From 842487caaa036933f988cb3f54162dce2886711a Mon Sep 17 00:00:00 2001 From: Tatiana Bradley Date: Thu, 21 Nov 2024 14:41:56 -0500 Subject: [PATCH] data/reports: add 3 unreviewed reports - data/reports/GO-2024-3280.yaml - data/reports/GO-2024-3281.yaml - data/reports/GO-2024-3283.yaml Fixes golang/vulndb#3280 Fixes golang/vulndb#3281 Fixes golang/vulndb#3283 Change-Id: I86c60e8a8bee592cedb756c99695eabff0de5e5e Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/630755 Reviewed-by: Zvonimir Pavlinovic Auto-Submit: Tatiana Bradley LUCI-TryBot-Result: Go LUCI --- data/osv/GO-2024-3280.json | 61 ++++++++++++++++++++++++++++ data/osv/GO-2024-3281.json | 48 +++++++++++++++++++++++ data/osv/GO-2024-3283.json | 72 ++++++++++++++++++++++++++++++++++ data/reports/GO-2024-3280.yaml | 20 ++++++++++ data/reports/GO-2024-3281.yaml | 21 ++++++++++ data/reports/GO-2024-3283.yaml | 23 +++++++++++ 6 files changed, 245 insertions(+) create mode 100644 data/osv/GO-2024-3280.json create mode 100644 data/osv/GO-2024-3281.json create mode 100644 data/osv/GO-2024-3283.json create mode 100644 data/reports/GO-2024-3280.yaml create mode 100644 data/reports/GO-2024-3281.yaml create mode 100644 data/reports/GO-2024-3283.yaml diff --git a/data/osv/GO-2024-3280.json b/data/osv/GO-2024-3280.json new file mode 100644 index 00000000..09787ab3 --- /dev/null +++ b/data/osv/GO-2024-3280.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3280", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-52282", + "GHSA-9c5p-35gj-jqp4" + ], + "summary": "Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher", + "details": "Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.8.0 before v2.8.10, from v2.9.0 before v2.9.4.", + "affected": [ + { + "package": { + "name": "github.com/rancher/rancher", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.10" + }, + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.4" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3280", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file diff --git a/data/osv/GO-2024-3281.json b/data/osv/GO-2024-3281.json new file mode 100644 index 00000000..d0a1f49a --- /dev/null +++ b/data/osv/GO-2024-3281.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3281", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-52280", + "GHSA-j5hq-5jcr-xwx7" + ], + "summary": "github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve", + "details": "github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve", + "affected": [ + { + "package": { + "name": "github.com/rancher/steve", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.0-20241029132712-2175e090fe4b" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7" + }, + { + "type": "FIX", + "url": "https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3281", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file diff --git a/data/osv/GO-2024-3283.json b/data/osv/GO-2024-3283.json new file mode 100644 index 00000000..3ac0db74 --- /dev/null +++ b/data/osv/GO-2024-3283.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3283", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-52309" + ], + "summary": "SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo", + "details": "SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo", + "affected": [ + { + "package": { + "name": "github.com/drakkan/sftpgo", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + }, + { + "package": { + "name": "github.com/drakkan/sftpgo/v2", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.6.3" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52309" + }, + { + "type": "FIX", + "url": "https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb" + }, + { + "type": "FIX", + "url": "https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4" + }, + { + "type": "WEB", + "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3283", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file diff --git a/data/reports/GO-2024-3280.yaml b/data/reports/GO-2024-3280.yaml new file mode 100644 index 00000000..819f70ae --- /dev/null +++ b/data/reports/GO-2024-3280.yaml @@ -0,0 +1,20 @@ +id: GO-2024-3280 +modules: + - module: github.com/rancher/rancher + non_go_versions: + - introduced: 2.8.0 + - fixed: 2.8.10 + - introduced: 2.9.0 + - fixed: 2.9.4 + vulnerable_at: 1.6.30 +summary: Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher +cves: + - CVE-2024-52282 +ghsas: + - GHSA-9c5p-35gj-jqp4 +references: + - advisory: https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4 +source: + id: GHSA-9c5p-35gj-jqp4 + created: 2024-11-21T14:39:33.619351-05:00 +review_status: UNREVIEWED diff --git a/data/reports/GO-2024-3281.yaml b/data/reports/GO-2024-3281.yaml new file mode 100644 index 00000000..069898f3 --- /dev/null +++ b/data/reports/GO-2024-3281.yaml @@ -0,0 +1,21 @@ +id: GO-2024-3281 +modules: + - module: github.com/rancher/steve + versions: + - fixed: 0.0.0-20241029132712-2175e090fe4b +summary: |- + github.com/rancher/steve's users can issue watch commands for arbitrary + resources in github.com/rancher/steve +cves: + - CVE-2024-52280 +ghsas: + - GHSA-j5hq-5jcr-xwx7 +references: + - advisory: https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7 + - fix: https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9 +notes: + - fix: 'github.com/rancher/steve: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version' +source: + id: GHSA-j5hq-5jcr-xwx7 + created: 2024-11-21T14:39:28.380649-05:00 +review_status: UNREVIEWED diff --git a/data/reports/GO-2024-3283.yaml b/data/reports/GO-2024-3283.yaml new file mode 100644 index 00000000..041c1e5e --- /dev/null +++ b/data/reports/GO-2024-3283.yaml @@ -0,0 +1,23 @@ +id: GO-2024-3283 +modules: + - module: github.com/drakkan/sftpgo + vulnerable_at: 1.2.2 + - module: github.com/drakkan/sftpgo/v2 + versions: + - introduced: 2.4.0 + - fixed: 2.6.3 + vulnerable_at: 2.6.2 +summary: |- + SFTPGo allows administrators to restrict command execution from the EventManager + in github.com/drakkan/sftpgo +cves: + - CVE-2024-52309 +references: + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52309 + - fix: https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb + - fix: https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4 + - web: https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7 +source: + id: CVE-2024-52309 + created: 2024-11-21T14:38:20.406237-05:00 +review_status: UNREVIEWED