Skip to content

Commit 890c00c

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 3 reports
 - data/reports/GO-2025-3462.yaml - data/reports/GO-2025-3476.yaml - data/reports/GO-2025-3485.yaml Updates #3462 Updates #3476 Updates #3485 Change-Id: Icdf8b3080cf005af8d731df3180d72dba473ad18 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/652896 Reviewed-by: Zvonimir Pavlinovic <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Neal Patel <[email protected]>
1 parent 1134978 commit 890c00c

File tree

6 files changed

+389
-0
lines changed

6 files changed

+389
-0
lines changed

‎data/osv/GO-2025-3462.json

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3462",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-1243",
8+
"GHSA-q9w6-cwj4-gf4p"
9+
],
10+
"summary": "Unencrypted transmission in Temporal api-go library in go.temporal.io/api",
11+
"details": "Unencrypted transmission in Temporal api-go library in go.temporal.io/api",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "go.temporal.io/api",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.44.1"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "go.temporal.io/api/proxy",
35+
"symbols": [
36+
"NewPayloadVisitorInterceptor"
37+
]
38+
}
39+
]
40+
}
41+
}
42+
],
43+
"references": [
44+
{
45+
"type": "ADVISORY",
46+
"url": "https://github.com/advisories/GHSA-q9w6-cwj4-gf4p"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/temporalio/api-go/commit/dad8b169ada911d3778e070484d1ae78a58bd22b"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/temporalio/api-go/releases/tag/v1.44.1"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://temporal.io/blog/announcing-a-new-operation-workflow-update"
59+
}
60+
],
61+
"database_specific": {
62+
"url": "https://pkg.go.dev/vuln/GO-2025-3462",
63+
"review_status": "REVIEWED"
64+
}
65+
}

‎data/osv/GO-2025-3476.json

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3476",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-x5vx-95h7-rv4p"
8+
],
9+
"summary": "Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk",
10+
"details": "Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cosmos/cosmos-sdk",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.47.16-ics-lsm"
26+
},
27+
{
28+
"introduced": "0.50.0-alpha.0"
29+
},
30+
{
31+
"fixed": "0.50.12"
32+
}
33+
]
34+
}
35+
],
36+
"ecosystem_specific": {
37+
"imports": [
38+
{
39+
"path": "github.com/cosmos/cosmos-sdk/x/group",
40+
"symbols": [
41+
"PercentageDecisionPolicy.Allow"
42+
]
43+
},
44+
{
45+
"path": "github.com/cosmos/cosmos-sdk/x/group/keeper",
46+
"symbols": [
47+
"Keeper.UpdateGroupMembers"
48+
]
49+
},
50+
{
51+
"path": "github.com/cosmos/cosmos-sdk/x/group/simulation",
52+
"symbols": [
53+
"SimulateMsgUpdateGroupMembers",
54+
"WeightedOperations"
55+
]
56+
}
57+
]
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-x5vx-95h7-rv4p"
65+
},
66+
{
67+
"type": "FIX",
68+
"url": "https://github.com/cosmos/cosmos-sdk/commit/0a98b65b24900a0e608866c78f172cf8e4140aea"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.16"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.12"
77+
}
78+
],
79+
"database_specific": {
80+
"url": "https://pkg.go.dev/vuln/GO-2025-3476",
81+
"review_status": "REVIEWED"
82+
}
83+
}

‎data/osv/GO-2025-3485.json

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3485",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27144",
8+
"GHSA-c6gw-w398-hv78"
9+
],
10+
"summary": "DoS in go-jose Parsing in github.com/go-jose/go-jose",
11+
"details": "DoS in go-jose Parsing in github.com/go-jose/go-jose",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/go-jose/go-jose",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/go-jose/go-jose/v3",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "3.0.4"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {
49+
"imports": [
50+
{
51+
"path": "github.com/go-jose/go-jose/v3",
52+
"symbols": [
53+
"ParseDetached",
54+
"ParseEncrypted",
55+
"ParseSigned",
56+
"rawJSONWebEncryption.sanitized",
57+
"rawJSONWebSignature.sanitized"
58+
]
59+
}
60+
]
61+
}
62+
},
63+
{
64+
"package": {
65+
"name": "github.com/go-jose/go-jose/v4",
66+
"ecosystem": "Go"
67+
},
68+
"ranges": [
69+
{
70+
"type": "SEMVER",
71+
"events": [
72+
{
73+
"introduced": "0"
74+
},
75+
{
76+
"fixed": "4.0.5"
77+
}
78+
]
79+
}
80+
],
81+
"ecosystem_specific": {
82+
"imports": [
83+
{
84+
"path": "github.com/go-jose/go-jose/v4",
85+
"symbols": [
86+
"ParseEncrypted",
87+
"ParseEncryptedCompact",
88+
"ParseSignedCompact"
89+
]
90+
}
91+
]
92+
}
93+
},
94+
{
95+
"package": {
96+
"name": "github.com/square/go-jose",
97+
"ecosystem": "Go"
98+
},
99+
"ranges": [
100+
{
101+
"type": "SEMVER",
102+
"events": [
103+
{
104+
"introduced": "0"
105+
}
106+
]
107+
}
108+
],
109+
"ecosystem_specific": {}
110+
}
111+
],
112+
"references": [
113+
{
114+
"type": "ADVISORY",
115+
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78"
116+
},
117+
{
118+
"type": "FIX",
119+
"url": "https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22"
120+
},
121+
{
122+
"type": "WEB",
123+
"url": "https://github.com/go-jose/go-jose/releases/tag/v4.0.5"
124+
},
125+
{
126+
"type": "WEB",
127+
"url": "https://go.dev/issue/71490"
128+
},
129+
{
130+
"type": "WEB",
131+
"url": "https://go.dev/issue/71490"
132+
}
133+
],
134+
"database_specific": {
135+
"url": "https://pkg.go.dev/vuln/GO-2025-3485",
136+
"review_status": "REVIEWED"
137+
}
138+
}

‎data/reports/GO-2025-3462.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: GO-2025-3462
2+
modules:
3+
- module: go.temporal.io/api
4+
versions:
5+
- fixed: 1.44.1
6+
vulnerable_at: 1.44.0
7+
packages:
8+
- package: go.temporal.io/api/proxy
9+
symbols:
10+
- NewPayloadVisitorInterceptor
11+
summary: Unencrypted transmission in Temporal api-go library in go.temporal.io/api
12+
cves:
13+
- CVE-2025-1243
14+
ghsas:
15+
- GHSA-q9w6-cwj4-gf4p
16+
references:
17+
- advisory: https://github.com/advisories/GHSA-q9w6-cwj4-gf4p
18+
- web: https://github.com/temporalio/api-go/commit/dad8b169ada911d3778e070484d1ae78a58bd22b
19+
- web: https://github.com/temporalio/api-go/releases/tag/v1.44.1
20+
- web: https://temporal.io/blog/announcing-a-new-operation-workflow-update
21+
source:
22+
id: GHSA-q9w6-cwj4-gf4p
23+
created: 2025-02-26T12:35:57.774107-05:00
24+
review_status: REVIEWED

‎data/reports/GO-2025-3476.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: GO-2025-3476
2+
modules:
3+
- module: github.com/cosmos/cosmos-sdk
4+
versions:
5+
- fixed: 0.47.16-ics-lsm
6+
- introduced: 0.50.0-alpha.0
7+
- fixed: 0.50.12
8+
vulnerable_at: 0.50.11
9+
packages:
10+
- package: github.com/cosmos/cosmos-sdk/x/group
11+
symbols:
12+
- PercentageDecisionPolicy.Allow
13+
- package: github.com/cosmos/cosmos-sdk/x/group/keeper
14+
symbols:
15+
- Keeper.UpdateGroupMembers
16+
- package: github.com/cosmos/cosmos-sdk/x/group/simulation
17+
symbols:
18+
- SimulateMsgUpdateGroupMembers
19+
derived_symbols:
20+
- WeightedOperations
21+
summary: 'Cosmos SDK: Groups module can halt chain when handling a malicious proposal in github.com/cosmos/cosmos-sdk'
22+
ghsas:
23+
- GHSA-x5vx-95h7-rv4p
24+
references:
25+
- advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-x5vx-95h7-rv4p
26+
- fix: https://github.com/cosmos/cosmos-sdk/commit/0a98b65b24900a0e608866c78f172cf8e4140aea
27+
- web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.16
28+
- web: https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.12
29+
source:
30+
id: GHSA-x5vx-95h7-rv4p
31+
created: 2025-02-26T12:35:33.327096-05:00
32+
review_status: REVIEWED

‎data/reports/GO-2025-3485.yaml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
id: GO-2025-3485
2+
modules:
3+
- module: github.com/go-jose/go-jose
4+
vulnerable_at: 2.6.3+incompatible
5+
- module: github.com/go-jose/go-jose/v3
6+
versions:
7+
- fixed: 3.0.4
8+
vulnerable_at: 3.0.3
9+
packages:
10+
- package: github.com/go-jose/go-jose/v3
11+
symbols:
12+
- rawJSONWebEncryption.sanitized
13+
- rawJSONWebSignature.sanitized
14+
derived_symbols:
15+
- ParseDetached
16+
- ParseEncrypted
17+
- ParseSigned
18+
- module: github.com/go-jose/go-jose/v4
19+
versions:
20+
- fixed: 4.0.5
21+
vulnerable_at: 4.0.4
22+
packages:
23+
- package: github.com/go-jose/go-jose/v4
24+
symbols:
25+
- ParseEncryptedCompact
26+
- ParseSignedCompact
27+
derived_symbols:
28+
- ParseEncrypted
29+
- module: github.com/square/go-jose
30+
vulnerable_at: 2.6.0+incompatible
31+
summary: DoS in go-jose Parsing in github.com/go-jose/go-jose
32+
cves:
33+
- CVE-2025-27144
34+
ghsas:
35+
- GHSA-c6gw-w398-hv78
36+
references:
37+
- advisory: https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78
38+
- fix: https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0cacfc22
39+
- web: https://github.com/go-jose/go-jose/releases/tag/v4.0.5
40+
- web: https://go.dev/issue/71490
41+
- web: https://go.dev/issue/71490
42+
notes:
43+
- go-jose/go-jose and square/go-jose are archived, end-of-life, and vulnerable with no fixes.
44+
source:
45+
id: GHSA-c6gw-w398-hv78
46+
created: 2025-02-26T12:35:14.227896-05:00
47+
review_status: REVIEWED

0 commit comments

Comments
 (0)