",
46+
"OnBehalfOfCredential.GetToken",
47+
"WorkloadIdentityCredential.GetToken",
48+
"confidentialClient.GetToken",
49+
"managedIdentityClient.authenticate",
50+
"managedIdentityClient.createAccessToken",
51+
"managedIdentityClient.createAppServiceAuthRequest",
52+
"managedIdentityClient.createAzureArcAuthRequest",
53+
"managedIdentityClient.createAzureMLAuthRequest",
54+
"managedIdentityClient.createCloudShellAuthRequest",
55+
"managedIdentityClient.createIMDSAuthRequest",
56+
"managedIdentityClient.createServiceFabricAuthRequest",
57+
"managedIdentityClient.getAzureArcSecretKey",
58+
"newManagedIdentityClient"
59+
]
60+
}
61+
]
62+
}
63+
}
64+
],
65+
"references": [
66+
{
67+
"type": "ADVISORY",
68+
"url": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"
69+
},
70+
{
71+
"type": "FIX",
72+
"url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
81+
}
82+
],
83+
"database_specific": {
84+
"url": "https://pkg.go.dev/vuln/GO-2024-2918",
85+
"review_status": "REVIEWED"
86+
}
87+
}

0 commit comments

Comments
 (0)