зеркало из https://github.com/golang/vulndb.git
data/reports: add 2 unreviewed reports
- data/reports/GO-2024-3260.yaml - data/reports/GO-2024-3262.yaml Fixes golang/vulndb#3260 Fixes golang/vulndb#3262 Change-Id: Ifb5b2b3821c73a03b6cfb231e3f2ec5af1134072 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/626556 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
This commit is contained in:
Tatiana Bradley
Gopher Robot
Родитель
64cbf39ff0
Коммит
6baa4383f3
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"schema_version": "1.3.1",
|
||||
"id": "GO-2024-3260",
|
||||
"modified": "0001-01-01T00:00:00Z",
|
||||
"published": "0001-01-01T00:00:00Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45794",
|
||||
"GHSA-q78v-cv36-8fxj"
|
||||
],
|
||||
"summary": "Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron",
|
||||
"details": "Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "github.com/devtron-labs/devtron",
|
||||
"ecosystem": "Go"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.7.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ecosystem_specific": {}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45794"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/devtron-labs/devtron/commit/1540271bd777b6bccd288e513a9070d8f04b6056"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"url": "https://pkg.go.dev/vuln/GO-2024-3260",
|
||||
"review_status": "UNREVIEWED"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
"schema_version": "1.3.1",
|
||||
"id": "GO-2024-3262",
|
||||
"modified": "0001-01-01T00:00:00Z",
|
||||
"published": "0001-01-01T00:00:00Z",
|
||||
"aliases": [
|
||||
"CVE-2024-10975",
|
||||
"GHSA-2w5v-x29g-jw7j"
|
||||
],
|
||||
"summary": "Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad",
|
||||
"details": "Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "github.com/hashicorp/nomad",
|
||||
"ecosystem": "Go"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ecosystem_specific": {}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://github.com/advisories/GHSA-2w5v-x29g-jw7j"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10975"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/hashicorp/nomad/commit/30849c518e16647a4f698e5f5cc82bef2bf40e4d"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"url": "https://pkg.go.dev/vuln/GO-2024-3262",
|
||||
"review_status": "UNREVIEWED"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
id: GO-2024-3260
|
||||
modules:
|
||||
- module: github.com/devtron-labs/devtron
|
||||
versions:
|
||||
- fixed: 0.7.2
|
||||
vulnerable_at: 0.7.2-rc.0
|
||||
summary: Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron
|
||||
cves:
|
||||
- CVE-2024-45794
|
||||
ghsas:
|
||||
- GHSA-q78v-cv36-8fxj
|
||||
references:
|
||||
- advisory: https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj
|
||||
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45794
|
||||
- fix: https://github.com/devtron-labs/devtron/commit/1540271bd777b6bccd288e513a9070d8f04b6056
|
||||
source:
|
||||
id: GHSA-q78v-cv36-8fxj
|
||||
created: 2024-11-08T12:15:13.627476-05:00
|
||||
review_status: UNREVIEWED
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
id: GO-2024-3262
|
||||
modules:
|
||||
- module: github.com/hashicorp/nomad
|
||||
unsupported_versions:
|
||||
- last_affected: 1.9.1
|
||||
vulnerable_at: 1.9.2
|
||||
summary: Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad
|
||||
cves:
|
||||
- CVE-2024-10975
|
||||
ghsas:
|
||||
- GHSA-2w5v-x29g-jw7j
|
||||
references:
|
||||
- advisory: https://github.com/advisories/GHSA-2w5v-x29g-jw7j
|
||||
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-10975
|
||||
- fix: https://github.com/hashicorp/nomad/commit/30849c518e16647a4f698e5f5cc82bef2bf40e4d
|
||||
- web: https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission
|
||||
source:
|
||||
id: GHSA-2w5v-x29g-jw7j
|
||||
created: 2024-11-08T12:15:08.376448-05:00
|
||||
review_status: UNREVIEWED
|
||||
Загрузка…
Ссылка в новой задаче