Skip to content

Commit 7313605

Browse files
tatianabtatianab
committed
data/reports: add 2 reviewed reports
 - data/reports/GO-2024-2977.yaml - data/reports/GO-2024-2978.yaml Fixes #2977 Fixes #2978 Change-Id: I6a664826f87b1dc9c586871e5ade8683b31e4ccd Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/597159 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Tim King <[email protected]>
1 parent 1b6716a commit 7313605

File tree

4 files changed

+183
-0
lines changed

4 files changed

+183
-0
lines changed

‎data/osv/GO-2024-2977.json

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2977",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-6284",
8+
"GHSA-qjvf-8748-9w7h"
9+
],
10+
"summary": "IP addresses were encoded in the wrong byte order in github.com/google/nftables",
11+
"details": "IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which did not work as intended (might block or not block the desired addresses).",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/google/nftables",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0.1.0"
24+
},
25+
{
26+
"fixed": "0.2.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/google/nftables",
35+
"symbols": [
36+
"Conn.AddSet"
37+
]
38+
}
39+
]
40+
}
41+
}
42+
],
43+
"references": [
44+
{
45+
"type": "ADVISORY",
46+
"url": "https://github.com/advisories/GHSA-qjvf-8748-9w7h"
47+
},
48+
{
49+
"type": "FIX",
50+
"url": "https://github.com/google/nftables/commit/b1f901b05510bed05c232c5049f68d1511b56a19"
51+
},
52+
{
53+
"type": "REPORT",
54+
"url": "https://github.com/google/nftables/issues/225"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://bugs.launchpad.net/ubuntu/+source/crowdsec-firewall-bouncer/+bug/2069596"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/crowdsecurity/cs-firewall-bouncer/issues/368"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2024-2977",
67+
"review_status": "REVIEWED"
68+
}
69+
}

‎data/osv/GO-2024-2978.json

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2978",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-xr7q-jx4m-x55m"
8+
],
9+
"summary": "Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc",
10+
"details": "If applications print or log a context containing gRPC metadata, the output will contain all the metadata, which may include private information. This represents a potential PII concern.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "google.golang.org/grpc",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "1.64.0"
23+
},
24+
{
25+
"fixed": "1.64.1"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {
31+
"imports": [
32+
{
33+
"path": "google.golang.org/grpc/metadata",
34+
"symbols": [
35+
"MD.String"
36+
]
37+
}
38+
]
39+
}
40+
}
41+
],
42+
"references": [
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-xr7q-jx4m-x55m"
46+
},
47+
{
48+
"type": "FIX",
49+
"url": "https://github.com/grpc/grpc-go/commit/ab292411ddc0f3b7a7786754d1fe05264c3021eb"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2024-2978",
54+
"review_status": "REVIEWED"
55+
}
56+
}

‎data/reports/GO-2024-2977.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: GO-2024-2977
2+
modules:
3+
- module: github.com/google/nftables
4+
versions:
5+
- introduced: 0.1.0
6+
- fixed: 0.2.0
7+
vulnerable_at: 0.1.0
8+
packages:
9+
- package: github.com/google/nftables
10+
symbols:
11+
- Conn.AddSet
12+
skip_fix: 'errors of the form ''undefined: unix.*'''
13+
summary: IP addresses were encoded in the wrong byte order in github.com/google/nftables
14+
description: |-
15+
IP addresses were encoded in the wrong byte order, resulting in an nftables
16+
configuration which did not work as intended (might block or not block the
17+
desired addresses).
18+
cves:
19+
- CVE-2024-6284
20+
ghsas:
21+
- GHSA-qjvf-8748-9w7h
22+
references:
23+
- advisory: https://github.com/advisories/GHSA-qjvf-8748-9w7h
24+
- fix: https://github.com/google/nftables/commit/b1f901b05510bed05c232c5049f68d1511b56a19
25+
- report: https://github.com/google/nftables/issues/225
26+
- web: https://bugs.launchpad.net/ubuntu/+source/crowdsec-firewall-bouncer/+bug/2069596
27+
- web: https://github.com/crowdsecurity/cs-firewall-bouncer/issues/368
28+
source:
29+
id: GHSA-qjvf-8748-9w7h
30+
created: 2024-07-08T13:23:25.436858-04:00
31+
review_status: REVIEWED

‎data/reports/GO-2024-2978.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
id: GO-2024-2978
2+
modules:
3+
- module: google.golang.org/grpc
4+
versions:
5+
- introduced: 1.64.0
6+
- fixed: 1.64.1
7+
vulnerable_at: 1.64.0
8+
packages:
9+
- package: google.golang.org/grpc/metadata
10+
symbols:
11+
- MD.String
12+
summary: |-
13+
Private tokens could appear in logs if context containing gRPC metadata is
14+
logged in google.golang.org/grpc
15+
description: |
16+
If applications print or log a context containing gRPC metadata, the
17+
output will contain all the metadata, which may include private
18+
information. This represents a potential PII concern.
19+
ghsas:
20+
- GHSA-xr7q-jx4m-x55m
21+
references:
22+
- advisory: https://github.com/grpc/grpc-go/security/advisories/GHSA-xr7q-jx4m-x55m
23+
- fix: https://github.com/grpc/grpc-go/commit/ab292411ddc0f3b7a7786754d1fe05264c3021eb
24+
source:
25+
id: GHSA-xr7q-jx4m-x55m
26+
created: 2024-07-08T13:23:23.725948-04:00
27+
review_status: REVIEWED

0 commit comments

Comments
 (0)