Skip to content

Commit 975704f

Browse files
committed
data/reports: update GO-2020-0001.yaml with correct vulnerable symbol
defaultLogFormatter is name of a variable holding an anonymous vulnerable function. We now claim vulnerable those functions that directly use defaultLogFormatter, which in this case is LoggerWithConfig. Fixes #55937 Change-Id: I38d398e7ef2f7a94cc625b669c26c5b8444adfa0 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/439377 TryBot-Result: Gopher Robot <[email protected]> Run-TryBot: Zvonimir Pavlinovic <[email protected]> Reviewed-by: Damien Neil <[email protected]>
1 parent 707a3b5 commit 975704f

File tree

2 files changed

+12
-2
lines changed

2 files changed

+12
-2
lines changed

data/osv/GO-2020-0001.json

+5-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,11 @@
3333
{
3434
"path": "github.com/gin-gonic/gin",
3535
"symbols": [
36-
"defaultLogFormatter"
36+
"Default",
37+
"Logger",
38+
"LoggerWithConfig",
39+
"LoggerWithFormatter",
40+
"LoggerWithWriter"
3741
]
3842
}
3943
]

data/reports/GO-2020-0001.yaml

+7-1
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,16 @@ modules:
22
- module: github.com/gin-gonic/gin
33
versions:
44
- fixed: 1.6.0
5+
vulnerable_at: 1.5.0
56
packages:
67
- package: github.com/gin-gonic/gin
78
symbols:
8-
- defaultLogFormatter
9+
- LoggerWithConfig
10+
derived_symbols:
11+
- Default
12+
- Logger
13+
- LoggerWithFormatter
14+
- LoggerWithWriter
915
description: |
1016
The default Formatter for the Logger middleware (LoggerConfig.Formatter),
1117
which is included in the Default engine, allows attackers to inject arbitrary

0 commit comments

Comments
 (0)