Skip to content

Commit f268f3b

Browse files
tatianabtatianab
committed
data/reports: add 7 unreviewed reports
 - data/reports/GO-2024-2968.yaml - data/reports/GO-2024-2969.yaml - data/reports/GO-2024-2970.yaml - data/reports/GO-2024-2971.yaml - data/reports/GO-2024-2972.yaml - data/reports/GO-2024-2973.yaml - data/reports/GO-2024-2974.yaml Fixes #2968 Fixes #2969 Fixes #2970 Fixes #2971 Fixes #2972 Fixes #2973 Fixes #2974 Change-Id: I0dd8dd80accdd5842a9cb7ebdd49b7698f162f57 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/597158 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
1 parent f272f63 commit f268f3b

14 files changed

+630
-0
lines changed

‎data/osv/GO-2024-2968.json

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2968",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39683",
8+
"GHSA-cvw9-c57h-3397"
9+
],
10+
"summary": "ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel",
11+
"details": "ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel from v2.0.0 before v2.53.8, from v2.54.0 before v2.54.5, from v2.55.0 before v2.55.1.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/zitadel/zitadel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "2.0.0"
35+
},
36+
{
37+
"fixed": "2.53.8"
38+
},
39+
{
40+
"introduced": "2.54.0"
41+
},
42+
{
43+
"fixed": "2.54.5"
44+
},
45+
{
46+
"introduced": "2.55.0"
47+
},
48+
{
49+
"fixed": "2.55.1"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39683"
65+
},
66+
{
67+
"type": "FIX",
68+
"url": "https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04"
69+
},
70+
{
71+
"type": "FIX",
72+
"url": "https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da"
73+
},
74+
{
75+
"type": "FIX",
76+
"url": "https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73"
77+
},
78+
{
79+
"type": "FIX",
80+
"url": "https://github.com/zitadel/zitadel/pull/8231"
81+
},
82+
{
83+
"type": "REPORT",
84+
"url": "https://github.com/zitadel/zitadel/issues/8213"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "https://discord.com/channels/927474939156643850/1254096852937347153"
89+
},
90+
{
91+
"type": "WEB",
92+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.8"
93+
},
94+
{
95+
"type": "WEB",
96+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.5"
97+
},
98+
{
99+
"type": "WEB",
100+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.1"
101+
}
102+
],
103+
"database_specific": {
104+
"url": "https://pkg.go.dev/vuln/GO-2024-2968",
105+
"review_status": "UNREVIEWED"
106+
}
107+
}

‎data/osv/GO-2024-2969.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2969",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39930"
8+
],
9+
"summary": "CVE-2024-39930 in github.com/gogs/gogs",
10+
"details": "CVE-2024-39930 in github.com/gogs/gogs",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/gogs/gogs",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39930"
34+
},
35+
{
36+
"type": "WEB",
37+
"url": "https://github.com/gogs/gogs/releases"
38+
},
39+
{
40+
"type": "WEB",
41+
"url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2024-2969",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

‎data/osv/GO-2024-2970.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2970",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39931",
8+
"GHSA-2vgj-3pvg-xh4w"
9+
],
10+
"summary": "Gogs allows deletion of internal files in github.com/gogs/gogs",
11+
"details": "Gogs allows deletion of internal files in github.com/gogs/gogs",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/gogs/gogs",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-2vgj-3pvg-xh4w"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39931"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/gogs/gogs/releases"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2024-2970",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2024-2971.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2971",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39932",
8+
"GHSA-hf29-9hfh-w63j"
9+
],
10+
"summary": "Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs",
11+
"details": "Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/gogs/gogs",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-hf29-9hfh-w63j"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39932"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/gogs/gogs/releases"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2024-2971",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2024-2972.json

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2972",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-39933",
8+
"GHSA-8mm6-wmpp-mmm3"
9+
],
10+
"summary": "Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs",
11+
"details": "Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/gogs/gogs",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-8mm6-wmpp-mmm3"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39933"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-2972",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

0 commit comments

Comments
 (0)