Skip to content

Commit 2b20095

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 16 unreviewed reports
 - data/reports/GO-2024-3207.yaml - data/reports/GO-2024-3208.yaml - data/reports/GO-2024-3210.yaml - data/reports/GO-2024-3211.yaml - data/reports/GO-2024-3212.yaml - data/reports/GO-2024-3213.yaml - data/reports/GO-2024-3214.yaml - data/reports/GO-2024-3215.yaml - data/reports/GO-2024-3216.yaml - data/reports/GO-2024-3217.yaml - data/reports/GO-2024-3219.yaml - data/reports/GO-2024-3220.yaml - data/reports/GO-2024-3221.yaml - data/reports/GO-2024-3222.yaml - data/reports/GO-2024-3223.yaml - data/reports/GO-2024-3224.yaml Fixes #3207 Fixes #3208 Fixes #3210 Fixes #3211 Fixes #3212 Fixes #3213 Fixes #3214 Fixes #3215 Fixes #3216 Fixes #3217 Fixes #3219 Fixes #3220 Fixes #3221 Fixes #3222 Fixes #3223 Fixes #3224 Change-Id: I194a8c99c011c5855a50ecd5069b628a1d36746a Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/622835 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
1 parent f0a1e14 commit 2b20095

32 files changed

+1460
-0
lines changed

‎data/osv/GO-2024-3207.json

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3207",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-p5wf-cmr4-xrwr"
8+
],
9+
"summary": "Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito",
10+
"details": "Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/facebookincubator/tacquito",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.0.0-20241011192817-07b49d1358e6"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/facebookincubator/tacquito/security/advisories/GHSA-p5wf-cmr4-xrwr"
37+
},
38+
{
39+
"type": "FIX",
40+
"url": "https://github.com/facebookincubator/tacquito/commit/07b49d1358e6ec0b5aa482fcd284f509191119e2"
41+
}
42+
],
43+
"database_specific": {
44+
"url": "https://pkg.go.dev/vuln/GO-2024-3207",
45+
"review_status": "UNREVIEWED"
46+
}
47+
}

‎data/osv/GO-2024-3208.json

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3208",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-47825",
8+
"GHSA-3wwx-63fv-pfq6"
9+
],
10+
"summary": "Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium",
11+
"details": "Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/cilium/cilium",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.14.0"
24+
},
25+
{
26+
"fixed": "1.14.16"
27+
},
28+
{
29+
"introduced": "1.15.0"
30+
},
31+
{
32+
"fixed": "1.15.10"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-3wwx-63fv-pfq6"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47825"
48+
},
49+
{
50+
"type": "FIX",
51+
"url": "https://github.com/cilium/cilium/commit/02d28d9ac9afcaddd301fae6fb4d6cda8c2d0c45"
52+
},
53+
{
54+
"type": "FIX",
55+
"url": "https://github.com/cilium/cilium/commit/9c01afb5646af3f0c696421a410dc66c513b6524"
56+
}
57+
],
58+
"database_specific": {
59+
"url": "https://pkg.go.dev/vuln/GO-2024-3208",
60+
"review_status": "UNREVIEWED"
61+
}
62+
}

‎data/osv/GO-2024-3210.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3210",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-8901"
8+
],
9+
"summary": "Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio",
10+
"details": "Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/awslabs/aws-alb-route-directive-adapter-for-istio",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2024-011/"
34+
},
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8901"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/security/advisories/GHSA-789x-wph8-m68r"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2024-3210",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

‎data/osv/GO-2024-3211.json

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3211",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-50312"
8+
],
9+
"summary": "Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console",
10+
"details": "Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/openshift/console",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50312"
34+
},
35+
{
36+
"type": "FIX",
37+
"url": "https://github.com/openshift/console/pull/14409/files"
38+
},
39+
{
40+
"type": "REPORT",
41+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319378"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://access.redhat.com/security/cve/CVE-2024-50312"
46+
}
47+
],
48+
"credits": [
49+
{
50+
"name": "Red Hat would like to thank Maksymilian Kubiak (AFINE), Paweł Zdunek (AFINE), and Sławomir Zakrzewski (AFINE) for reporting this issue."
51+
}
52+
],
53+
"database_specific": {
54+
"url": "https://pkg.go.dev/vuln/GO-2024-3211",
55+
"review_status": "UNREVIEWED"
56+
}
57+
}

‎data/osv/GO-2024-3212.json

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3212",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-rjfv-pjvx-mjgv"
8+
],
9+
"summary": "AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller",
10+
"details": "AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: sigs.k8s.io/aws-load-balancer-controller from v2.0.0 before v2.8.2.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "sigs.k8s.io/aws-load-balancer-controller",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {
28+
"custom_ranges": [
29+
{
30+
"type": "ECOSYSTEM",
31+
"events": [
32+
{
33+
"introduced": "2.0.0"
34+
},
35+
{
36+
"fixed": "2.8.2"
37+
}
38+
]
39+
}
40+
]
41+
}
42+
}
43+
],
44+
"references": [
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://github.com/kubernetes-sigs/aws-load-balancer-controller/security/advisories/GHSA-rjfv-pjvx-mjgv"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://aws.amazon.com/security/vulnerability-reporting"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/configurations/#waf-addons"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/ingress/annotations/#addons"
60+
}
61+
],
62+
"database_specific": {
63+
"url": "https://pkg.go.dev/vuln/GO-2024-3212",
64+
"review_status": "UNREVIEWED"
65+
}
66+
}

‎data/osv/GO-2024-3213.json

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3213",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-49380"
8+
],
9+
"summary": "Plenti arbitrary file write vulnerability in github.com/plentico/plenti",
10+
"details": "Plenti arbitrary file write vulnerability in github.com/plentico/plenti",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/plentico/plenti",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.7.2"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49380"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/plentico/plenti/releases/tag/v0.7.2"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/"
49+
}
50+
],
51+
"database_specific": {
52+
"url": "https://pkg.go.dev/vuln/GO-2024-3213",
53+
"review_status": "UNREVIEWED"
54+
}
55+
}

0 commit comments

Comments
 (0)