Skip to content

Commit c9ed1ff

Browse files
tatianabtatianab
committed
data/excluded,data/reports: add 6 reports
 - data/excluded/GO-2024-2985.yaml - data/excluded/GO-2024-2986.yaml - data/reports/GO-2024-2987.yaml - data/reports/GO-2024-2989.yaml - data/reports/GO-2024-2990.yaml - data/reports/GO-2024-2992.yaml Fixes #2985 Fixes #2986 Fixes #2987 Fixes #2989 Fixes #2990 Fixes #2992 Change-Id: Ic7fbcd2b3fb62df054f13fdba9b4b4cb1aee8d6e Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/599457 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Damien Neil <dneil@google.com>
1 parent 6a3e504 commit c9ed1ff

10 files changed

+350
-0
lines changed

‎data/excluded/GO-2024-2985.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
id: GO-2024-2985
2+
excluded: NOT_GO_CODE
3+
modules:
4+
- module: github.com/apache/airflow
5+
cves:
6+
- CVE-2024-39863

‎data/excluded/GO-2024-2986.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
id: GO-2024-2986
2+
excluded: NOT_GO_CODE
3+
modules:
4+
- module: github.com/apache/airflow
5+
cves:
6+
- CVE-2024-39877

‎data/osv/GO-2024-2987.json

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2987",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-6535",
8+
"GHSA-w799-v85j-88pg"
9+
],
10+
"summary": "Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper",
11+
"details": "Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/skupperproject/skupper",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.0-20240703184342-c26bce4079ff"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-w799-v85j-88pg"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6535"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/skupperproject/skupper/commit/d2cb3782e807853694ee66b6e3d4a1917485eb71"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://access.redhat.com/security/cve/CVE-2024-6535"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296024"
54+
}
55+
],
56+
"database_specific": {
57+
"url": "https://pkg.go.dev/vuln/GO-2024-2987",
58+
"review_status": "UNREVIEWED"
59+
}
60+
}

‎data/osv/GO-2024-2989.json

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2989",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-40641",
8+
"GHSA-c3q9-c27p-cw9h"
9+
],
10+
"summary": "projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei",
11+
"details": "projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/projectdiscovery/nuclei",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/projectdiscovery/nuclei/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {}
46+
},
47+
{
48+
"package": {
49+
"name": "github.com/projectdiscovery/nuclei/v3",
50+
"ecosystem": "Go"
51+
},
52+
"ranges": [
53+
{
54+
"type": "SEMVER",
55+
"events": [
56+
{
57+
"introduced": "0"
58+
},
59+
{
60+
"fixed": "3.3.0"
61+
}
62+
]
63+
}
64+
],
65+
"ecosystem_specific": {}
66+
}
67+
],
68+
"references": [
69+
{
70+
"type": "ADVISORY",
71+
"url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-c3q9-c27p-cw9h"
72+
},
73+
{
74+
"type": "ADVISORY",
75+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40641"
76+
}
77+
],
78+
"database_specific": {
79+
"url": "https://pkg.go.dev/vuln/GO-2024-2989",
80+
"review_status": "UNREVIEWED"
81+
}
82+
}

‎data/osv/GO-2024-2990.json

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2990",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39907",
8+
"GHSA-5grx-v727-qmq6"
9+
],
10+
"summary": "1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel",
11+
"details": "1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/1Panel-dev/1Panel before v1.10.12-tls.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/1Panel-dev/1Panel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "1.10.12-tls"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6"
49+
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39907"
53+
},
54+
{
55+
"type": "FIX",
56+
"url": "https://github.com/1Panel-dev/1Panel/commit/ff549a47937c1314e6ee08453a1d2128242440cd"
57+
}
58+
],
59+
"database_specific": {
60+
"url": "https://pkg.go.dev/vuln/GO-2024-2990",
61+
"review_status": "UNREVIEWED"
62+
}
63+
}

‎data/osv/GO-2024-2992.json

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2992",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39911"
8+
],
9+
"summary": "1Panel SQL injection in github.com/1Panel-dev/1Panel",
10+
"details": "1Panel SQL injection in github.com/1Panel-dev/1Panel",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/1Panel-dev/1Panel",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.10.12-lts"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39911"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5"
45+
}
46+
],
47+
"database_specific": {
48+
"url": "https://pkg.go.dev/vuln/GO-2024-2992",
49+
"review_status": "UNREVIEWED"
50+
}
51+
}

‎data/reports/GO-2024-2987.yaml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
id: GO-2024-2987
2+
modules:
3+
- module: github.com/skupperproject/skupper
4+
versions:
5+
- fixed: 0.0.0-20240703184342-c26bce4079ff
6+
summary: Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper
7+
cves:
8+
- CVE-2024-6535
9+
ghsas:
10+
- GHSA-w799-v85j-88pg
11+
references:
12+
- advisory: https://github.com/advisories/GHSA-w799-v85j-88pg
13+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-6535
14+
- fix: https://github.com/skupperproject/skupper/commit/d2cb3782e807853694ee66b6e3d4a1917485eb71
15+
- web: https://access.redhat.com/security/cve/CVE-2024-6535
16+
- web: https://bugzilla.redhat.com/show_bug.cgi?id=2296024
17+
notes:
18+
- fix: 'github.com/skupperproject/skupper: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
19+
source:
20+
id: GHSA-w799-v85j-88pg
21+
created: 2024-07-18T16:18:19.770441-04:00
22+
review_status: UNREVIEWED

‎data/reports/GO-2024-2989.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
id: GO-2024-2989
2+
modules:
3+
- module: github.com/projectdiscovery/nuclei
4+
vulnerable_at: 1.1.7
5+
- module: github.com/projectdiscovery/nuclei/v2
6+
vulnerable_at: 2.9.15
7+
- module: github.com/projectdiscovery/nuclei/v3
8+
versions:
9+
- fixed: 3.3.0
10+
vulnerable_at: 3.2.9
11+
summary: |-
12+
projectdiscovery/nuclei allows unsigned code template execution through
13+
workflows in github.com/projectdiscovery/nuclei
14+
cves:
15+
- CVE-2024-40641
16+
ghsas:
17+
- GHSA-c3q9-c27p-cw9h
18+
references:
19+
- advisory: https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-c3q9-c27p-cw9h
20+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-40641
21+
source:
22+
id: GHSA-c3q9-c27p-cw9h
23+
created: 2024-07-18T16:18:07.953998-04:00
24+
review_status: UNREVIEWED

‎data/reports/GO-2024-2990.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2024-2990
2+
modules:
3+
- module: github.com/1Panel-dev/1Panel
4+
non_go_versions:
5+
- fixed: 1.10.12-tls
6+
vulnerable_at: 1.9.6
7+
summary: 1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel
8+
cves:
9+
- CVE-2024-39907
10+
ghsas:
11+
- GHSA-5grx-v727-qmq6
12+
references:
13+
- advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39907
15+
- fix: https://github.com/1Panel-dev/1Panel/commit/ff549a47937c1314e6ee08453a1d2128242440cd
16+
source:
17+
id: GHSA-5grx-v727-qmq6
18+
created: 2024-07-18T16:18:04.925699-04:00
19+
review_status: UNREVIEWED

‎data/reports/GO-2024-2992.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: GO-2024-2992
2+
modules:
3+
- module: github.com/1Panel-dev/1Panel
4+
versions:
5+
- fixed: 1.10.12-lts
6+
vulnerable_at: 1.10.12-beta
7+
summary: 1Panel SQL injection in github.com/1Panel-dev/1Panel
8+
cves:
9+
- CVE-2024-39911
10+
references:
11+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39911
12+
- web: https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html
13+
- web: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5
14+
source:
15+
id: CVE-2024-39911
16+
created: 2024-07-18T16:18:00.687879-04:00
17+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)