data/reports: add vulnerable_at to GO-2021-0098.yaml

Aliases: CVE-2021-21237, GHSA-cx3w-xqmc-84g5

Updates #98

Change-Id: I69c91b82b7b477c494c2ef8884b0e8d6e034589e
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/465798
Run-TryBot: Tatiana Bradley <[email protected]>
Reviewed-by: Tim King <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>

Author: tatianab

data/osv/GO-2021-0098.json

@@ -37,7 +37,14 @@
               "windows"
             ],
             "symbols": [
-              "PipeCommand"
+              "PipeCommand",
+              "PipeMediaCommand",
+              "Run",
+              "lockVerifier.Verify",
+              "singleCheckout.Run",
+              "singleCheckout.RunToPath",
+              "uploadContext.NewQueue",
+              "uploadContext.UploadPointers"
             ]
           },
           {
@@ -46,7 +53,11 @@
               "windows"
             ],
             "symbols": [
+              "AskPassCredentialHelper.Fill",
               "AskPassCredentialHelper.getFromProgram",
+              "CredentialHelperWrapper.FillCreds",
+              "CredentialHelpers.Approve",
+              "CredentialHelpers.Fill",
               "commandCredentialHelper.Approve"
             ]
           },
@@ -56,6 +67,9 @@
               "windows"
             ],
             "symbols": [
+              "GitFilter.Clean",
+              "GitFilter.Smudge",
+              "GitFilter.SmudgeToFile",
               "pipeExtensions"
             ]
           },
@@ -65,7 +79,13 @@
               "windows"
             ],
             "symbols": [
-              "sshAuthClient.Resolve"
+              "Client.Do",
+              "Client.DoWithAccess",
+              "Client.HttpClient",
+              "Client.NewRequest",
+              "Client.Transport",
+              "sshAuthClient.Resolve",
+              "sshCache.Resolve"
             ]
           }
         ]

data/reports/GO-2021-0098.yaml

@@ -2,32 +2,53 @@ modules:
   - module: github.com/git-lfs/git-lfs
     versions:
       - fixed: 1.5.1-0.20210113180018-fc664697ed2c
+    vulnerable_at: 1.5.1-0.20201211195948-e896fc7af7db
     packages:
       - package: github.com/git-lfs/git-lfs/commands
         goos:
           - windows
         symbols:
           - PipeCommand
-        skip_fix: 'TODO: fill this out [or set vulnerable_at to derive symbols]'
+        derived_symbols:
+          - PipeMediaCommand
+          - Run
+          - lockVerifier.Verify
+          - singleCheckout.Run
+          - singleCheckout.RunToPath
+          - uploadContext.NewQueue
+          - uploadContext.UploadPointers
       - package: github.com/git-lfs/git-lfs/creds
         goos:
           - windows
         symbols:
           - AskPassCredentialHelper.getFromProgram
           - commandCredentialHelper.Approve
-        skip_fix: 'TODO: fill this out [or set vulnerable_at to derive symbols]'
+        derived_symbols:
+          - AskPassCredentialHelper.Fill
+          - CredentialHelperWrapper.FillCreds
+          - CredentialHelpers.Approve
+          - CredentialHelpers.Fill
       - package: github.com/git-lfs/git-lfs/lfs
         goos:
           - windows
         symbols:
           - pipeExtensions
-        skip_fix: 'TODO: fill this out [or set vulnerable_at to derive symbols]'
+        derived_symbols:
+          - GitFilter.Clean
+          - GitFilter.Smudge
+          - GitFilter.SmudgeToFile
       - package: github.com/git-lfs/git-lfs/lfshttp
         goos:
           - windows
         symbols:
           - sshAuthClient.Resolve
-        skip_fix: 'TODO: fill this out [or set vulnerable_at to derive symbols]'
+        derived_symbols:
+          - Client.Do
+          - Client.DoWithAccess
+          - Client.HttpClient
+          - Client.NewRequest
+          - Client.Transport
+          - sshCache.Resolve
 description: |
     Due to the standard library behavior of exec.LookPath on Windows a number of methods may
     result in arbitrary code execution when cloning or operating on untrusted Git repositories.