Skip to content

Commit 455ee1e

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 2 reports
 - data/reports/GO-2024-2961.yaml - data/reports/GO-2024-2962.yaml Updates #2961 Updates #2962 Change-Id: I99256f208f954f881aaf677c7a38151ad4ee1f0d Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/596177 Auto-Submit: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]>
1 parent 1f1fc5f commit 455ee1e

File tree

6 files changed

+383
-0
lines changed

6 files changed

+383
-0
lines changed

‎data/cve/v5/GO-2024-2961.json

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2022-30636"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Limited directory traversal vulnerability on Windows in golang.org/x/crypto",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\\..\\asd becomes ..\\..\\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "golang.org/x/crypto",
22+
"product": "golang.org/x/crypto/acme/autocert",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "golang.org/x/crypto/acme/autocert",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "0.0.0-20220525230936-793ad666bf5e",
29+
"status": "affected",
30+
"versionType": "semver"
31+
}
32+
],
33+
"platforms": [
34+
"windows"
35+
],
36+
"programRoutines": [
37+
{
38+
"name": "DirCache.Get"
39+
},
40+
{
41+
"name": "DirCache.Put"
42+
},
43+
{
44+
"name": "DirCache.Delete"
45+
},
46+
{
47+
"name": "HostWhitelist"
48+
},
49+
{
50+
"name": "Manager.GetCertificate"
51+
},
52+
{
53+
"name": "Manager.Listener"
54+
},
55+
{
56+
"name": "NewListener"
57+
},
58+
{
59+
"name": "listener.Accept"
60+
},
61+
{
62+
"name": "listener.Close"
63+
}
64+
],
65+
"defaultStatus": "unaffected"
66+
}
67+
],
68+
"problemTypes": [
69+
{
70+
"descriptions": [
71+
{
72+
"lang": "en",
73+
"description": "CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
74+
}
75+
]
76+
}
77+
],
78+
"references": [
79+
{
80+
"url": "https://go.dev/cl/408694"
81+
},
82+
{
83+
"url": "https://go.dev/issue/53082"
84+
},
85+
{
86+
"url": "https://pkg.go.dev/vuln/GO-2024-2961"
87+
}
88+
],
89+
"credits": [
90+
{
91+
"lang": "en",
92+
"value": "Juho Nurminen of Mattermost"
93+
}
94+
]
95+
}
96+
}
97+
}

‎data/cve/v5/GO-2024-2962.json

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2023-24531"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Output of \"go env\" does not sanitize values in cmd/go",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making \"go env\" print them out."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go toolchain",
22+
"product": "cmd/go",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "cmd/go",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.21.0-0",
29+
"status": "affected",
30+
"versionType": "semver"
31+
}
32+
],
33+
"defaultStatus": "unaffected"
34+
}
35+
],
36+
"problemTypes": [
37+
{
38+
"descriptions": [
39+
{
40+
"lang": "en",
41+
"description": "CWE-138: Improper Neutralization of Special Elements"
42+
}
43+
]
44+
}
45+
],
46+
"references": [
47+
{
48+
"url": "https://go.dev/cl/488375"
49+
},
50+
{
51+
"url": "https://go.dev/cl/493535"
52+
},
53+
{
54+
"url": "https://go.dev/issue/58508"
55+
},
56+
{
57+
"url": "https://groups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJ"
58+
},
59+
{
60+
"url": "https://pkg.go.dev/vuln/GO-2024-2962"
61+
}
62+
],
63+
"credits": [
64+
{
65+
"lang": "en",
66+
"value": "Hunter Wittenborn (https://hunterwittenborn.com/)"
67+
}
68+
]
69+
}
70+
}
71+
}

‎data/osv/GO-2024-2961.json

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2961",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2022-30636"
8+
],
9+
"summary": "Limited directory traversal vulnerability on Windows in golang.org/x/crypto",
10+
"details": "httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\\..\\asd becomes ..\\..\\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened.\n\nSince the controlled path is suffixed with +http-01 before opening, the impact of this is significantly limited, since it only allows reading arbitrary files on the system if and only if they have this suffix.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "golang.org/x/crypto",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.0.0-20220525230936-793ad666bf5e"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {
31+
"imports": [
32+
{
33+
"path": "golang.org/x/crypto/acme/autocert",
34+
"goos": [
35+
"windows"
36+
],
37+
"symbols": [
38+
"DirCache.Delete",
39+
"DirCache.Get",
40+
"DirCache.Put",
41+
"HostWhitelist",
42+
"Manager.GetCertificate",
43+
"Manager.Listener",
44+
"NewListener",
45+
"listener.Accept",
46+
"listener.Close"
47+
]
48+
}
49+
]
50+
}
51+
}
52+
],
53+
"references": [
54+
{
55+
"type": "FIX",
56+
"url": "https://go.dev/cl/408694"
57+
},
58+
{
59+
"type": "REPORT",
60+
"url": "https://go.dev/issue/53082"
61+
}
62+
],
63+
"credits": [
64+
{
65+
"name": "Juho Nurminen of Mattermost"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2024-2961",
70+
"review_status": "REVIEWED"
71+
}
72+
}

‎data/osv/GO-2024-2962.json

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2962",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-24531"
8+
],
9+
"summary": "Output of \"go env\" does not sanitize values in cmd/go",
10+
"details": "Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables.\n\nThis issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making \"go env\" print them out.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "toolchain",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.21.0-0"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {
31+
"imports": [
32+
{
33+
"path": "cmd/go"
34+
}
35+
]
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "FIX",
42+
"url": "https://go.dev/cl/488375"
43+
},
44+
{
45+
"type": "FIX",
46+
"url": "https://go.dev/cl/493535"
47+
},
48+
{
49+
"type": "REPORT",
50+
"url": "https://go.dev/issue/58508"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://groups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJ"
55+
}
56+
],
57+
"credits": [
58+
{
59+
"name": "Hunter Wittenborn (https://hunterwittenborn.com/)"
60+
}
61+
],
62+
"database_specific": {
63+
"url": "https://pkg.go.dev/vuln/GO-2024-2962",
64+
"review_status": "REVIEWED"
65+
}
66+
}

‎data/reports/GO-2024-2961.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
id: GO-2024-2961
2+
modules:
3+
- module: golang.org/x/crypto
4+
versions:
5+
- fixed: 0.0.0-20220525230936-793ad666bf5e
6+
vulnerable_at: 0.0.0-20220518034528-6f7dac969898
7+
packages:
8+
- package: golang.org/x/crypto/acme/autocert
9+
goos:
10+
- windows
11+
symbols:
12+
- DirCache.Get
13+
- DirCache.Put
14+
- DirCache.Delete
15+
derived_symbols:
16+
- HostWhitelist
17+
- Manager.GetCertificate
18+
- Manager.Listener
19+
- NewListener
20+
- listener.Accept
21+
- listener.Close
22+
summary: Limited directory traversal vulnerability on Windows in golang.org/x/crypto
23+
description: |-
24+
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to
25+
lookup in the DirCache implementation. On Windows, path.Base acts differently to
26+
filepath.Base, since Windows uses a different path separator (\ vs. /), allowing
27+
a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd
28+
becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined
29+
with the cache directory, and opened.
30+
31+
Since the controlled path is suffixed with +http-01 before opening, the impact
32+
of this is significantly limited, since it only allows reading arbitrary files
33+
on the system if and only if they have this suffix.
34+
credits:
35+
- Juho Nurminen of Mattermost
36+
references:
37+
- fix: https://go.dev/cl/408694
38+
- report: https://go.dev/issue/53082
39+
cve_metadata:
40+
id: CVE-2022-30636
41+
cwe: 'CWE 22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')'
42+
source:
43+
id: go-security-team
44+
created: 2024-07-02T12:55:35.249465-04:00
45+
review_status: REVIEWED

‎data/reports/GO-2024-2962.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
id: GO-2024-2962
2+
modules:
3+
- module: cmd
4+
versions:
5+
- fixed: 1.21.0-0
6+
vulnerable_at: 1.20.14
7+
packages:
8+
- package: cmd/go
9+
summary: Output of "go env" does not sanitize values in cmd/go
10+
description: |-
11+
Command go env is documented as outputting a shell script containing the Go
12+
environment. However, go env doesn't sanitize values, so executing its output as
13+
a shell script can cause various bad bahaviors, including executing arbitrary
14+
commands or inserting new environment variables.
15+
16+
This issue is relatively minor because, in general, if an attacker can set
17+
arbitrary environment variables on a system, they have better attack vectors
18+
than making "go env" print them out.
19+
credits:
20+
- Hunter Wittenborn (https://hunterwittenborn.com/)
21+
references:
22+
- fix: https://go.dev/cl/488375
23+
- fix: https://go.dev/cl/493535
24+
- report: https://go.dev/issue/58508
25+
- web: https://groups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJ
26+
cve_metadata:
27+
id: CVE-2023-24531
28+
cwe: 'CWE-138: Improper Neutralization of Special Elements'
29+
source:
30+
id: go-security-team
31+
created: 2024-07-02T12:32:20.378304-04:00
32+
review_status: REVIEWED

0 commit comments

Comments
 (0)