Skip to content

Commit 6b8d768

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: review 3 reports, add 2 reports
 - data/reports/GO-2024-2491.yaml - data/reports/GO-2024-2698.yaml - data/reports/GO-2024-2785.yaml - data/reports/GO-2024-2912.yaml - data/reports/GO-2024-2918.yaml Updates #2491 Updates #2698 Updates #2785 Fixes #2912 Fixes #2918 Change-Id: I296bb2155b7a3ad7b8f8e7e3f1cc829a159c6cc8 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/595960 Auto-Submit: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]>
1 parent 76e28a5 commit 6b8d768

10 files changed

+343
-61
lines changed

‎data/osv/GO-2024-2491.json

Lines changed: 36 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
"CVE-2024-21626",
88
"GHSA-xr7r-f8xq-vfvv"
99
],
10-
"summary": "runc vulnerable to container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
11-
"details": "runc vulnerable to container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
10+
"summary": "Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
11+
"details": "Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc",
1212
"affected": [
1313
{
1414
"package": {
@@ -28,53 +28,62 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/opencontainers/runc/libcontainer/utils",
35+
"symbols": [
36+
"CloseExecFrom"
37+
]
38+
},
39+
{
40+
"path": "github.com/opencontainers/runc/libcontainer/cgroups",
41+
"symbols": [
42+
"openFile",
43+
"prepareOpenat2"
44+
]
45+
},
46+
{
47+
"path": "github.com/opencontainers/runc/libcontainer",
48+
"symbols": [
49+
"Container.start",
50+
"Init",
51+
"finalizeNamespace",
52+
"linuxSetnsInit.Init",
53+
"linuxStandardInit.Init"
54+
]
55+
}
56+
]
57+
}
3258
}
3359
],
3460
"references": [
3561
{
3662
"type": "ADVISORY",
3763
"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv"
3864
},
39-
{
40-
"type": "ADVISORY",
41-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21626"
42-
},
4365
{
4466
"type": "FIX",
4567
"url": "https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf"
4668
},
4769
{
4870
"type": "WEB",
4971
"url": "http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html"
50-
},
51-
{
52-
"type": "WEB",
53-
"url": "http://www.openwall.com/lists/oss-security/2024/02/01/1"
54-
},
55-
{
56-
"type": "WEB",
57-
"url": "http://www.openwall.com/lists/oss-security/2024/02/02/3"
58-
},
59-
{
60-
"type": "WEB",
61-
"url": "https://github.com/opencontainers/runc/releases/tag/v1.1.12"
62-
},
72+
}
73+
],
74+
"credits": [
6375
{
64-
"type": "WEB",
65-
"url": "https://lists.debian.org/debian-lts-announce/2024/02/msg00005.html"
76+
"name": "Rory McNamara from Snyk"
6677
},
6778
{
68-
"type": "WEB",
69-
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/2NLXNE23Q5ESQUAI22Z7A63JX2WMPJ2J"
79+
"name": "@lifubang from acmcoder"
7080
},
7181
{
72-
"type": "WEB",
73-
"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/SYMO3BANINS6RGFQFKPRG4FIOJ7GWYTL"
82+
"name": "Aleksa Sarai from SUSE"
7483
}
7584
],
7685
"database_specific": {
7786
"url": "https://pkg.go.dev/vuln/GO-2024-2491",
78-
"review_status": "UNREVIEWED"
87+
"review_status": "REVIEWED"
7988
}
8089
}

‎data/osv/GO-2024-2698.json

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"GHSA-rhh4-rh7c-7r5v"
99
],
1010
"summary": "Archiver Path Traversal vulnerability in github.com/mholt/archiver",
11-
"details": "Archiver Path Traversal vulnerability in github.com/mholt/archiver",
11+
"details": "A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.",
1212
"affected": [
1313
{
1414
"package": {
@@ -50,10 +50,6 @@
5050
"type": "ADVISORY",
5151
"url": "https://github.com/advisories/GHSA-rhh4-rh7c-7r5v"
5252
},
53-
{
54-
"type": "ADVISORY",
55-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0406"
56-
},
5753
{
5854
"type": "WEB",
5955
"url": "https://access.redhat.com/security/cve/CVE-2024-0406"
@@ -65,6 +61,6 @@
6561
],
6662
"database_specific": {
6763
"url": "https://pkg.go.dev/vuln/GO-2024-2698",
68-
"review_status": "UNREVIEWED"
64+
"review_status": "REVIEWED"
6965
}
7066
}

‎data/osv/GO-2024-2785.json

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"GHSA-m9w6-wp3h-vq8g"
99
],
1010
"summary": "CoreDNS may return invalid cache entries in github.com/coredns/coredns",
11-
"details": "CoreDNS may return invalid cache entries in github.com/coredns/coredns",
11+
"details": "A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching.",
1212
"affected": [
1313
{
1414
"package": {
@@ -28,18 +28,30 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/coredns/coredns/plugin/cache",
35+
"symbols": [
36+
"Cache.ServeDNS",
37+
"Cache.exists",
38+
"Cache.getIgnoreTTL",
39+
"ResponseWriter.WriteMsg",
40+
"hash",
41+
"key",
42+
"newPrefetchResponseWriter",
43+
"verifyStaleResponseWriter.WriteMsg"
44+
]
45+
}
46+
]
47+
}
3248
}
3349
],
3450
"references": [
3551
{
3652
"type": "ADVISORY",
3753
"url": "https://github.com/advisories/GHSA-m9w6-wp3h-vq8g"
3854
},
39-
{
40-
"type": "ADVISORY",
41-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0874"
42-
},
4355
{
4456
"type": "FIX",
4557
"url": "https://github.com/coredns/coredns/commit/997c7f953962d47c242273f0e41398fdfb5b0151"
@@ -52,6 +64,10 @@
5264
"type": "REPORT",
5365
"url": "https://github.com/coredns/coredns/issues/6186"
5466
},
67+
{
68+
"type": "WEB",
69+
"url": "https://access.redhat.com/errata/RHSA-2024:0041"
70+
},
5571
{
5672
"type": "WEB",
5773
"url": "https://access.redhat.com/security/cve/CVE-2024-0874"
@@ -63,6 +79,6 @@
6379
],
6480
"database_specific": {
6581
"url": "https://pkg.go.dev/vuln/GO-2024-2785",
66-
"review_status": "UNREVIEWED"
82+
"review_status": "REVIEWED"
6783
}
6884
}

‎data/osv/GO-2024-2912.json

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2912",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2021-41092",
8+
"GHSA-99pg-grm5-qq3v"
9+
],
10+
"summary": "Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli",
11+
"details": "Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/docker/cli",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "20.10.9+incompatible"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/docker/cli/command",
35+
"symbols": [
36+
"GetDefaultAuthConfig",
37+
"RegistryAuthenticationPrivilegedFunc"
38+
]
39+
},
40+
{
41+
"path": "github.com/docker/cli/command/registry",
42+
"symbols": [
43+
"runLogin"
44+
]
45+
}
46+
]
47+
}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b"
58+
}
59+
],
60+
"database_specific": {
61+
"url": "https://pkg.go.dev/vuln/GO-2024-2912",
62+
"review_status": "REVIEWED"
63+
}
64+
}

‎data/osv/GO-2024-2918.json

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2918",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-35255",
8+
"GHSA-m5vv-6r4h-3vj9"
9+
],
10+
"summary": "Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
11+
"details": "Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.6.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/Azure/azure-sdk-for-go/sdk/azidentity",
35+
"symbols": [
36+
"AzurePipelinesCredential.GetToken",
37+
"ChainedTokenCredential.GetToken",
38+
"ClientAssertionCredential.GetToken",
39+
"ClientCertificateCredential.GetToken",
40+
"ClientSecretCredential.GetToken",
41+
"DefaultAzureCredential.GetToken",
42+
"EnvironmentCredential.GetToken",
43+
"ManagedIdentityCredential.GetToken",
44+
"NewDefaultAzureCredential",
45+
"NewManagedIdentityCredential",
46+
"OnBehalfOfCredential.GetToken",
47+
"WorkloadIdentityCredential.GetToken",
48+
"confidentialClient.GetToken",
49+
"managedIdentityClient.authenticate",
50+
"managedIdentityClient.createAccessToken",
51+
"managedIdentityClient.createAppServiceAuthRequest",
52+
"managedIdentityClient.createAzureArcAuthRequest",
53+
"managedIdentityClient.createAzureMLAuthRequest",
54+
"managedIdentityClient.createCloudShellAuthRequest",
55+
"managedIdentityClient.createIMDSAuthRequest",
56+
"managedIdentityClient.createServiceFabricAuthRequest",
57+
"managedIdentityClient.getAzureArcSecretKey",
58+
"newManagedIdentityClient"
59+
]
60+
}
61+
]
62+
}
63+
}
64+
],
65+
"references": [
66+
{
67+
"type": "ADVISORY",
68+
"url": "https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"
69+
},
70+
{
71+
"type": "FIX",
72+
"url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
81+
}
82+
],
83+
"database_specific": {
84+
"url": "https://pkg.go.dev/vuln/GO-2024-2918",
85+
"review_status": "REVIEWED"
86+
}
87+
}

0 commit comments

Comments
 (0)