Skip to content

Commit 76e28a5

Browse files
tatianabtatianab
committed
data/reports: review 7 reports
Review 7 vulns that need REVIEWED reports based on estimated impact. - data/reports/GO-2024-2500.yaml - data/reports/GO-2024-2512.yaml - data/reports/GO-2024-2572.yaml - data/reports/GO-2024-2575.yaml - data/reports/GO-2024-2846.yaml - data/reports/GO-2024-2913.yaml - data/reports/GO-2024-2914.yaml Fixes #2500 Fixes #2512 Fixes #2572 Fixes #2575 Fixes #2846 Fixes #2913 Fixes #2914 Change-Id: I65341fdb981196e44d09545d84e7b77261a549f3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/595999 Reviewed-by: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 95ad15a commit 76e28a5

14 files changed

+597
-115
lines changed

‎data/osv/GO-2024-2500.json

+125-18
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,66 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/docker/docker/daemon",
35+
"symbols": [
36+
"Daemon.create",
37+
"Daemon.setupContainerMountsRoot",
38+
"NewDaemon",
39+
"setupDaemonRoot"
40+
]
41+
},
42+
{
43+
"path": "github.com/docker/docker/daemon/graphdriver/aufs",
44+
"symbols": [
45+
"Init"
46+
]
47+
},
48+
{
49+
"path": "github.com/docker/docker/daemon/graphdriver/btrfs",
50+
"symbols": [
51+
"Driver.Create",
52+
"Init"
53+
]
54+
},
55+
{
56+
"path": "github.com/docker/docker/daemon/graphdriver/fuse-overlayfs",
57+
"symbols": [
58+
"Driver.create",
59+
"Init"
60+
]
61+
},
62+
{
63+
"path": "github.com/docker/docker/daemon/graphdriver/overlay",
64+
"symbols": [
65+
"Driver.Create",
66+
"Init"
67+
]
68+
},
69+
{
70+
"path": "github.com/docker/docker/daemon/graphdriver/overlay2",
71+
"symbols": [
72+
"Driver.create",
73+
"Init"
74+
]
75+
},
76+
{
77+
"path": "github.com/docker/docker/daemon/graphdriver/vfs",
78+
"symbols": [
79+
"Driver.Create",
80+
"Init"
81+
]
82+
},
83+
{
84+
"path": "github.com/docker/docker/daemon/graphdriver/zfs",
85+
"symbols": [
86+
"Init"
87+
]
88+
}
89+
]
90+
}
3291
},
3392
{
3493
"package": {
@@ -48,37 +107,85 @@
48107
]
49108
}
50109
],
51-
"ecosystem_specific": {}
110+
"ecosystem_specific": {
111+
"imports": [
112+
{
113+
"path": "github.com/moby/moby/daemon",
114+
"symbols": [
115+
"Daemon.create",
116+
"Daemon.setupContainerMountsRoot",
117+
"NewDaemon",
118+
"setupDaemonRoot"
119+
]
120+
},
121+
{
122+
"path": "github.com/moby/moby/daemon/graphdriver/aufs",
123+
"symbols": [
124+
"Init"
125+
]
126+
},
127+
{
128+
"path": "github.com/moby/moby/daemon/graphdriver/btrfs",
129+
"symbols": [
130+
"Driver.Create",
131+
"Init"
132+
]
133+
},
134+
{
135+
"path": "github.com/moby/moby/daemon/graphdriver/fuse-overlayfs",
136+
"symbols": [
137+
"Driver.create",
138+
"Init"
139+
]
140+
},
141+
{
142+
"path": "github.com/moby/moby/daemon/graphdriver/overlay",
143+
"symbols": [
144+
"Driver.Create",
145+
"Init"
146+
]
147+
},
148+
{
149+
"path": "github.com/moby/moby/daemon/graphdriver/overlay2",
150+
"symbols": [
151+
"Driver.create",
152+
"Init"
153+
]
154+
},
155+
{
156+
"path": "github.com/moby/moby/daemon/graphdriver/vfs",
157+
"symbols": [
158+
"Driver.Create",
159+
"Init"
160+
]
161+
},
162+
{
163+
"path": "github.com/moby/moby/daemon/graphdriver/zfs",
164+
"symbols": [
165+
"Init"
166+
]
167+
}
168+
]
169+
}
52170
}
53171
],
54172
"references": [
55173
{
56174
"type": "ADVISORY",
57175
"url": "https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558"
58176
},
59-
{
60-
"type": "ADVISORY",
61-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41091"
62-
},
63177
{
64178
"type": "FIX",
65179
"url": "https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64"
66-
},
67-
{
68-
"type": "WEB",
69-
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
70-
},
71-
{
72-
"type": "WEB",
73-
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB"
74-
},
180+
}
181+
],
182+
"credits": [
75183
{
76-
"type": "WEB",
77-
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB"
184+
"name": "Joan Bruguera"
78185
}
79186
],
80187
"database_specific": {
81188
"url": "https://pkg.go.dev/vuln/GO-2024-2500",
82-
"review_status": "UNREVIEWED"
189+
"review_status": "REVIEWED"
83190
}
84191
}

‎data/osv/GO-2024-2512.json

+105-5
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,107 @@
3434
]
3535
}
3636
],
37-
"ecosystem_specific": {}
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "github.com/docker/docker/builder/dockerfile"
41+
},
42+
{
43+
"path": "github.com/docker/docker/daemon/containerd",
44+
"symbols": [
45+
"imageCache.GetCache",
46+
"isMatch",
47+
"localCache.GetCache"
48+
]
49+
},
50+
{
51+
"path": "github.com/docker/docker/daemon/images",
52+
"symbols": [
53+
"ImageService.CommitImage",
54+
"ImageService.CreateImage"
55+
]
56+
},
57+
{
58+
"path": "github.com/docker/docker/image",
59+
"symbols": [
60+
"store.IsBuiltLocally",
61+
"store.SetBuiltLocally"
62+
]
63+
},
64+
{
65+
"path": "github.com/docker/docker/image/cache",
66+
"symbols": [
67+
"ImageCache.GetCache",
68+
"LocalImageCache.GetCache",
69+
"compare",
70+
"getLocalCachedImage"
71+
]
72+
}
73+
]
74+
}
75+
},
76+
{
77+
"package": {
78+
"name": "github.com/moby/moby",
79+
"ecosystem": "Go"
80+
},
81+
"ranges": [
82+
{
83+
"type": "SEMVER",
84+
"events": [
85+
{
86+
"introduced": "0"
87+
},
88+
{
89+
"fixed": "24.0.9+incompatible"
90+
},
91+
{
92+
"introduced": "25.0.0+incompatible"
93+
},
94+
{
95+
"fixed": "25.0.2+incompatible"
96+
}
97+
]
98+
}
99+
],
100+
"ecosystem_specific": {
101+
"imports": [
102+
{
103+
"path": "github.com/moby/moby/builder/dockerfile"
104+
},
105+
{
106+
"path": "github.com/moby/moby/daemon/containerd",
107+
"symbols": [
108+
"imageCache.GetCache",
109+
"isMatch",
110+
"localCache.GetCache"
111+
]
112+
},
113+
{
114+
"path": "github.com/moby/moby/daemon/images",
115+
"symbols": [
116+
"ImageService.CommitImage",
117+
"ImageService.CreateImage"
118+
]
119+
},
120+
{
121+
"path": "github.com/moby/moby/image",
122+
"symbols": [
123+
"store.IsBuiltLocally",
124+
"store.SetBuiltLocally"
125+
]
126+
},
127+
{
128+
"path": "github.com/moby/moby/image/cache",
129+
"symbols": [
130+
"ImageCache.GetCache",
131+
"LocalImageCache.GetCache",
132+
"compare",
133+
"getLocalCachedImage"
134+
]
135+
}
136+
]
137+
}
38138
}
39139
],
40140
"references": [
@@ -43,20 +143,20 @@
43143
"url": "https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc"
44144
},
45145
{
46-
"type": "WEB",
146+
"type": "FIX",
47147
"url": "https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae"
48148
},
49149
{
50-
"type": "WEB",
150+
"type": "FIX",
51151
"url": "https://github.com/moby/moby/commit/fca702de7f71362c8d103073c7e4a1d0a467fadd"
52152
},
53153
{
54-
"type": "WEB",
154+
"type": "FIX",
55155
"url": "https://github.com/moby/moby/commit/fce6e0ca9bc000888de3daa157af14fa41fcd0ff"
56156
}
57157
],
58158
"database_specific": {
59159
"url": "https://pkg.go.dev/vuln/GO-2024-2512",
60-
"review_status": "UNREVIEWED"
160+
"review_status": "REVIEWED"
61161
}
62162
}

‎data/osv/GO-2024-2572.json

+13-4
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
"aliases": [
77
"GHSA-4j93-fm92-rp4m"
88
],
9-
"summary": "ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module in github.com/cosmos/cosmos-sdk",
10-
"details": "ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module in github.com/cosmos/cosmos-sdk",
9+
"summary": "Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk",
10+
"details": "Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk",
1111
"affected": [
1212
{
1313
"package": {
@@ -33,7 +33,16 @@
3333
]
3434
}
3535
],
36-
"ecosystem_specific": {}
36+
"ecosystem_specific": {
37+
"imports": [
38+
{
39+
"path": "github.com/cosmos/cosmos-sdk/x/auth/vesting",
40+
"symbols": [
41+
"msgServer.CreatePeriodicVestingAccount"
42+
]
43+
}
44+
]
45+
}
3746
}
3847
],
3948
"references": [
@@ -56,6 +65,6 @@
5665
],
5766
"database_specific": {
5867
"url": "https://pkg.go.dev/vuln/GO-2024-2572",
59-
"review_status": "UNREVIEWED"
68+
"review_status": "REVIEWED"
6069
}
6170
}

0 commit comments

Comments
 (0)