Skip to content

Commit 6f05161

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 5 unreviewed reports
 - data/reports/GO-2024-3076.yaml - data/reports/GO-2024-3077.yaml - data/reports/GO-2024-3078.yaml - data/reports/GO-2024-3079.yaml - data/reports/GO-2024-3080.yaml Fixes #3076 Fixes #3077 Fixes #3078 Fixes #3079 Fixes #3080 Change-Id: Iaa16597434903127a8393697316faf903ac7896f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607335 Auto-Submit: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]>
1 parent a282e8f commit 6f05161

10 files changed

+400
-0
lines changed

‎data/osv/GO-2024-3076.json

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3076",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-43379",
8+
"GHSA-3r74-v83p-f4f4"
9+
],
10+
"summary": "Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog",
11+
"details": "Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/trufflesecurity/trufflehog",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/trufflesecurity/trufflehog/v3",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "3.81.9"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/trufflesecurity/trufflehog/security/advisories/GHSA-3r74-v83p-f4f4"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43379"
59+
},
60+
{
61+
"type": "FIX",
62+
"url": "https://github.com/trufflesecurity/trufflehog/commit/fe5624c70923355128868cffd647b6e2cfe11443"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2024-3076",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2024-3077.json

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3077",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39690",
8+
"GHSA-mq69-4j5w-3qwp"
9+
],
10+
"summary": "Capsule tenant owner with \"patch namespace\" permission can hijack system namespaces in github.com/projectcapsule/capsule",
11+
"details": "Capsule tenant owner with \"patch namespace\" permission can hijack system namespaces in github.com/projectcapsule/capsule",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/projectcapsule/capsule",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39690"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-3077",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2024-3078.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3078",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-43406",
8+
"GHSA-r5ph-4jxm-6j9p"
9+
],
10+
"summary": "LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper",
11+
"details": "LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/lf-edge/ekuiper",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.14.2"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43406"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2024-3078",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2024-3079.json

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3079",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-6322",
8+
"GHSA-hh8p-374f-qgr5"
9+
],
10+
"summary": "Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana",
11+
"details": "Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana from v11.1.0 before v11.1.1, from v11.1.2 before v11.1.3.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/grafana/grafana",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "11.1.0"
35+
},
36+
{
37+
"fixed": "11.1.1"
38+
},
39+
{
40+
"introduced": "11.1.2"
41+
},
42+
{
43+
"fixed": "11.1.3"
44+
}
45+
]
46+
}
47+
]
48+
}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/advisories/GHSA-hh8p-374f-qgr5"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6322"
59+
},
60+
{
61+
"type": "FIX",
62+
"url": "https://github.com/grafana/grafana/commit/4cb3ba5d1a7ab8b9676034e89dada2fcde1766ef"
63+
},
64+
{
65+
"type": "FIX",
66+
"url": "https://github.com/grafana/grafana/commit/9cdba084a9100c6b11d32eef9d2bd53656c6964a"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://grafana.com/security/security-advisories/cve-2024-6322"
71+
}
72+
],
73+
"database_specific": {
74+
"url": "https://pkg.go.dev/vuln/GO-2024-3079",
75+
"review_status": "UNREVIEWED"
76+
}
77+
}

‎data/osv/GO-2024-3080.json

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3080",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-43403",
8+
"GHSA-h27c-6xm3-mcqp"
9+
],
10+
"summary": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister",
11+
"details": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/kanisterio/kanister",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/kanisterio/kanister/security/advisories/GHSA-h27c-6xm3-mcqp"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://github.com/kanisterio/kanister/blob/master/helm/kanister-operator/templates/rbac.yaml#L49"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/kanisterio/kanister/wiki/2023%E2%80%9024-Community-Meeting-Notes"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-3080",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/reports/GO-2024-3076.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2024-3076
2+
modules:
3+
- module: github.com/trufflesecurity/trufflehog
4+
vulnerable_at: 0.0.0-20220127183845-e9ac138996e7
5+
- module: github.com/trufflesecurity/trufflehog/v3
6+
versions:
7+
- fixed: 3.81.9
8+
vulnerable_at: 3.81.8
9+
summary: Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog
10+
cves:
11+
- CVE-2024-43379
12+
ghsas:
13+
- GHSA-3r74-v83p-f4f4
14+
references:
15+
- advisory: https://github.com/trufflesecurity/trufflehog/security/advisories/GHSA-3r74-v83p-f4f4
16+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-43379
17+
- fix: https://github.com/trufflesecurity/trufflehog/commit/fe5624c70923355128868cffd647b6e2cfe11443
18+
source:
19+
id: GHSA-3r74-v83p-f4f4
20+
created: 2024-08-21T10:26:13.043304-04:00
21+
review_status: UNREVIEWED

‎data/reports/GO-2024-3077.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2024-3077
2+
modules:
3+
- module: github.com/projectcapsule/capsule
4+
unsupported_versions:
5+
- last_affected: 0.7.0
6+
vulnerable_at: 0.7.0
7+
summary: |-
8+
Capsule tenant owner with "patch namespace" permission can hijack system
9+
namespaces in github.com/projectcapsule/capsule
10+
cves:
11+
- CVE-2024-39690
12+
ghsas:
13+
- GHSA-mq69-4j5w-3qwp
14+
references:
15+
- advisory: https://github.com/projectcapsule/capsule/security/advisories/GHSA-mq69-4j5w-3qwp
16+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39690
17+
- fix: https://github.com/projectcapsule/capsule/commit/d620b0457ddec01616b8eab8512a10611611f584
18+
source:
19+
id: GHSA-mq69-4j5w-3qwp
20+
created: 2024-08-21T10:26:09.725236-04:00
21+
review_status: UNREVIEWED

‎data/reports/GO-2024-3078.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2024-3078
2+
modules:
3+
- module: github.com/lf-edge/ekuiper
4+
versions:
5+
- fixed: 1.14.2
6+
vulnerable_at: 1.14.1
7+
summary: LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper
8+
cves:
9+
- CVE-2024-43406
10+
ghsas:
11+
- GHSA-r5ph-4jxm-6j9p
12+
references:
13+
- advisory: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-43406
15+
- fix: https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503
16+
source:
17+
id: GHSA-r5ph-4jxm-6j9p
18+
created: 2024-08-21T10:26:05.798948-04:00
19+
review_status: UNREVIEWED

‎data/reports/GO-2024-3079.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: GO-2024-3079
2+
modules:
3+
- module: github.com/grafana/grafana
4+
non_go_versions:
5+
- introduced: 11.1.0
6+
- fixed: 11.1.1
7+
- introduced: 11.1.2
8+
- fixed: 11.1.3
9+
vulnerable_at: 5.4.5+incompatible
10+
summary: Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
11+
cves:
12+
- CVE-2024-6322
13+
ghsas:
14+
- GHSA-hh8p-374f-qgr5
15+
references:
16+
- advisory: https://github.com/advisories/GHSA-hh8p-374f-qgr5
17+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-6322
18+
- fix: https://github.com/grafana/grafana/commit/4cb3ba5d1a7ab8b9676034e89dada2fcde1766ef
19+
- fix: https://github.com/grafana/grafana/commit/9cdba084a9100c6b11d32eef9d2bd53656c6964a
20+
- web: https://grafana.com/security/security-advisories/cve-2024-6322
21+
source:
22+
id: GHSA-hh8p-374f-qgr5
23+
created: 2024-08-21T10:25:47.658165-04:00
24+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)