data/reports: update GO-2020-0001.yaml with correct vulnerable symbol

defaultLogFormatter is name of a variable holding an anonymous
vulnerable function. We now claim vulnerable those functions that
directly use defaultLogFormatter, which in this case is
LoggerWithConfig.

Fixes #55937

Change-Id: I38d398e7ef2f7a94cc625b669c26c5b8444adfa0
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/439377
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
This commit is contained in:
Zvonimir Pavlinovic 2022-10-05 14:50:39 -07:00
Родитель 707a3b5b40
Коммит 975704f232
2 изменённых файлов: 12 добавлений и 2 удалений

Просмотреть файл

@ -33,7 +33,11 @@
{
"path": "github.com/gin-gonic/gin",
"symbols": [
"defaultLogFormatter"
"Default",
"Logger",
"LoggerWithConfig",
"LoggerWithFormatter",
"LoggerWithWriter"
]
}
]

Просмотреть файл

@ -2,10 +2,16 @@ modules:
- module: github.com/gin-gonic/gin
versions:
- fixed: 1.6.0
vulnerable_at: 1.5.0
packages:
- package: github.com/gin-gonic/gin
symbols:
- defaultLogFormatter
- LoggerWithConfig
derived_symbols:
- Default
- Logger
- LoggerWithFormatter
- LoggerWithWriter
description: |
The default Formatter for the Logger middleware (LoggerConfig.Formatter),
which is included in the Default engine, allows attackers to inject arbitrary