Skip to content

Commit 8cd6cf1

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 3 reports
 - data/reports/GO-2025-3586.yaml - data/reports/GO-2025-3587.yaml - data/reports/GO-2025-3588.yaml Fixes #3586 Fixes #3587 Fixes #3588 Change-Id: I5f592926a0a83767eae8114ae44644856dab5780 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/662295 Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Neal Patel <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent ece059a commit 8cd6cf1

File tree

6 files changed

+236
-0
lines changed

6 files changed

+236
-0
lines changed

‎data/osv/GO-2025-3586.json

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3586",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-23391",
8+
"GHSA-8p83-cpfg-fj3g"
9+
],
10+
"summary": "Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher",
11+
"details": "Rancher: Restricted Administrator can change Administrator's passwords in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.8.0 before v2.8.14, from v2.9.0 before v2.9.8, from v2.10.0 before v2.10.4.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/rancher",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "2.8.0"
35+
},
36+
{
37+
"fixed": "2.8.14"
38+
},
39+
{
40+
"introduced": "2.9.0"
41+
},
42+
{
43+
"fixed": "2.9.8"
44+
},
45+
{
46+
"introduced": "2.10.0"
47+
},
48+
{
49+
"fixed": "2.10.4"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-8p83-cpfg-fj3g"
61+
}
62+
],
63+
"database_specific": {
64+
"url": "https://pkg.go.dev/vuln/GO-2025-3586",
65+
"review_status": "UNREVIEWED"
66+
}
67+
}

‎data/osv/GO-2025-3587.json

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3587",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-29868",
8+
"GHSA-wqcc-mfhw-53pc"
9+
],
10+
"summary": "Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer",
11+
"details": "Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/apache/answer",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.4.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-wqcc-mfhw-53pc"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29868"
42+
},
43+
{
44+
"type": "REPORT",
45+
"url": "https://github.com/apache/answer/issues/1250"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2025-3587",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2025-3588.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3588",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-31135",
8+
"GHSA-c2c3-pqw5-5p7c"
9+
],
10+
"summary": "Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla",
11+
"details": "Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/phires/go-guerrilla",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.6.7"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31135"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3588",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/reports/GO-2025-3586.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: GO-2025-3586
2+
modules:
3+
- module: github.com/rancher/rancher
4+
non_go_versions:
5+
- introduced: 2.8.0
6+
- fixed: 2.8.14
7+
- introduced: 2.9.0
8+
- fixed: 2.9.8
9+
- introduced: 2.10.0
10+
- fixed: 2.10.4
11+
vulnerable_at: 1.6.30
12+
summary: 'Rancher: Restricted Administrator can change Administrator''s passwords in github.com/rancher/rancher'
13+
cves:
14+
- CVE-2025-23391
15+
ghsas:
16+
- GHSA-8p83-cpfg-fj3g
17+
references:
18+
- advisory: https://github.com/rancher/rancher/security/advisories/GHSA-8p83-cpfg-fj3g
19+
source:
20+
id: GHSA-8p83-cpfg-fj3g
21+
created: 2025-04-02T11:31:10.729499-04:00
22+
review_status: UNREVIEWED

‎data/reports/GO-2025-3587.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3587
2+
modules:
3+
- module: github.com/apache/answer
4+
versions:
5+
- fixed: 1.4.5
6+
vulnerable_at: 1.4.5-RC1
7+
summary: Apache Answer User Using External Images Potentially Discloses User Information in github.com/apache/answer
8+
cves:
9+
- CVE-2025-29868
10+
ghsas:
11+
- GHSA-wqcc-mfhw-53pc
12+
references:
13+
- advisory: https://github.com/advisories/GHSA-wqcc-mfhw-53pc
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-29868
15+
- report: https://github.com/apache/answer/issues/1250
16+
- web: https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf
17+
source:
18+
id: GHSA-wqcc-mfhw-53pc
19+
created: 2025-04-02T11:31:04.960681-04:00
20+
review_status: UNREVIEWED

‎data/reports/GO-2025-3588.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2025-3588
2+
modules:
3+
- module: github.com/phires/go-guerrilla
4+
versions:
5+
- fixed: 1.6.7
6+
vulnerable_at: 1.6.6
7+
summary: Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times in github.com/phires/go-guerrilla
8+
cves:
9+
- CVE-2025-31135
10+
ghsas:
11+
- GHSA-c2c3-pqw5-5p7c
12+
references:
13+
- advisory: https://github.com/phires/go-guerrilla/security/advisories/GHSA-c2c3-pqw5-5p7c
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-31135
15+
- fix: https://github.com/phires/go-guerrilla/commit/7673947f2d5204a135d7ae0b7f80759e548abee6
16+
source:
17+
id: GHSA-c2c3-pqw5-5p7c
18+
created: 2025-04-02T11:30:59.679338-04:00
19+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)