зеркало из https://github.com/golang/vulndb.git
data/reports: add 3 unreviewed reports
- data/reports/GO-2024-3070.yaml - data/reports/GO-2024-3071.yaml - data/reports/GO-2024-3072.yaml Fixes golang/vulndb#3070 Fixes golang/vulndb#3071 Fixes golang/vulndb#3072 Change-Id: I12a406808b75a7f049eb8b899302fe17e0599662 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606235 Auto-Submit: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This commit is contained in:
Tatiana Bradley
Gopher Robot
Родитель
69ff61e6ae
Коммит
7f3ffd5c65
|
|
@ -0,0 +1,52 @@
|
|||
{
|
||||
"schema_version": "1.3.1",
|
||||
"id": "GO-2024-3070",
|
||||
"modified": "0001-01-01T00:00:00Z",
|
||||
"published": "0001-01-01T00:00:00Z",
|
||||
"aliases": [
|
||||
"CVE-2024-32231"
|
||||
],
|
||||
"summary": "CVE-2024-32231 in github.com/stashapp/stash",
|
||||
"details": "CVE-2024-32231 in github.com/stashapp/stash",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "github.com/stashapp/stash",
|
||||
"ecosystem": "Go"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ecosystem_specific": {}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32231"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/stashapp/stash/pull/4865"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/stashapp"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/stashapp/stash"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"url": "https://pkg.go.dev/vuln/GO-2024-3070",
|
||||
"review_status": "UNREVIEWED"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
{
|
||||
"schema_version": "1.3.1",
|
||||
"id": "GO-2024-3071",
|
||||
"modified": "0001-01-01T00:00:00Z",
|
||||
"published": "0001-01-01T00:00:00Z",
|
||||
"aliases": [
|
||||
"CVE-2024-42487",
|
||||
"GHSA-qcm3-7879-xcww"
|
||||
],
|
||||
"summary": "Gateway API route matching order contradicts specification in github.com/cilium/cilium",
|
||||
"details": "Gateway API route matching order contradicts specification in github.com/cilium/cilium",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "github.com/cilium/cilium",
|
||||
"ecosystem": "Go"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "1.15.0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.15.8"
|
||||
},
|
||||
{
|
||||
"introduced": "1.16.0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.16.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ecosystem_specific": {}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcww"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42487"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699a"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/cilium/cilium/commit/d88772b9c29e370becbc4547cada6711d51edcde"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/cilium/cilium/commit/fe42273566a943a0f3174c87b23a195c856b51d6"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/cilium/cilium/pull/34109"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"url": "https://pkg.go.dev/vuln/GO-2024-3071",
|
||||
"review_status": "UNREVIEWED"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
{
|
||||
"schema_version": "1.3.1",
|
||||
"id": "GO-2024-3072",
|
||||
"modified": "0001-01-01T00:00:00Z",
|
||||
"published": "0001-01-01T00:00:00Z",
|
||||
"aliases": [
|
||||
"CVE-2024-42488",
|
||||
"GHSA-q7w8-72mr-vpgw"
|
||||
],
|
||||
"summary": "Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium",
|
||||
"details": "Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "github.com/cilium/cilium",
|
||||
"ecosystem": "Go"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.14.14"
|
||||
},
|
||||
{
|
||||
"introduced": "1.15.0"
|
||||
},
|
||||
{
|
||||
"fixed": "1.15.8"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ecosystem_specific": {}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw"
|
||||
},
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42488"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/cilium/cilium/pull/33511"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"url": "https://pkg.go.dev/vuln/GO-2024-3072",
|
||||
"review_status": "UNREVIEWED"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
id: GO-2024-3070
|
||||
modules:
|
||||
- module: github.com/stashapp/stash
|
||||
vulnerable_at: 0.26.2
|
||||
summary: CVE-2024-32231 in github.com/stashapp/stash
|
||||
cves:
|
||||
- CVE-2024-32231
|
||||
references:
|
||||
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-32231
|
||||
- fix: https://github.com/stashapp/stash/pull/4865
|
||||
- web: https://github.com/stashapp
|
||||
- web: https://github.com/stashapp/stash
|
||||
source:
|
||||
id: CVE-2024-32231
|
||||
created: 2024-08-16T11:20:42.574239-04:00
|
||||
review_status: UNREVIEWED
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
id: GO-2024-3071
|
||||
modules:
|
||||
- module: github.com/cilium/cilium
|
||||
versions:
|
||||
- introduced: 1.15.0
|
||||
- fixed: 1.15.8
|
||||
- introduced: 1.16.0
|
||||
- fixed: 1.16.1
|
||||
vulnerable_at: 1.16.0
|
||||
summary: Gateway API route matching order contradicts specification in github.com/cilium/cilium
|
||||
cves:
|
||||
- CVE-2024-42487
|
||||
ghsas:
|
||||
- GHSA-qcm3-7879-xcww
|
||||
references:
|
||||
- advisory: https://github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcww
|
||||
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-42487
|
||||
- fix: https://github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699a
|
||||
- fix: https://github.com/cilium/cilium/commit/d88772b9c29e370becbc4547cada6711d51edcde
|
||||
- fix: https://github.com/cilium/cilium/commit/fe42273566a943a0f3174c87b23a195c856b51d6
|
||||
- fix: https://github.com/cilium/cilium/pull/34109
|
||||
source:
|
||||
id: GHSA-qcm3-7879-xcww
|
||||
created: 2024-08-16T11:20:36.928722-04:00
|
||||
review_status: UNREVIEWED
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
id: GO-2024-3072
|
||||
modules:
|
||||
- module: github.com/cilium/cilium
|
||||
versions:
|
||||
- fixed: 1.14.14
|
||||
- introduced: 1.15.0
|
||||
- fixed: 1.15.8
|
||||
vulnerable_at: 1.15.7
|
||||
summary: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
|
||||
cves:
|
||||
- CVE-2024-42488
|
||||
ghsas:
|
||||
- GHSA-q7w8-72mr-vpgw
|
||||
references:
|
||||
- advisory: https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw
|
||||
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-42488
|
||||
- fix: https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8
|
||||
- fix: https://github.com/cilium/cilium/pull/33511
|
||||
source:
|
||||
id: GHSA-q7w8-72mr-vpgw
|
||||
created: 2024-08-16T11:20:32.523735-04:00
|
||||
review_status: UNREVIEWED
|
||||
Загрузка…
Ссылка в новой задаче