-
Notifications
You must be signed in to change notification settings - Fork 55
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
data/reports: add 7 unreviewed reports
- data/reports/GO-2024-2968.yaml - data/reports/GO-2024-2969.yaml - data/reports/GO-2024-2970.yaml - data/reports/GO-2024-2971.yaml - data/reports/GO-2024-2972.yaml - data/reports/GO-2024-2973.yaml - data/reports/GO-2024-2974.yaml Fixes #2968 Fixes #2969 Fixes #2970 Fixes #2971 Fixes #2972 Fixes #2973 Fixes #2974 Change-Id: I0dd8dd80accdd5842a9cb7ebdd49b7698f162f57 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/597158 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
- Loading branch information
Showing
14 changed files
with
630 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| { | ||
| "schema_version": "1.3.1", | ||
| "id": "GO-2024-2968", | ||
| "modified": "0001-01-01T00:00:00Z", | ||
| "published": "0001-01-01T00:00:00Z", | ||
| "aliases": [ | ||
| "CVE-2024-39683", | ||
| "GHSA-cvw9-c57h-3397" | ||
| ], | ||
| "summary": "ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel", | ||
| "details": "ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel from v2.0.0 before v2.53.8, from v2.54.0 before v2.54.5, from v2.55.0 before v2.55.1.", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "name": "github.com/zitadel/zitadel", | ||
| "ecosystem": "Go" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "SEMVER", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "ecosystem_specific": { | ||
| "custom_ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "2.0.0" | ||
| }, | ||
| { | ||
| "fixed": "2.53.8" | ||
| }, | ||
| { | ||
| "introduced": "2.54.0" | ||
| }, | ||
| { | ||
| "fixed": "2.54.5" | ||
| }, | ||
| { | ||
| "introduced": "2.55.0" | ||
| }, | ||
| { | ||
| "fixed": "2.55.1" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397" | ||
| }, | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39683" | ||
| }, | ||
| { | ||
| "type": "FIX", | ||
| "url": "https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04" | ||
| }, | ||
| { | ||
| "type": "FIX", | ||
| "url": "https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da" | ||
| }, | ||
| { | ||
| "type": "FIX", | ||
| "url": "https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73" | ||
| }, | ||
| { | ||
| "type": "FIX", | ||
| "url": "https://github.com/zitadel/zitadel/pull/8231" | ||
| }, | ||
| { | ||
| "type": "REPORT", | ||
| "url": "https://github.com/zitadel/zitadel/issues/8213" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://discord.com/channels/927474939156643850/1254096852937347153" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.8" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.5" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.1" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "url": "https://pkg.go.dev/vuln/GO-2024-2968", | ||
| "review_status": "UNREVIEWED" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| { | ||
| "schema_version": "1.3.1", | ||
| "id": "GO-2024-2969", | ||
| "modified": "0001-01-01T00:00:00Z", | ||
| "published": "0001-01-01T00:00:00Z", | ||
| "aliases": [ | ||
| "CVE-2024-39930" | ||
| ], | ||
| "summary": "CVE-2024-39930 in github.com/gogs/gogs", | ||
| "details": "CVE-2024-39930 in github.com/gogs/gogs", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "name": "github.com/gogs/gogs", | ||
| "ecosystem": "Go" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "SEMVER", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "ecosystem_specific": {} | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39930" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/gogs/gogs/releases" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "url": "https://pkg.go.dev/vuln/GO-2024-2969", | ||
| "review_status": "UNREVIEWED" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| { | ||
| "schema_version": "1.3.1", | ||
| "id": "GO-2024-2970", | ||
| "modified": "0001-01-01T00:00:00Z", | ||
| "published": "0001-01-01T00:00:00Z", | ||
| "aliases": [ | ||
| "CVE-2024-39931", | ||
| "GHSA-2vgj-3pvg-xh4w" | ||
| ], | ||
| "summary": "Gogs allows deletion of internal files in github.com/gogs/gogs", | ||
| "details": "Gogs allows deletion of internal files in github.com/gogs/gogs", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "name": "github.com/gogs/gogs", | ||
| "ecosystem": "Go" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "SEMVER", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "ecosystem_specific": {} | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://github.com/advisories/GHSA-2vgj-3pvg-xh4w" | ||
| }, | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39931" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/gogs/gogs/releases" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "url": "https://pkg.go.dev/vuln/GO-2024-2970", | ||
| "review_status": "UNREVIEWED" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| { | ||
| "schema_version": "1.3.1", | ||
| "id": "GO-2024-2971", | ||
| "modified": "0001-01-01T00:00:00Z", | ||
| "published": "0001-01-01T00:00:00Z", | ||
| "aliases": [ | ||
| "CVE-2024-39932", | ||
| "GHSA-hf29-9hfh-w63j" | ||
| ], | ||
| "summary": "Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs", | ||
| "details": "Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "name": "github.com/gogs/gogs", | ||
| "ecosystem": "Go" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "SEMVER", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "ecosystem_specific": {} | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://github.com/advisories/GHSA-hf29-9hfh-w63j" | ||
| }, | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39932" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://github.com/gogs/gogs/releases" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "url": "https://pkg.go.dev/vuln/GO-2024-2971", | ||
| "review_status": "UNREVIEWED" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| { | ||
| "schema_version": "1.3.1", | ||
| "id": "GO-2024-2972", | ||
| "modified": "0001-01-01T00:00:00Z", | ||
| "published": "0001-01-01T00:00:00Z", | ||
| "aliases": [ | ||
| "CVE-2024-39933", | ||
| "GHSA-8mm6-wmpp-mmm3" | ||
| ], | ||
| "summary": "Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs", | ||
| "details": "Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs", | ||
| "affected": [ | ||
| { | ||
| "package": { | ||
| "name": "github.com/gogs/gogs", | ||
| "ecosystem": "Go" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "SEMVER", | ||
| "events": [ | ||
| { | ||
| "introduced": "0" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "ecosystem_specific": {} | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://github.com/advisories/GHSA-8mm6-wmpp-mmm3" | ||
| }, | ||
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39933" | ||
| }, | ||
| { | ||
| "type": "WEB", | ||
| "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "url": "https://pkg.go.dev/vuln/GO-2024-2972", | ||
| "review_status": "UNREVIEWED" | ||
| } | ||
| } |
Oops, something went wrong.