Skip to content

Commit aa7c6ae

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 5 reports
 - data/reports/GO-2025-3656.yaml - data/reports/GO-2025-3661.yaml - data/reports/GO-2025-3662.yaml - data/reports/GO-2025-3663.yaml - data/reports/GO-2025-3665.yaml Fixes #3656 Fixes #3661 Fixes #3662 Fixes #3663 Fixes #3665 Change-Id: Iadf94f7511240c2675cc0582d6d8acdac8165e36 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/670315 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Neal Patel <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]>
1 parent 97fc44b commit aa7c6ae

10 files changed

+447
-0
lines changed

‎data/osv/GO-2025-3656.json

+112
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3656",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-32777",
8+
"GHSA-hg79-fw4p-25p8"
9+
],
10+
"summary": "Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano",
11+
"details": "Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin in volcano.sh/volcano",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "volcano.sh/volcano",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.9.1"
27+
},
28+
{
29+
"introduced": "1.10.0-alpha.0"
30+
},
31+
{
32+
"fixed": "1.10.2"
33+
},
34+
{
35+
"introduced": "1.11.0-network-topology-preview.0"
36+
},
37+
{
38+
"fixed": "1.11.0-network-topology-preview.3"
39+
},
40+
{
41+
"introduced": "1.11.0"
42+
},
43+
{
44+
"fixed": "1.11.2"
45+
},
46+
{
47+
"introduced": "1.12.0-alpha.0"
48+
},
49+
{
50+
"fixed": "1.12.0-alpha.2"
51+
}
52+
]
53+
}
54+
],
55+
"ecosystem_specific": {}
56+
}
57+
],
58+
"references": [
59+
{
60+
"type": "ADVISORY",
61+
"url": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-hg79-fw4p-25p8"
62+
},
63+
{
64+
"type": "ADVISORY",
65+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32777"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://github.com/volcano-sh/volcano/commit/45a4347471a5254121d10afef04c6732095fa398"
70+
},
71+
{
72+
"type": "WEB",
73+
"url": "https://github.com/volcano-sh/volcano/commit/7103c18de19821cd278f949fa24c13da350a8c5d"
74+
},
75+
{
76+
"type": "WEB",
77+
"url": "https://github.com/volcano-sh/volcano/commit/735842af59b9be0da5090677db7693c98a798b2a"
78+
},
79+
{
80+
"type": "WEB",
81+
"url": "https://github.com/volcano-sh/volcano/commit/7c0ea53fa3cfa7a05b5fba7a8af7bfe88adc41c3"
82+
},
83+
{
84+
"type": "WEB",
85+
"url": "https://github.com/volcano-sh/volcano/commit/d687f75a11fa36f37b54e4b6ff8e49bc0a3ca6b4"
86+
},
87+
{
88+
"type": "WEB",
89+
"url": "https://github.com/volcano-sh/volcano/releases/tag/v1.10.2"
90+
},
91+
{
92+
"type": "WEB",
93+
"url": "https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3"
94+
},
95+
{
96+
"type": "WEB",
97+
"url": "https://github.com/volcano-sh/volcano/releases/tag/v1.11.2"
98+
},
99+
{
100+
"type": "WEB",
101+
"url": "https://github.com/volcano-sh/volcano/releases/tag/v1.12.0-alpha.2"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://github.com/volcano-sh/volcano/releases/tag/v1.9.1"
106+
}
107+
],
108+
"database_specific": {
109+
"url": "https://pkg.go.dev/vuln/GO-2025-3656",
110+
"review_status": "UNREVIEWED"
111+
}
112+
}

‎data/osv/GO-2025-3661.json

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3661",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-4210"
8+
],
9+
"summary": "Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor",
10+
"details": "Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/casdoor/casdoor",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4210"
34+
},
35+
{
36+
"type": "FIX",
37+
"url": "https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe"
38+
},
39+
{
40+
"type": "FIX",
41+
"url": "https://github.com/casdoor/casdoor/releases/tag/v1.812.0"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://vuldb.com/?ctiid.307180"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://vuldb.com/?id.307180"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://vuldb.com/?submit.556201"
54+
}
55+
],
56+
"credits": [
57+
{
58+
"name": "krav (VulDB User)"
59+
}
60+
],
61+
"database_specific": {
62+
"url": "https://pkg.go.dev/vuln/GO-2025-3661",
63+
"review_status": "UNREVIEWED"
64+
}
65+
}

‎data/osv/GO-2025-3662.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3662",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-3879",
8+
"GHSA-f9ch-h8j7-8jwg"
9+
],
10+
"summary": "Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault",
11+
"details": "Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/hashicorp/vault",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.10.0"
24+
},
25+
{
26+
"fixed": "1.19.1"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-f9ch-h8j7-8jwg"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3879"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3662",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3663.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3663",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-4166",
8+
"GHSA-gcqf-f89c-68hv"
9+
],
10+
"summary": "Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault",
11+
"details": "Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/hashicorp/vault",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0.3.0"
24+
},
25+
{
26+
"fixed": "1.19.3"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-gcqf-f89c-68hv"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4166"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3663",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3665.json

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3665",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-pv22-fqcj-7xwh"
8+
],
9+
"summary": "Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget",
10+
"details": "Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/inspektor-gadget/inspektor-gadget",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0.31.0"
23+
},
24+
{
25+
"fixed": "0.40.0"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-pv22-fqcj-7xwh"
37+
},
38+
{
39+
"type": "FIX",
40+
"url": "https://github.com/inspektor-gadget/inspektor-gadget/commit/c51d419964f5b6f9344fcad4faba70e2e025212b"
41+
}
42+
],
43+
"database_specific": {
44+
"url": "https://pkg.go.dev/vuln/GO-2025-3665",
45+
"review_status": "UNREVIEWED"
46+
}
47+
}

‎data/reports/GO-2025-3656.yaml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
id: GO-2025-3656
2+
modules:
3+
- module: volcano.sh/volcano
4+
versions:
5+
- fixed: 1.9.1
6+
- introduced: 1.10.0-alpha.0
7+
- fixed: 1.10.2
8+
- introduced: 1.11.0-network-topology-preview.0
9+
- fixed: 1.11.0-network-topology-preview.3
10+
- introduced: 1.11.0
11+
- fixed: 1.11.2
12+
- introduced: 1.12.0-alpha.0
13+
- fixed: 1.12.0-alpha.2
14+
vulnerable_at: 1.12.0-alpha.1
15+
summary: |-
16+
Volcano Scheduler Denial of Service via Unbounded Response from Elastic
17+
Service/extender Plugin in volcano.sh/volcano
18+
cves:
19+
- CVE-2025-32777
20+
ghsas:
21+
- GHSA-hg79-fw4p-25p8
22+
references:
23+
- advisory: https://github.com/volcano-sh/volcano/security/advisories/GHSA-hg79-fw4p-25p8
24+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-32777
25+
- web: https://github.com/volcano-sh/volcano/commit/45a4347471a5254121d10afef04c6732095fa398
26+
- web: https://github.com/volcano-sh/volcano/commit/7103c18de19821cd278f949fa24c13da350a8c5d
27+
- web: https://github.com/volcano-sh/volcano/commit/735842af59b9be0da5090677db7693c98a798b2a
28+
- web: https://github.com/volcano-sh/volcano/commit/7c0ea53fa3cfa7a05b5fba7a8af7bfe88adc41c3
29+
- web: https://github.com/volcano-sh/volcano/commit/d687f75a11fa36f37b54e4b6ff8e49bc0a3ca6b4
30+
- web: https://github.com/volcano-sh/volcano/releases/tag/v1.10.2
31+
- web: https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3
32+
- web: https://github.com/volcano-sh/volcano/releases/tag/v1.11.2
33+
- web: https://github.com/volcano-sh/volcano/releases/tag/v1.12.0-alpha.2
34+
- web: https://github.com/volcano-sh/volcano/releases/tag/v1.9.1
35+
source:
36+
id: GHSA-hg79-fw4p-25p8
37+
created: 2025-05-05T12:55:57.305718-04:00
38+
review_status: UNREVIEWED

‎data/reports/GO-2025-3661.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: GO-2025-3661
2+
modules:
3+
- module: github.com/casdoor/casdoor
4+
unsupported_versions:
5+
- cve_version_range: affected at 1.811
6+
vulnerable_at: 1.904.0
7+
summary: Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor
8+
cves:
9+
- CVE-2025-4210
10+
credits:
11+
- krav (VulDB User)
12+
references:
13+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-4210
14+
- fix: https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe
15+
- fix: https://github.com/casdoor/casdoor/releases/tag/v1.812.0
16+
- web: https://vuldb.com/?ctiid.307180
17+
- web: https://vuldb.com/?id.307180
18+
- web: https://vuldb.com/?submit.556201
19+
source:
20+
id: CVE-2025-4210
21+
created: 2025-05-05T12:56:06.268616-04:00
22+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)