Skip to content

Commit 35c5446

Browse files
tomoyamachitomoyamachi
authored
add /.vex (#264)
1 parent e3f1396 commit 35c5446

File tree

1 file changed

+236
-0
lines changed

1 file changed

+236
-0
lines changed

‎.vex/dockle.openvex.json‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
{
2+
"@context": "https://openvex.dev/ns/v0.2.0",
3+
"@id": "goodwithtech/dockle:e3f1396fca8b873f997c9fd51e1db455bdc501a8",
4+
"author": "Tomoya AMACHI",
5+
"timestamp": "2024-08-20T15:40:25.683571Z",
6+
"version": 1,
7+
"tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
8+
"statements": [
9+
{
10+
"vulnerability": {
11+
"@id": "https://pkg.go.dev/vuln/GO-2022-0646",
12+
"name": "GO-2022-0646",
13+
"description": "Use of risky cryptographic algorithm in github.com/aws/aws-sdk-go",
14+
"aliases": [
15+
"CVE-2020-8911",
16+
"CVE-2020-8912",
17+
"GHSA-7f33-f4f5-xwgw",
18+
"GHSA-f5pg-7wfw-84q9"
19+
]
20+
},
21+
"products": [
22+
{
23+
"@id": "Unknown Product"
24+
}
25+
],
26+
"status": "not_affected",
27+
"justification": "vulnerable_code_not_present",
28+
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
29+
},
30+
{
31+
"vulnerability": {
32+
"@id": "https://pkg.go.dev/vuln/GO-2024-2512",
33+
"name": "GO-2024-2512",
34+
"description": "Classic builder cache poisoning in github.com/docker/docker",
35+
"aliases": [
36+
"CVE-2024-24557",
37+
"GHSA-xw73-rw38-6vjc"
38+
]
39+
},
40+
"products": [
41+
{
42+
"@id": "Unknown Product"
43+
}
44+
],
45+
"status": "not_affected",
46+
"justification": "vulnerable_code_not_present",
47+
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
48+
},
49+
{
50+
"vulnerability": {
51+
"@id": "https://pkg.go.dev/vuln/GO-2024-2598",
52+
"name": "GO-2024-2598",
53+
"description": "Verify panics on certificates with an unknown public key algorithm in crypto/x509",
54+
"aliases": [
55+
"CVE-2024-24783"
56+
]
57+
},
58+
"products": [
59+
{
60+
"@id": "Unknown Product"
61+
}
62+
],
63+
"status": "under_investigation"
64+
},
65+
{
66+
"vulnerability": {
67+
"@id": "https://pkg.go.dev/vuln/GO-2024-2599",
68+
"name": "GO-2024-2599",
69+
"description": "Memory exhaustion in multipart form parsing in net/textproto and net/http",
70+
"aliases": [
71+
"CVE-2023-45290"
72+
]
73+
},
74+
"products": [
75+
{
76+
"@id": "Unknown Product"
77+
}
78+
],
79+
"status": "under_investigation"
80+
},
81+
{
82+
"vulnerability": {
83+
"@id": "https://pkg.go.dev/vuln/GO-2024-2600",
84+
"name": "GO-2024-2600",
85+
"description": "Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http",
86+
"aliases": [
87+
"CVE-2023-45289"
88+
]
89+
},
90+
"products": [
91+
{
92+
"@id": "Unknown Product"
93+
}
94+
],
95+
"status": "under_investigation"
96+
},
97+
{
98+
"vulnerability": {
99+
"@id": "https://pkg.go.dev/vuln/GO-2024-2609",
100+
"name": "GO-2024-2609",
101+
"description": "Comments in display names are incorrectly handled in net/mail",
102+
"aliases": [
103+
"CVE-2024-24784"
104+
]
105+
},
106+
"products": [
107+
{
108+
"@id": "Unknown Product"
109+
}
110+
],
111+
"status": "not_affected",
112+
"justification": "vulnerable_code_not_present",
113+
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
114+
},
115+
{
116+
"vulnerability": {
117+
"@id": "https://pkg.go.dev/vuln/GO-2024-2610",
118+
"name": "GO-2024-2610",
119+
"description": "Errors returned from JSON marshaling may break template escaping in html/template",
120+
"aliases": [
121+
"CVE-2024-24785"
122+
]
123+
},
124+
"products": [
125+
{
126+
"@id": "Unknown Product"
127+
}
128+
],
129+
"status": "not_affected",
130+
"justification": "vulnerable_code_not_present",
131+
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
132+
},
133+
{
134+
"vulnerability": {
135+
"@id": "https://pkg.go.dev/vuln/GO-2024-2687",
136+
"name": "GO-2024-2687",
137+
"description": "HTTP/2 CONTINUATION flood in net/http",
138+
"aliases": [
139+
"CVE-2023-45288",
140+
"GHSA-4v7x-pqxf-cx7m"
141+
]
142+
},
143+
"products": [
144+
{
145+
"@id": "Unknown Product"
146+
}
147+
],
148+
"status": "under_investigation"
149+
},
150+
{
151+
"vulnerability": {
152+
"@id": "https://pkg.go.dev/vuln/GO-2024-2842",
153+
"name": "GO-2024-2842",
154+
"description": "Unexpected authenticated registry accesses in github.com/containers/image/v5",
155+
"aliases": [
156+
"CVE-2024-3727",
157+
"GHSA-6wvf-f2vw-3425"
158+
]
159+
},
160+
"products": [
161+
{
162+
"@id": "Unknown Product"
163+
}
164+
],
165+
"status": "under_investigation"
166+
},
167+
{
168+
"vulnerability": {
169+
"@id": "https://pkg.go.dev/vuln/GO-2024-2887",
170+
"name": "GO-2024-2887",
171+
"description": "Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip",
172+
"aliases": [
173+
"CVE-2024-24790"
174+
]
175+
},
176+
"products": [
177+
{
178+
"@id": "Unknown Product"
179+
}
180+
],
181+
"status": "under_investigation"
182+
},
183+
{
184+
"vulnerability": {
185+
"@id": "https://pkg.go.dev/vuln/GO-2024-2888",
186+
"name": "GO-2024-2888",
187+
"description": "Mishandling of corrupt central directory record in archive/zip",
188+
"aliases": [
189+
"CVE-2024-24789"
190+
]
191+
},
192+
"products": [
193+
{
194+
"@id": "Unknown Product"
195+
}
196+
],
197+
"status": "not_affected",
198+
"justification": "vulnerable_code_not_present",
199+
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
200+
},
201+
{
202+
"vulnerability": {
203+
"@id": "https://pkg.go.dev/vuln/GO-2024-2963",
204+
"name": "GO-2024-2963",
205+
"description": "Denial of service due to improper 100-continue handling in net/http",
206+
"aliases": [
207+
"CVE-2024-24791"
208+
]
209+
},
210+
"products": [
211+
{
212+
"@id": "Unknown Product"
213+
}
214+
],
215+
"status": "under_investigation"
216+
},
217+
{
218+
"vulnerability": {
219+
"@id": "https://pkg.go.dev/vuln/GO-2024-3005",
220+
"name": "GO-2024-3005",
221+
"description": "Moby authz zero length regression in github.com/moby/moby",
222+
"aliases": [
223+
"CVE-2024-41110"
224+
]
225+
},
226+
"products": [
227+
{
228+
"@id": "Unknown Product"
229+
}
230+
],
231+
"status": "not_affected",
232+
"justification": "vulnerable_code_not_present",
233+
"impact_statement": "Govulncheck determined that the vulnerable code isn't called"
234+
}
235+
]
236+
}

0 commit comments

Comments
 (0)