Skip to content

Commit 64cbf39

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 4 unreviewed reports
 - data/reports/GO-2024-3251.yaml - data/reports/GO-2024-3252.yaml - data/reports/GO-2024-3253.yaml - data/reports/GO-2024-3254.yaml Fixes #3251 Fixes #3252 Fixes #3253 Fixes #3254 Change-Id: Ib263e13922d9ade0f30629b7f9a902de630fb2bc Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/625955 Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
1 parent b05c7fc commit 64cbf39

8 files changed

+284
-0
lines changed

Diff for: ‎data/osv/GO-2024-3251.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3251",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-10389",
8+
"GHSA-q3rp-vvm7-j8jg"
9+
],
10+
"summary": "Safearchive Path Traversal vulnerability in github.com/google/safearchive",
11+
"details": "Safearchive Path Traversal vulnerability in github.com/google/safearchive",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/google/safearchive",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.0-20241025131057-f7ce9d7b6f9c"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-q3rp-vvm7-j8jg"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10389"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/google/safearchive/commit/f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2024-3251",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

Diff for: ‎data/osv/GO-2024-3252.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3252",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-51746",
8+
"GHSA-8pmp-678w-c8xx"
9+
],
10+
"summary": "gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign",
11+
"details": "gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/sigstore/gitsign",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.11.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51746"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2024-3252",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

Diff for: ‎data/osv/GO-2024-3253.json

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3253",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-48057",
8+
"GHSA-ghx4-cgxw-7h9p"
9+
],
10+
"summary": "LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI",
11+
"details": "LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mudler/LocalAI",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-ghx4-cgxw-7h9p"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48057"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://gist.github.com/AfterSnows/1bd7ee5a3a42dbb5f5ff67f7f9c8ccec"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/mudler/LocalAI/blob/master/core/http/views/index.html#L75"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://rumbling-slice-eb0.notion.site/LocalAI-deleted-model-with-storage-XSS-CSRF-vulnerability-in-mudler-localai-101e3cda9e8c80e0ac12fe418d5dd982?pvs=4"
51+
}
52+
],
53+
"database_specific": {
54+
"url": "https://pkg.go.dev/vuln/GO-2024-3253",
55+
"review_status": "UNREVIEWED"
56+
}
57+
}

Diff for: ‎data/osv/GO-2024-3254.json

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3254",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-51735",
8+
"GHSA-wvv7-wm5v-w2gv"
9+
],
10+
"summary": "Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus",
11+
"details": "Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/j3ssie/osmedeus",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/j3ssie/osmedeus/security/advisories/GHSA-wvv7-wm5v-w2gv"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51735"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://drive.google.com/file/d/1u-YowfzFV1tUqLaZk4s4Y1DykFhJZ8gR/view?usp=sharing"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-3254",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

Diff for: ‎data/reports/GO-2024-3251.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2024-3251
2+
modules:
3+
- module: github.com/google/safearchive
4+
versions:
5+
- fixed: 0.0.0-20241025131057-f7ce9d7b6f9c
6+
summary: Safearchive Path Traversal vulnerability in github.com/google/safearchive
7+
cves:
8+
- CVE-2024-10389
9+
ghsas:
10+
- GHSA-q3rp-vvm7-j8jg
11+
references:
12+
- advisory: https://github.com/advisories/GHSA-q3rp-vvm7-j8jg
13+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-10389
14+
- fix: https://github.com/google/safearchive/commit/f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc
15+
notes:
16+
- fix: 'github.com/google/safearchive: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
17+
source:
18+
id: GHSA-q3rp-vvm7-j8jg
19+
created: 2024-11-06T11:55:09.66027-05:00
20+
review_status: UNREVIEWED

Diff for: ‎data/reports/GO-2024-3252.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2024-3252
2+
modules:
3+
- module: github.com/sigstore/gitsign
4+
versions:
5+
- fixed: 0.11.0
6+
vulnerable_at: 0.10.2
7+
summary: gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
8+
cves:
9+
- CVE-2024-51746
10+
ghsas:
11+
- GHSA-8pmp-678w-c8xx
12+
references:
13+
- advisory: https://github.com/sigstore/gitsign/security/advisories/GHSA-8pmp-678w-c8xx
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-51746
15+
source:
16+
id: GHSA-8pmp-678w-c8xx
17+
created: 2024-11-06T11:55:06.276361-05:00
18+
review_status: UNREVIEWED

Diff for: ‎data/reports/GO-2024-3253.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2024-3253
2+
modules:
3+
- module: github.com/mudler/LocalAI
4+
unsupported_versions:
5+
- last_affected: 2.20.1
6+
vulnerable_at: 1.40.0
7+
summary: LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI
8+
cves:
9+
- CVE-2024-48057
10+
ghsas:
11+
- GHSA-ghx4-cgxw-7h9p
12+
references:
13+
- advisory: https://github.com/advisories/GHSA-ghx4-cgxw-7h9p
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-48057
15+
- web: https://gist.github.com/AfterSnows/1bd7ee5a3a42dbb5f5ff67f7f9c8ccec
16+
- web: https://github.com/mudler/LocalAI/blob/master/core/http/views/index.html#L75
17+
- web: https://rumbling-slice-eb0.notion.site/LocalAI-deleted-model-with-storage-XSS-CSRF-vulnerability-in-mudler-localai-101e3cda9e8c80e0ac12fe418d5dd982?pvs=4
18+
source:
19+
id: GHSA-ghx4-cgxw-7h9p
20+
created: 2024-11-06T11:54:56.535401-05:00
21+
review_status: UNREVIEWED

Diff for: ‎data/reports/GO-2024-3254.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2024-3254
2+
modules:
3+
- module: github.com/j3ssie/osmedeus
4+
unsupported_versions:
5+
- last_affected: 4.6.4
6+
vulnerable_at: 0.0.0-20240404115937-815c261d44f6
7+
summary: Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus
8+
cves:
9+
- CVE-2024-51735
10+
ghsas:
11+
- GHSA-wvv7-wm5v-w2gv
12+
references:
13+
- advisory: https://github.com/j3ssie/osmedeus/security/advisories/GHSA-wvv7-wm5v-w2gv
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-51735
15+
- web: https://drive.google.com/file/d/1u-YowfzFV1tUqLaZk4s4Y1DykFhJZ8gR/view?usp=sharing
16+
source:
17+
id: GHSA-wvv7-wm5v-w2gv
18+
created: 2024-11-06T11:54:48.127027-05:00
19+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)