Skip to content

Commit 95ad15a

Browse files
tatianabtatianab
committed
data/reports: add 5 reports
 - data/reports/GO-2024-2920.yaml - data/reports/GO-2024-2921.yaml - data/reports/GO-2024-2930.yaml - data/reports/GO-2024-2936.yaml - data/reports/GO-2024-2943.yaml Fixes #2920 Fixes #2921 Fixes #2930 Fixes #2936 Fixes #2943 Change-Id: I6de64b6c40310fbc70839bdffd8665a4c639d7b3 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/595957 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]>
1 parent 3f3b024 commit 95ad15a

10 files changed

+969
-0
lines changed

‎data/osv/GO-2024-2920.json

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2920",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-49559",
8+
"GHSA-2hmf-46v7-v6fx"
9+
],
10+
"summary": "Denial of service vulnerability via the parseDirectives function in github.com/vektah/gqlparser",
11+
"details": "An issue in vektah gqlparser open-source-library allows a remote attacker to cause a denial of service via a crafted script to the parseDirectives function.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/vektah/gqlparser",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"imports": [
30+
{
31+
"path": "github.com/vektah/gqlparser/parser",
32+
"symbols": [
33+
"ParseQuery",
34+
"ParseSchema",
35+
"ParseSchemas",
36+
"parser.parseDirectives"
37+
]
38+
}
39+
]
40+
}
41+
},
42+
{
43+
"package": {
44+
"name": "github.com/vektah/gqlparser/v2",
45+
"ecosystem": "Go"
46+
},
47+
"ranges": [
48+
{
49+
"type": "SEMVER",
50+
"events": [
51+
{
52+
"introduced": "0"
53+
},
54+
{
55+
"fixed": "2.5.14"
56+
}
57+
]
58+
}
59+
],
60+
"ecosystem_specific": {
61+
"imports": [
62+
{
63+
"path": "github.com/vektah/gqlparser/v2/parser",
64+
"symbols": [
65+
"ParseQuery",
66+
"ParseSchema",
67+
"ParseSchemas",
68+
"parser.parseDirectives"
69+
]
70+
}
71+
]
72+
}
73+
}
74+
],
75+
"references": [
76+
{
77+
"type": "ADVISORY",
78+
"url": "https://github.com/advisories/GHSA-2hmf-46v7-v6fx"
79+
},
80+
{
81+
"type": "FIX",
82+
"url": "https://github.com/vektah/gqlparser/commit/36a3658873bf5a107f42488dfc392949cdd02977"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://gist.github.com/uvzz/d3ed9d4532be16ec1040a2cf3dfec8d1"
87+
},
88+
{
89+
"type": "WEB",
90+
"url": "https://github.com/99designs/gqlgen/issues/3118"
91+
},
92+
{
93+
"type": "WEB",
94+
"url": "https://github.com/vektah/gqlparser/blob/master/parser/query.go#L316"
95+
}
96+
],
97+
"database_specific": {
98+
"url": "https://pkg.go.dev/vuln/GO-2024-2920",
99+
"review_status": "REVIEWED"
100+
}
101+
}

‎data/osv/GO-2024-2921.json

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2921",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-5798",
8+
"GHSA-32cj-5wx4-gq8p"
9+
],
10+
"summary": "HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault",
11+
"details": "HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/hashicorp/vault",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0.11.0"
24+
},
25+
{
26+
"fixed": "1.16.3"
27+
},
28+
{
29+
"introduced": "1.17.0-rc1"
30+
},
31+
{
32+
"fixed": "1.17.0"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/advisories/GHSA-32cj-5wx4-gq8p"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5798"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770"
52+
}
53+
],
54+
"database_specific": {
55+
"url": "https://pkg.go.dev/vuln/GO-2024-2921",
56+
"review_status": "UNREVIEWED"
57+
}
58+
}

‎data/osv/GO-2024-2930.json

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2930",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-32191",
8+
"GHSA-6gr4-52w6-vmqx"
9+
],
10+
"summary": "RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke",
11+
"details": "When RKE provisions a cluster, it stores the cluster state in a configmap called \"full-cluster-state\" inside the \"kube-system\" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/rke",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.4.18"
24+
},
25+
{
26+
"fixed": "1.4.19"
27+
},
28+
{
29+
"introduced": "1.5.9"
30+
},
31+
{
32+
"fixed": "1.5.10"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "github.com/rancher/rke/k8s",
41+
"symbols": [
42+
"GetSecret",
43+
"GetSecretsList",
44+
"GetSystemSecret",
45+
"UpdateSecret"
46+
]
47+
},
48+
{
49+
"path": "github.com/rancher/rke/cluster",
50+
"symbols": [
51+
"Cluster.CheckClusterPorts",
52+
"Cluster.CleanDeadLogs",
53+
"Cluster.CleanupNodes",
54+
"Cluster.ClusterRemove",
55+
"Cluster.DeployControlPlane",
56+
"Cluster.DeployRestoreCerts",
57+
"Cluster.DeployStateFile",
58+
"Cluster.DeployWorkerPlane",
59+
"Cluster.DisableSecretsEncryption",
60+
"Cluster.GetStateFileFromConfigMap",
61+
"Cluster.PrePullK8sImages",
62+
"Cluster.ReconcileDesiredStateEncryptionConfig",
63+
"Cluster.RewriteSecrets",
64+
"Cluster.RotateEncryptionKey",
65+
"Cluster.RunSELinuxCheck",
66+
"Cluster.SetUpHosts",
67+
"Cluster.StoreAddonConfigMap",
68+
"Cluster.SyncLabelsAndTaints",
69+
"Cluster.TunnelHosts",
70+
"Cluster.UpdateClusterCurrentState",
71+
"Cluster.UpgradeControlPlane",
72+
"Cluster.UpgradeWorkerPlane",
73+
"ConfigureCluster",
74+
"FullState.WriteStateFile",
75+
"GetClusterCertsFromKubernetes",
76+
"GetK8sVersion",
77+
"GetStateFromKubernetes",
78+
"ReadStateFile",
79+
"RebuildKubeconfig",
80+
"RebuildState",
81+
"ReconcileCluster",
82+
"ReconcileEncryptionProviderConfig",
83+
"RestartClusterPods",
84+
"SaveFullStateToKubernetes",
85+
"buildFreshState"
86+
]
87+
},
88+
{
89+
"path": "github.com/rancher/rke/cmd",
90+
"symbols": [
91+
"ClusterInit",
92+
"ClusterRemove",
93+
"ClusterUp",
94+
"RestoreEtcdSnapshot",
95+
"RestoreEtcdSnapshotFromCli",
96+
"RetrieveClusterStateConfigMap",
97+
"RotateEncryptionKey",
98+
"SnapshotRemoveFromEtcdHosts",
99+
"SnapshotSaveEtcdHosts",
100+
"SnapshotSaveEtcdHostsFromCli",
101+
"getStateFile",
102+
"saveClusterState"
103+
]
104+
}
105+
]
106+
}
107+
}
108+
],
109+
"references": [
110+
{
111+
"type": "ADVISORY",
112+
"url": "https://github.com/rancher/rke/security/advisories/GHSA-6gr4-52w6-vmqx"
113+
},
114+
{
115+
"type": "FIX",
116+
"url": "https://github.com/rancher/rke/commit/cf49199481a1891909acb1384eed73a5c987d5bd"
117+
},
118+
{
119+
"type": "FIX",
120+
"url": "https://github.com/rancher/rke/commit/f7485b8dce376db0fc15a7c3ceb3de7029c8d0cf"
121+
}
122+
],
123+
"database_specific": {
124+
"url": "https://pkg.go.dev/vuln/GO-2024-2930",
125+
"review_status": "REVIEWED"
126+
}
127+
}

0 commit comments

Comments
 (0)