Skip to content

x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-95f9-94vc-665h #569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
julieqiu opened this issue Aug 1, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/beego/beego: GHSA-95f9-94vc-665h #569

julieqiu opened this issue Aug 1, 2022 · 3 comments
Assignees
@jba
Labels
NeedsReport

Comments

@julieqiu
Copy link
Member

julieqiu commented Aug 1, 2022

In GitHub Security Advisory GHSA-95f9-94vc-665h, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/beego/beego 2.0.4 < 2.0.4

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/beego/beego
    versions:
      - fixed: 2.0.4
description: The leafInfo.match() function in Beego v2.0.3 and below uses path.join()
    to deal with wildcardvalues which can lead to cross directory risk.
published: 2022-07-06T00:00:28Z
last_modified: 2022-07-15T20:48:25Z
cves:
  - CVE-2022-31836
ghsas:
  - GHSA-95f9-94vc-665h
links:
    context:
      - https://github.com/advisories/GHSA-95f9-94vc-665h
@julieqiu julieqiu assigned jba and unassigned zpavlinovic Aug 15, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/425079 mentions this issue: add report for issue 569

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/425084 mentions this issue: x/vulndb: add data/reports/GO-2022-0569.yaml for CVE-2022-31836

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/465801 mentions this issue: data/reports: add vulnerable_at to GO-2022-0569.yaml

gopherbot pushed a commit that referenced this issue Feb 7, 2023
@tatianab
data/reports: add vulnerable_at to GO-2022-0569.yaml
f01ed42 
Aliases: CVE-2022-31836, GHSA-95f9-94vc-665h

Updates #569

Change-Id: If26ddd1f63c2d82bf4a6e069a1de1945a5b6491d
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/465801
Reviewed-by: Tim King <[email protected]>
Run-TryBot: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
@GoVulnBot GoVulnBot mentioned this issue Feb 1, 2024
Closed
This was referenced Aug 1, 2024
Closed
Closed
This was referenced Aug 1, 2024
Open
Closed
This was referenced Dec 12, 2024
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Mar 31, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jba jba

Labels
NeedsReport
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@zpavlinovic @julieqiu @gopherbot @jba