Skip to content

Commit bb794fc

Browse files
tatianabtatianab
committed
data/excluded,data/reports: review 2 reports, add GO-2024-2983
 - data/excluded/GO-2024-2983.yaml - data/reports/GO-2024-2747.yaml - data/reports/GO-2024-2900.yaml Fixes #2983 Fixes #2747 Fixes #2900 Change-Id: I5780e4654faa189cb5fe052f6a5d203ac35d75db Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/598592 Reviewed-by: Damien Neil <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent dd7900b commit bb794fc

File tree

5 files changed

+74
-33
lines changed

5 files changed

+74
-33
lines changed

‎data/excluded/GO-2024-2983.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
id: GO-2024-2983
2+
excluded: DEPENDENT_VULNERABILITY
3+
modules:
4+
- module: github.com/zitadel/zitadel-go/v3
5+
ghsas:
6+
- GHSA-qc6v-5g5m-8cw2

‎data/osv/GO-2024-2747.json

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
"CVE-2024-32875",
88
"GHSA-ppf8-hhpp-f5hj"
99
],
10-
"summary": "Hugo Markdown titles do not escaped in internal render hooks in github.com/gohugoio/hugo",
11-
"details": "Hugo Markdown titles do not escaped in internal render hooks in github.com/gohugoio/hugo",
10+
"summary": "Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo",
11+
"details": "Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo",
1212
"affected": [
1313
{
1414
"package": {
@@ -28,18 +28,20 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/gohugoio/hugo/hugolib"
35+
}
36+
]
37+
}
3238
}
3339
],
3440
"references": [
3541
{
3642
"type": "ADVISORY",
3743
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj"
3844
},
39-
{
40-
"type": "ADVISORY",
41-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32875"
42-
},
4345
{
4446
"type": "FIX",
4547
"url": "https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1"
@@ -55,6 +57,6 @@
5557
],
5658
"database_specific": {
5759
"url": "https://pkg.go.dev/vuln/GO-2024-2747",
58-
"review_status": "UNREVIEWED"
60+
"review_status": "REVIEWED"
5961
}
6062
}

‎data/osv/GO-2024-2900.json

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"GHSA-c74f-6mfw-mm4v"
99
],
1010
"summary": "Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc",
11-
"details": "Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc",
11+
"details": "An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.",
1212
"affected": [
1313
{
1414
"package": {
@@ -28,7 +28,17 @@
2828
]
2929
}
3030
],
31-
"ecosystem_specific": {}
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "go.opentelemetry.io/collector/config/configgrpc",
35+
"symbols": [
36+
"ClientConfig.ToClientConn",
37+
"getGRPCCompressionName"
38+
]
39+
}
40+
]
41+
}
3242
},
3343
{
3444
"package": {
@@ -48,7 +58,19 @@
4858
]
4959
}
5060
],
51-
"ecosystem_specific": {}
61+
"ecosystem_specific": {
62+
"imports": [
63+
{
64+
"path": "go.opentelemetry.io/collector/config/confighttp",
65+
"symbols": [
66+
"ServerConfig.ToServer",
67+
"clientInfoHandler.ServeHTTP",
68+
"decompressor.ServeHTTP",
69+
"httpContentDecompressor"
70+
]
71+
}
72+
]
73+
}
5274
}
5375
],
5476
"references": [
@@ -57,15 +79,11 @@
5779
"url": "https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v"
5880
},
5981
{
60-
"type": "ADVISORY",
61-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36129"
62-
},
63-
{
64-
"type": "WEB",
82+
"type": "FIX",
6583
"url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10289"
6684
},
6785
{
68-
"type": "WEB",
86+
"type": "FIX",
6987
"url": "https://github.com/open-telemetry/opentelemetry-collector/pull/10323"
7088
},
7189
{
@@ -75,6 +93,6 @@
7593
],
7694
"database_specific": {
7795
"url": "https://pkg.go.dev/vuln/GO-2024-2900",
78-
"review_status": "UNREVIEWED"
96+
"review_status": "REVIEWED"
7997
}
8098
}

‎data/reports/GO-2024-2747.yaml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,21 @@ modules:
33
- module: github.com/gohugoio/hugo
44
versions:
55
- introduced: 0.123.0
6-
fixed: 0.125.3
6+
- fixed: 0.125.3
77
vulnerable_at: 0.125.2
8-
summary: Hugo Markdown titles do not escaped in internal render hooks in github.com/gohugoio/hugo
8+
packages:
9+
- package: github.com/gohugoio/hugo/hugolib
10+
summary: Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
911
cves:
1012
- CVE-2024-32875
1113
ghsas:
1214
- GHSA-ppf8-hhpp-f5hj
1315
references:
1416
- advisory: https://github.com/gohugoio/hugo/security/advisories/GHSA-ppf8-hhpp-f5hj
15-
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-32875
1617
- fix: https://github.com/gohugoio/hugo/commit/15a4b9b33715887001f6eff30721d41c0d4cfdd1
1718
- web: https://github.com/gohugoio/hugo/releases/tag/v0.125.3
1819
- web: https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault
1920
source:
2021
id: GHSA-ppf8-hhpp-f5hj
21-
created: 2024-05-17T16:12:42.192064-04:00
22-
review_status: UNREVIEWED
22+
created: 2024-07-16T11:10:41.124714-04:00
23+
review_status: REVIEWED

‎data/reports/GO-2024-2900.yaml

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,40 @@ modules:
44
versions:
55
- fixed: 0.102.1
66
vulnerable_at: 0.102.0
7+
packages:
8+
- package: go.opentelemetry.io/collector/config/configgrpc
9+
symbols:
10+
- getGRPCCompressionName
11+
derived_symbols:
12+
- ClientConfig.ToClientConn
713
- module: go.opentelemetry.io/collector/config/confighttp
814
versions:
915
- fixed: 0.102.0
1016
vulnerable_at: 0.101.0
11-
summary: Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc
17+
packages:
18+
- package: go.opentelemetry.io/collector/config/confighttp
19+
symbols:
20+
- httpContentDecompressor
21+
- decompressor.ServeHTTP
22+
- ServerConfig.ToServer
23+
derived_symbols:
24+
- clientInfoHandler.ServeHTTP
25+
summary: |-
26+
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in
27+
go.opentelemetry.io/collector/config/configgrpc
28+
description: |-
29+
An unsafe decompression vulnerability allows unauthenticated attackers to crash
30+
the collector via excessive memory consumption.
1231
cves:
1332
- CVE-2024-36129
1433
ghsas:
1534
- GHSA-c74f-6mfw-mm4v
16-
unknown_aliases:
17-
- CGA-6j3r-jg3v-43qf
18-
- CGA-c8pv-52m7-2mhm
19-
- CGA-f48r-hvmp-wx9g
2035
references:
2136
- advisory: https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
22-
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-36129
23-
- web: https://github.com/open-telemetry/opentelemetry-collector/pull/10289
24-
- web: https://github.com/open-telemetry/opentelemetry-collector/pull/10323
37+
- fix: https://github.com/open-telemetry/opentelemetry-collector/pull/10289
38+
- fix: https://github.com/open-telemetry/opentelemetry-collector/pull/10323
2539
- web: https://opentelemetry.io/blog/2024/cve-2024-36129
2640
source:
2741
id: GHSA-c74f-6mfw-mm4v
28-
created: 2024-06-26T14:08:43.597373-04:00
29-
review_status: UNREVIEWED
42+
created: 2024-07-16T10:53:58.646682-04:00
43+
review_status: REVIEWED

0 commit comments

Comments
 (0)