diff --git a/data/osv/GO-2024-3124.json b/data/osv/GO-2024-3124.json new file mode 100644 index 00000000..6773ca3a --- /dev/null +++ b/data/osv/GO-2024-3124.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3124", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2023-46565", + "GHSA-6rqv-5cg7-m4x3" + ], + "summary": "Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp", + "details": "Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function.", + "affected": [ + { + "package": { + "name": "github.com/osrg/gobgp/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.20.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/osrg/gobgp/v3/pkg/packet/bgp", + "symbols": [ + "ValidateAttribute", + "ValidateUpdateMsg" + ] + }, + { + "path": "github.com/osrg/gobgp/v3/pkg/server", + "symbols": [ + "BgpServer.Serve", + "fsmHandler.recvMessageWithError" + ] + } + ] + } + } + ], + "references": [ + { + "type": "FIX", + "url": "https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22" + }, + { + "type": "REPORT", + "url": "https://github.com/osrg/gobgp/issues/2725" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3124", + "review_status": "REVIEWED" + } +} \ No newline at end of file diff --git a/data/reports/GO-2024-3124.yaml b/data/reports/GO-2024-3124.yaml new file mode 100644 index 00000000..6cc2dc81 --- /dev/null +++ b/data/reports/GO-2024-3124.yaml @@ -0,0 +1,31 @@ +id: GO-2024-3124 +modules: + - module: github.com/osrg/gobgp/v3 + versions: + - fixed: 3.20.0 + vulnerable_at: 3.19.0 + packages: + - package: github.com/osrg/gobgp/v3/pkg/packet/bgp + symbols: + - ValidateAttribute + - ValidateUpdateMsg + - package: github.com/osrg/gobgp/v3/pkg/server + symbols: + - fsmHandler.recvMessageWithError + derived_symbols: + - BgpServer.Serve +summary: Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp +description: |- + Buffer Overflow vulnerability allows a remote attacker to cause a denial of + service via an fsm error handling function. +cves: + - CVE-2023-46565 +ghsas: + - GHSA-6rqv-5cg7-m4x3 +references: + - fix: https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22 + - report: https://github.com/osrg/gobgp/issues/2725 +source: + id: GHSA-6rqv-5cg7-m4x3 + created: 2024-09-17T13:41:34.353150637Z +review_status: REVIEWED