Skip to content

Commit d3be009

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 4 reports
 - data/reports/GO-2025-3463.yaml - data/reports/GO-2025-3498.yaml - data/reports/GO-2025-3499.yaml - data/reports/GO-2025-3500.yaml Fixes #3463 Fixes #3498 Fixes #3499 Fixes #3500 Change-Id: Ibfa6cf4d39b364c0971aebd76ae850a71574c973 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/655095 Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Neal Patel <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 6bcf152 commit d3be009

8 files changed

+517
-0
lines changed

‎data/osv/GO-2025-3463.json

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3463",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-6fgm-x6ff-w78f"
8+
],
9+
"summary": "DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware",
10+
"details": "DoS may temporarily disable IBC transfers to native chain in github.com/cosmos/ibc-apps/middleware/packet-forward-middleware",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
}
41+
]
42+
}
43+
],
44+
"ecosystem_specific": {}
45+
},
46+
{
47+
"package": {
48+
"name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6",
49+
"ecosystem": "Go"
50+
},
51+
"ranges": [
52+
{
53+
"type": "SEMVER",
54+
"events": [
55+
{
56+
"introduced": "0"
57+
}
58+
]
59+
}
60+
],
61+
"ecosystem_specific": {}
62+
},
63+
{
64+
"package": {
65+
"name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7",
66+
"ecosystem": "Go"
67+
},
68+
"ranges": [
69+
{
70+
"type": "SEMVER",
71+
"events": [
72+
{
73+
"introduced": "0"
74+
},
75+
{
76+
"fixed": "7.2.1"
77+
}
78+
]
79+
}
80+
],
81+
"ecosystem_specific": {
82+
"imports": [
83+
{
84+
"path": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7/packetforward",
85+
"symbols": [
86+
"AppModule.ConsensusVersion",
87+
"AppModule.RegisterServices",
88+
"Keeper.WriteAcknowledgementForForwardedPacket"
89+
]
90+
}
91+
]
92+
}
93+
},
94+
{
95+
"package": {
96+
"name": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8",
97+
"ecosystem": "Go"
98+
},
99+
"ranges": [
100+
{
101+
"type": "SEMVER",
102+
"events": [
103+
{
104+
"introduced": "0"
105+
},
106+
{
107+
"fixed": "8.1.1"
108+
}
109+
]
110+
}
111+
],
112+
"ecosystem_specific": {
113+
"imports": [
114+
{
115+
"path": "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v8/packetforward",
116+
"symbols": [
117+
"AppModule.ConsensusVersion",
118+
"AppModule.RegisterServices",
119+
"Keeper.WriteAcknowledgementForForwardedPacket"
120+
]
121+
}
122+
]
123+
}
124+
}
125+
],
126+
"references": [
127+
{
128+
"type": "ADVISORY",
129+
"url": "https://github.com/cosmos/ibc-apps/security/advisories/GHSA-6fgm-x6ff-w78f"
130+
},
131+
{
132+
"type": "WEB",
133+
"url": "https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv7.2.1"
134+
},
135+
{
136+
"type": "WEB",
137+
"url": "https://github.com/cosmos/ibc-apps/releases/tag/middleware%2Fpacket-forward-middleware%2Fv8.1.1"
138+
}
139+
],
140+
"database_specific": {
141+
"url": "https://pkg.go.dev/vuln/GO-2025-3463",
142+
"review_status": "REVIEWED"
143+
}
144+
}

‎data/osv/GO-2025-3498.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3498",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27421",
8+
"GHSA-vh64-54px-qgf8"
9+
],
10+
"summary": "Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus",
11+
"details": "Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/jasonlovesdoggo/abacus",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.0-20250302043802-898ff1204e11"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/JasonLovesDoggo/abacus/security/advisories/GHSA-vh64-54px-qgf8"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27421"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/JasonLovesDoggo/abacus/commit/78fdb9b48b7f6d08ed0cd41077509c0a97071552"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/JasonLovesDoggo/abacus/commit/898ff1204e11317cc161240b660e63eed5a72b33"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2025-3498",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2025-3499.json

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3499",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27507",
8+
"GHSA-f3gh-529w-v32x"
9+
],
10+
"summary": "IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel",
11+
"details": "IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v2.63.8, from v2.64.0 before v2.64.5, from v2.65.0 before v2.65.6, from v2.66.0 before v2.66.11, from v2.67.0 before v2.67.8, from v2.68.0 before v2.68.4, from v2.69.0 before v2.69.4, from v2.70.0 before v2.70.1.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/zitadel/zitadel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "2.63.8"
38+
},
39+
{
40+
"introduced": "2.64.0"
41+
},
42+
{
43+
"fixed": "2.64.5"
44+
},
45+
{
46+
"introduced": "2.65.0"
47+
},
48+
{
49+
"fixed": "2.65.6"
50+
},
51+
{
52+
"introduced": "2.66.0"
53+
},
54+
{
55+
"fixed": "2.66.11"
56+
},
57+
{
58+
"introduced": "2.67.0"
59+
},
60+
{
61+
"fixed": "2.67.8"
62+
},
63+
{
64+
"introduced": "2.68.0"
65+
},
66+
{
67+
"fixed": "2.68.4"
68+
},
69+
{
70+
"introduced": "2.69.0"
71+
},
72+
{
73+
"fixed": "2.69.4"
74+
},
75+
{
76+
"introduced": "2.70.0"
77+
},
78+
{
79+
"fixed": "2.70.1"
80+
}
81+
]
82+
}
83+
]
84+
}
85+
}
86+
],
87+
"references": [
88+
{
89+
"type": "ADVISORY",
90+
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-f3gh-529w-v32x"
91+
},
92+
{
93+
"type": "ADVISORY",
94+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27507"
95+
},
96+
{
97+
"type": "FIX",
98+
"url": "https://github.com/zitadel/zitadel/commit/d9d8339813f1c43d3eb7d8d80f11fdabb2fd2ee4"
99+
},
100+
{
101+
"type": "WEB",
102+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.63.8"
103+
},
104+
{
105+
"type": "WEB",
106+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.64.5"
107+
},
108+
{
109+
"type": "WEB",
110+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.65.6"
111+
},
112+
{
113+
"type": "WEB",
114+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.66.11"
115+
},
116+
{
117+
"type": "WEB",
118+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.67.8"
119+
},
120+
{
121+
"type": "WEB",
122+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.68.4"
123+
},
124+
{
125+
"type": "WEB",
126+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.69.4"
127+
},
128+
{
129+
"type": "WEB",
130+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.70.1"
131+
},
132+
{
133+
"type": "WEB",
134+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.0"
135+
}
136+
],
137+
"database_specific": {
138+
"url": "https://pkg.go.dev/vuln/GO-2025-3499",
139+
"review_status": "UNREVIEWED"
140+
}
141+
}

‎data/osv/GO-2025-3500.json

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3500",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-27155",
8+
"GHSA-fr62-mg2q-7wqv"
9+
],
10+
"summary": "In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone",
11+
"details": "In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/matrix-org/pinecone",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27155"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2025-3500",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

0 commit comments

Comments
 (0)