Skip to content

Commit ba32577

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 4 unreviewed reports
 - data/reports/GO-2024-2993.yaml - data/reports/GO-2024-2994.yaml - data/reports/GO-2024-2996.yaml - data/reports/GO-2024-2997.yaml Fixes #2993 Fixes #2994 Fixes #2996 Fixes #2997 Change-Id: I4aec2240621abb4771d856a7fb29ee0a5fed7424 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/599636 Reviewed-by: Damien Neil <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent 434eb95 commit ba32577

8 files changed

+434
-0
lines changed

‎data/osv/GO-2024-2993.json

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2993",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-41111",
8+
"GHSA-hc5w-gxxr-w8x8"
9+
],
10+
"summary": "Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver",
11+
"details": "Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/bishopfox/sliver",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.5.40"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-hc5w-gxxr-w8x8"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41111"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/BishopFox/sliver/commit/0deaee625d14c6f05f63c86e5c3b7ae623a1138f"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/BishopFox/sliver/commit/5016fb8d7cdff38c79e22e8293e58300f8d3bd57"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/BishopFox/sliver/issues/65"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/BishopFox/sliver/pull/1281"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://sliver.sh/docs?name=Multi-player+Mode"
59+
}
60+
],
61+
"database_specific": {
62+
"url": "https://pkg.go.dev/vuln/GO-2024-2993",
63+
"review_status": "UNREVIEWED"
64+
}
65+
}

‎data/osv/GO-2024-2994.json

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2994",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-5321",
8+
"GHSA-82m2-cv7p-4m75"
9+
],
10+
"summary": "Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes",
11+
"details": "Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "k8s.io/kubernetes",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.27.16"
27+
},
28+
{
29+
"introduced": "1.28.0"
30+
},
31+
{
32+
"fixed": "1.28.12"
33+
},
34+
{
35+
"introduced": "1.29.0"
36+
},
37+
{
38+
"fixed": "1.29.7"
39+
},
40+
{
41+
"introduced": "1.30.0"
42+
},
43+
{
44+
"fixed": "1.30.3"
45+
}
46+
]
47+
}
48+
],
49+
"ecosystem_specific": {}
50+
}
51+
],
52+
"references": [
53+
{
54+
"type": "ADVISORY",
55+
"url": "https://github.com/advisories/GHSA-82m2-cv7p-4m75"
56+
},
57+
{
58+
"type": "ADVISORY",
59+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5321"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/kubernetes/kubernetes/commit/23660a78ae462a6c8c75ac7ffd9af97550dda1aa"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://github.com/kubernetes/kubernetes/commit/84beb2915fa28ae477fe0676be8ba94ccd2b811a"
68+
},
69+
{
70+
"type": "WEB",
71+
"url": "https://github.com/kubernetes/kubernetes/commit/90589b8f63d28bcd3db89749950ebc48ed07c190"
72+
},
73+
{
74+
"type": "WEB",
75+
"url": "https://github.com/kubernetes/kubernetes/commit/de2033033b1d202ecaaa79d41861a075df8b49c1"
76+
},
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/kubernetes/kubernetes/issues/126161"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://groups.google.com/g/kubernetes-security-announce/c/81c0BHkKNt0"
84+
}
85+
],
86+
"database_specific": {
87+
"url": "https://pkg.go.dev/vuln/GO-2024-2994",
88+
"review_status": "UNREVIEWED"
89+
}
90+
}

‎data/osv/GO-2024-2996.json

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2996",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-21527"
8+
],
9+
"summary": "CVE-2024-21527 in github.com/gotenberg/gotenberg",
10+
"details": "CVE-2024-21527 in github.com/gotenberg/gotenberg",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/gotenberg/gotenberg/v7",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/gotenberg/gotenberg/v8",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
},
41+
{
42+
"fixed": "8.1.0"
43+
}
44+
]
45+
}
46+
],
47+
"ecosystem_specific": {}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21527"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/gotenberg/gotenberg/releases/tag/v8.1.0"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGGOTENBERG-7537081"
70+
},
71+
{
72+
"type": "WEB",
73+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESCHROMIUM-7537082"
74+
},
75+
{
76+
"type": "WEB",
77+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESWEBHOOK-7537083"
78+
}
79+
],
80+
"credits": [
81+
{
82+
"name": "Filip Ochnik"
83+
}
84+
],
85+
"database_specific": {
86+
"url": "https://pkg.go.dev/vuln/GO-2024-2996",
87+
"review_status": "UNREVIEWED"
88+
}
89+
}

‎data/osv/GO-2024-2997.json

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2997",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-21583"
8+
],
9+
"summary": "CVE-2024-21583 in github.com/gitpod-io/gitpod",
10+
"details": "CVE-2024-21583 in github.com/gitpod-io/gitpod",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/gitpod-io/gitpod",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21583"
34+
},
35+
{
36+
"type": "FIX",
37+
"url": "https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155"
38+
},
39+
{
40+
"type": "FIX",
41+
"url": "https://github.com/gitpod-io/gitpod/pull/19973"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=[…]942e-c768d37e9e0c\u0026tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "Elliot Ward (Snyk Security Research)"
75+
}
76+
],
77+
"database_specific": {
78+
"url": "https://pkg.go.dev/vuln/GO-2024-2997",
79+
"review_status": "UNREVIEWED"
80+
}
81+
}

‎data/reports/GO-2024-2993.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
id: GO-2024-2993
2+
modules:
3+
- module: github.com/bishopfox/sliver
4+
versions:
5+
- introduced: 1.5.40
6+
unsupported_versions:
7+
- last_affected: 1.6.0-dev
8+
vulnerable_at: 1.5.42
9+
summary: Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver
10+
cves:
11+
- CVE-2024-41111
12+
ghsas:
13+
- GHSA-hc5w-gxxr-w8x8
14+
references:
15+
- advisory: https://github.com/BishopFox/sliver/security/advisories/GHSA-hc5w-gxxr-w8x8
16+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-41111
17+
- web: https://github.com/BishopFox/sliver/commit/0deaee625d14c6f05f63c86e5c3b7ae623a1138f
18+
- web: https://github.com/BishopFox/sliver/commit/5016fb8d7cdff38c79e22e8293e58300f8d3bd57
19+
- web: https://github.com/BishopFox/sliver/issues/65
20+
- web: https://github.com/BishopFox/sliver/pull/1281
21+
- web: https://sliver.sh/docs?name=Multi-player+Mode
22+
source:
23+
id: GHSA-hc5w-gxxr-w8x8
24+
created: 2024-07-19T12:19:31.469236-04:00
25+
review_status: UNREVIEWED

‎data/reports/GO-2024-2994.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: GO-2024-2994
2+
modules:
3+
- module: k8s.io/kubernetes
4+
versions:
5+
- fixed: 1.27.16
6+
- introduced: 1.28.0
7+
- fixed: 1.28.12
8+
- introduced: 1.29.0
9+
- fixed: 1.29.7
10+
- introduced: 1.30.0
11+
- fixed: 1.30.3
12+
vulnerable_at: 1.30.2
13+
summary: Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes
14+
cves:
15+
- CVE-2024-5321
16+
ghsas:
17+
- GHSA-82m2-cv7p-4m75
18+
references:
19+
- advisory: https://github.com/advisories/GHSA-82m2-cv7p-4m75
20+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-5321
21+
- web: https://github.com/kubernetes/kubernetes/commit/23660a78ae462a6c8c75ac7ffd9af97550dda1aa
22+
- web: https://github.com/kubernetes/kubernetes/commit/84beb2915fa28ae477fe0676be8ba94ccd2b811a
23+
- web: https://github.com/kubernetes/kubernetes/commit/90589b8f63d28bcd3db89749950ebc48ed07c190
24+
- web: https://github.com/kubernetes/kubernetes/commit/de2033033b1d202ecaaa79d41861a075df8b49c1
25+
- web: https://github.com/kubernetes/kubernetes/issues/126161
26+
- web: https://groups.google.com/g/kubernetes-security-announce/c/81c0BHkKNt0
27+
source:
28+
id: GHSA-82m2-cv7p-4m75
29+
created: 2024-07-19T12:19:24.247679-04:00
30+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)