Skip to content

Commit 6bcf152

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 3 reports
 - data/reports/GO-2025-3504.yaml - data/reports/GO-2025-3505.yaml - data/reports/GO-2025-3507.yaml Fixes #3504 Fixes #3505 Fixes #3507 Change-Id: I8d97f8418bcc34ec5ccd164af5582c34a32b943a Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/656176 Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Neal Patel <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 2ff63cd commit 6bcf152

File tree

6 files changed

+314
-0
lines changed

6 files changed

+314
-0
lines changed

‎data/osv/GO-2025-3504.json

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3504",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-25294",
8+
"GHSA-mf24-chxh-hmvj"
9+
],
10+
"summary": "Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway",
11+
"details": "Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/envoyproxy/gateway",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.2.7"
27+
},
28+
{
29+
"introduced": "1.3.0-rc.1"
30+
},
31+
{
32+
"fixed": "1.3.1"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25294"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://github.com/envoyproxy/gateway/commit/041d474a70d5921e5d65e6e14ea60e14dac70b01"
52+
},
53+
{
54+
"type": "FIX",
55+
"url": "https://github.com/envoyproxy/gateway/commit/358bed50dcb7b32f39a2edb252fb1399c7fc65dc"
56+
},
57+
{
58+
"type": "FIX",
59+
"url": "https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.2.7"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://github.com/envoyproxy/gateway/releases/tag/v1.3.1"
68+
}
69+
],
70+
"database_specific": {
71+
"url": "https://pkg.go.dev/vuln/GO-2025-3504",
72+
"review_status": "UNREVIEWED"
73+
}
74+
}

‎data/osv/GO-2025-3505.json

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3505",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27509",
8+
"GHSA-52jx-g6m5-h735"
9+
],
10+
"summary": "Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet",
11+
"details": "Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/fleetdm/fleet/v4 before v4.53.2, from v4.54.0 before v4.58.1, from v4.62.0 before v4.62.4, from v4.63.0 before v4.63.2, from v4.64.0 before v4.64.2.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/fleetdm/fleet/v4",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "4.53.2"
38+
},
39+
{
40+
"introduced": "4.54.0"
41+
},
42+
{
43+
"fixed": "4.58.1"
44+
},
45+
{
46+
"introduced": "4.62.0"
47+
},
48+
{
49+
"fixed": "4.62.4"
50+
},
51+
{
52+
"introduced": "4.63.0"
53+
},
54+
{
55+
"fixed": "4.63.2"
56+
},
57+
{
58+
"introduced": "4.64.0"
59+
},
60+
{
61+
"fixed": "4.64.2"
62+
}
63+
]
64+
}
65+
]
66+
}
67+
}
68+
],
69+
"references": [
70+
{
71+
"type": "ADVISORY",
72+
"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-52jx-g6m5-h735"
73+
},
74+
{
75+
"type": "ADVISORY",
76+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27509"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/fleetdm/fleet/commit/718c95e47ad010ad6b8ceb3f3460e921fbfc53bb"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://github.com/fleetdm/fleet/releases/tag/fleet-v4.64.2"
85+
}
86+
],
87+
"database_specific": {
88+
"url": "https://pkg.go.dev/vuln/GO-2025-3505",
89+
"review_status": "UNREVIEWED"
90+
}
91+
}

‎data/osv/GO-2025-3507.json

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3507",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-6wxf-7784-62fp"
8+
],
9+
"summary": "Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux",
10+
"details": "Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/strangelove-ventures/horcrux",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/strangelove-ventures/horcrux/v3",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "3.1.0"
40+
},
41+
{
42+
"fixed": "3.3.2"
43+
}
44+
]
45+
}
46+
],
47+
"ecosystem_specific": {}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/strangelove-ventures/horcrux/security/advisories/GHSA-6wxf-7784-62fp"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/strangelove-ventures/horcrux/commit/fb49be9baed30942b81b42da2b4f7040a2a83c02"
58+
},
59+
{
60+
"type": "FIX",
61+
"url": "https://github.com/strangelove-ventures/horcrux/pull/169"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/strangelove-ventures/horcrux/releases/tag/v3.3.2"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2025-3507",
70+
"review_status": "UNREVIEWED"
71+
}
72+
}

‎data/reports/GO-2025-3504.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: GO-2025-3504
2+
modules:
3+
- module: github.com/envoyproxy/gateway
4+
versions:
5+
- fixed: 1.2.7
6+
- introduced: 1.3.0-rc.1
7+
- fixed: 1.3.1
8+
vulnerable_at: 1.3.0
9+
summary: Envoy Gateway Log Injection Vulnerability in github.com/envoyproxy/gateway
10+
cves:
11+
- CVE-2025-25294
12+
ghsas:
13+
- GHSA-mf24-chxh-hmvj
14+
references:
15+
- advisory: https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj
16+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-25294
17+
- fix: https://github.com/envoyproxy/gateway/commit/041d474a70d5921e5d65e6e14ea60e14dac70b01
18+
- fix: https://github.com/envoyproxy/gateway/commit/358bed50dcb7b32f39a2edb252fb1399c7fc65dc
19+
- fix: https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a
20+
- web: https://github.com/envoyproxy/gateway/releases/tag/v1.2.7
21+
- web: https://github.com/envoyproxy/gateway/releases/tag/v1.3.1
22+
source:
23+
id: GHSA-mf24-chxh-hmvj
24+
created: 2025-03-10T14:13:13.515665-04:00
25+
review_status: UNREVIEWED

‎data/reports/GO-2025-3505.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: GO-2025-3505
2+
modules:
3+
- module: github.com/fleetdm/fleet/v4
4+
non_go_versions:
5+
- fixed: 4.53.2
6+
- introduced: 4.54.0
7+
- fixed: 4.58.1
8+
- introduced: 4.62.0
9+
- fixed: 4.62.4
10+
- introduced: 4.63.0
11+
- fixed: 4.63.2
12+
- introduced: 4.64.0
13+
- fixed: 4.64.2
14+
summary: |-
15+
Fleet has SAML authentication vulnerability due to improper SAML response
16+
validation in github.com/fleetdm/fleet
17+
cves:
18+
- CVE-2025-27509
19+
ghsas:
20+
- GHSA-52jx-g6m5-h735
21+
references:
22+
- advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-52jx-g6m5-h735
23+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-27509
24+
- web: https://github.com/fleetdm/fleet/commit/718c95e47ad010ad6b8ceb3f3460e921fbfc53bb
25+
- web: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.64.2
26+
notes:
27+
- fix: 'github.com/fleetdm/fleet/v4: could not add vulnerable_at: no fix, but could not find latest version from proxy: HTTP GET /github.com/fleetdm/fleet/v4/@latest returned status 404 Not Found'
28+
source:
29+
id: GHSA-52jx-g6m5-h735
30+
created: 2025-03-10T14:13:27.937602-04:00
31+
review_status: UNREVIEWED

‎data/reports/GO-2025-3507.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2025-3507
2+
modules:
3+
- module: github.com/strangelove-ventures/horcrux
4+
vulnerable_at: 0.1.4
5+
- module: github.com/strangelove-ventures/horcrux/v3
6+
versions:
7+
- introduced: 3.1.0
8+
- fixed: 3.3.2
9+
vulnerable_at: 3.3.1
10+
summary: Horcrux Double Sign Possibility in github.com/strangelove-ventures/horcrux
11+
ghsas:
12+
- GHSA-6wxf-7784-62fp
13+
references:
14+
- advisory: https://github.com/strangelove-ventures/horcrux/security/advisories/GHSA-6wxf-7784-62fp
15+
- fix: https://github.com/strangelove-ventures/horcrux/commit/fb49be9baed30942b81b42da2b4f7040a2a83c02
16+
- fix: https://github.com/strangelove-ventures/horcrux/pull/169
17+
- web: https://github.com/strangelove-ventures/horcrux/releases/tag/v3.3.2
18+
source:
19+
id: GHSA-6wxf-7784-62fp
20+
created: 2025-03-10T14:13:35.744193-04:00
21+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)