x/vulndb: potential Go vuln in github.com/projectdiscovery/nuclei: CVE-2024-43405

[GoVulnBot]

Advisory CVE-2024-43405 references a vulnerability in the following Go modules:

Module
github.com/projectdiscovery/nuclei

Description:
Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template. The vulnerability is present in the template signature verification process, specifically in the signer package. The vulnerability stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, combined with the way multiple signatures ar...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-43405
• FIX: projectdiscovery/nuclei@0da993a
• WEB: GHSA-7h5p-mmpp-hgmm

Cross references:

• github.com/projectdiscovery/nuclei appears in 2 other report(s):
  • data/reports/GO-2024-2645.yaml (x/vulndb: potential Go vuln in github.com/projectdiscovery/nuclei/v3: GHSA-w5wx-6g2r-r78q #2645)
  • data/reports/GO-2024-2989.yaml (x/vulndb: potential Go vuln in github.com/projectdiscovery/nuclei: CVE-2024-40641 #2989)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/projectdiscovery/nuclei
      vulnerable_at: 1.1.7
summary: CVE-2024-43405 in github.com/projectdiscovery/nuclei
cves:
    - CVE-2024-43405
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-43405
    - fix: https://github.com/projectdiscovery/nuclei/commit/0da993afe6d41b4b1b814e8fad23a2acba13c60a
    - web: https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-7h5p-mmpp-hgmm
source:
    id: CVE-2024-43405
    created: 2024-09-04T17:01:16.81155688Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/610804 mentions this issue: data/reports: add 8 unreviewed reports