Skip to content

Commit 8c4ccf8

Browse files
Maceo Thompsongopherbot
Maceo Thompson
authored and
gopherbot
committed
data/reports: add 15 reports
 - data/reports/GO-2024-3161.yaml - data/reports/GO-2024-3162.yaml - data/reports/GO-2024-3163.yaml - data/reports/GO-2024-3166.yaml - data/reports/GO-2024-3167.yaml - data/reports/GO-2024-3168.yaml - data/reports/GO-2024-3169.yaml - data/reports/GO-2024-3170.yaml - data/reports/GO-2024-3172.yaml - data/reports/GO-2024-3173.yaml - data/reports/GO-2024-3174.yaml - data/reports/GO-2024-3175.yaml - data/reports/GO-2024-3179.yaml - data/reports/GO-2024-3181.yaml - data/reports/GO-2024-3182.yaml Fixes #3161 Fixes #3162 Fixes #3163 Fixes #3166 Fixes #3167 Fixes #3168 Fixes #3169 Fixes #3170 Fixes #3172 Fixes #3173 Fixes #3174 Fixes #3175 Fixes #3179 Fixes #3181 Fixes #3182 Change-Id: I6f47e813357034a674970920b6f0de6f4abac032 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/619135 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]> Auto-Submit: Maceo Thompson <[email protected]>
1 parent 7a4bd20 commit 8c4ccf8

30 files changed

+1390
-0
lines changed

‎data/osv/GO-2024-3161.json

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3161",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-22030",
8+
"GHSA-h4h5-9833-v2p4"
9+
],
10+
"summary": "Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher",
11+
"details": "Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.7.0 before v2.7.15, from v2.8.0 before v2.8.8, from v2.9.0 before v2.9.2.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/rancher",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "2.7.0"
35+
},
36+
{
37+
"fixed": "2.7.15"
38+
},
39+
{
40+
"introduced": "2.8.0"
41+
},
42+
{
43+
"fixed": "2.8.8"
44+
},
45+
{
46+
"introduced": "2.9.0"
47+
},
48+
{
49+
"fixed": "2.9.2"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings"
69+
}
70+
],
71+
"database_specific": {
72+
"url": "https://pkg.go.dev/vuln/GO-2024-3161",
73+
"review_status": "UNREVIEWED"
74+
}
75+
}

‎data/osv/GO-2024-3162.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3162",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-7594",
8+
"GHSA-jg74-mwgw-v6x3"
9+
],
10+
"summary": "Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault",
11+
"details": "Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/hashicorp/vault",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.7.7"
24+
},
25+
{
26+
"fixed": "1.17.6"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-jg74-mwgw-v6x3"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7594"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2024-3162",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2024-3163.json

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3163",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-47182"
8+
],
9+
"summary": "Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle",
10+
"details": "Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/amir20/dozzle before v8.5.3.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/amir20/dozzle",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {
28+
"custom_ranges": [
29+
{
30+
"type": "ECOSYSTEM",
31+
"events": [
32+
{
33+
"introduced": "0"
34+
},
35+
{
36+
"fixed": "8.5.3"
37+
}
38+
]
39+
}
40+
]
41+
}
42+
}
43+
],
44+
"references": [
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47182"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35"
56+
}
57+
],
58+
"database_specific": {
59+
"url": "https://pkg.go.dev/vuln/GO-2024-3163",
60+
"review_status": "UNREVIEWED"
61+
}
62+
}

‎data/osv/GO-2024-3166.json

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3166",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-47534",
8+
"GHSA-4f8r-qqr9-fq8j"
9+
],
10+
"summary": "Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf",
11+
"details": "Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/theupdateframework/go-tuf",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/theupdateframework/go-tuf/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.0.1"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47534"
59+
},
60+
{
61+
"type": "FIX",
62+
"url": "https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/theupdateframework/tuf-conformance/pull/115"
71+
}
72+
],
73+
"database_specific": {
74+
"url": "https://pkg.go.dev/vuln/GO-2024-3166",
75+
"review_status": "UNREVIEWED"
76+
}
77+
}

‎data/osv/GO-2024-3167.json

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3167",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-9355",
8+
"GHSA-3h3x-2hwv-hr52"
9+
],
10+
"summary": "Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl",
11+
"details": "Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/golang-fips/openssl",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/golang-fips/openssl/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {}
46+
}
47+
],
48+
"references": [
49+
{
50+
"type": "ADVISORY",
51+
"url": "https://github.com/advisories/GHSA-3h3x-2hwv-hr52"
52+
},
53+
{
54+
"type": "ADVISORY",
55+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://access.redhat.com/errata/RHSA-2024:7502"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://access.redhat.com/errata/RHSA-2024:7550"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://access.redhat.com/security/cve/CVE-2024-9355"
68+
},
69+
{
70+
"type": "WEB",
71+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
72+
}
73+
],
74+
"database_specific": {
75+
"url": "https://pkg.go.dev/vuln/GO-2024-3167",
76+
"review_status": "UNREVIEWED"
77+
}
78+
}

0 commit comments

Comments
 (0)