data/reports: add GO-2024-2534.yaml
Aliases: CVE-2023-32192, GHSA-833m-37f7-jq55
Fixes golang/vulndb#2534
Change-Id: I34185c2659485a63b31e0980325208b3bdb76cfd
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/564535
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
diff --git a/data/osv/GO-2024-2534.json b/data/osv/GO-2024-2534.json
new file mode 100644
index 0000000..2f3f6a3
--- /dev/null
+++ b/data/osv/GO-2024-2534.json
@@ -0,0 +1,94 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2024-2534",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2023-32192",
+ "GHSA-833m-37f7-jq55"
+ ],
+ "summary": "Unauthenticated cross-site scripting in github.com/rancher/apiserver",
+ "details": "Unauthenticated cross-site scripting in github.com/rancher/apiserver",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/rancher/apiserver",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "0.0.0-20240207153957-4fd7d821d952"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {
+ "imports": [
+ {
+ "path": "github.com/rancher/apiserver/pkg/writer",
+ "symbols": [
+ "HTMLResponseWriter.Write",
+ "HTMLResponseWriter.WriteList",
+ "HTMLResponseWriter.write"
+ ]
+ },
+ {
+ "path": "github.com/rancher/apiserver/pkg/urlbuilder",
+ "symbols": [
+ "New",
+ "NewPrefixed",
+ "ParseRequestURL"
+ ]
+ }
+ ]
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/apiserver/commit/4df268e250f625fa323349062636496e0aeff4e4"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/apiserver/commit/4e102cf0d07b1af3d10d82c3e5a751a869b8a6c7"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/apiserver/commit/4fd7d821d952510bfe38c9d4a3e2a65157f50525"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/apiserver/commit/69b3c2b56f3fa5a421889c533dada8cd08783cda"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/apiserver/commit/97a10a30200cb851afd8ee85ee6b2295c4b6e5ee"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/apiserver/commit/a3b9e3721c1b558ee63aec9594e37c223a5c8437"
+ }
+ ],
+ "credits": [
+ {
+ "name": "diego95root"
+ },
+ {
+ "name": "kujalamathias"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2024-2534"
+ }
+}
\ No newline at end of file
diff --git a/data/reports/GO-2024-2534.yaml b/data/reports/GO-2024-2534.yaml
new file mode 100644
index 0000000..952b501
--- /dev/null
+++ b/data/reports/GO-2024-2534.yaml
@@ -0,0 +1,35 @@
+id: GO-2024-2534
+modules:
+ - module: github.com/rancher/apiserver
+ versions:
+ - fixed: 0.0.0-20240207153957-4fd7d821d952
+ vulnerable_at: 0.0.0-20240206174200-14e7493da5d3
+ packages:
+ - package: github.com/rancher/apiserver/pkg/writer
+ symbols:
+ - HTMLResponseWriter.write
+ derived_symbols:
+ - HTMLResponseWriter.Write
+ - HTMLResponseWriter.WriteList
+ - package: github.com/rancher/apiserver/pkg/urlbuilder
+ symbols:
+ - ParseRequestURL
+ derived_symbols:
+ - New
+ - NewPrefixed
+summary: Unauthenticated cross-site scripting in github.com/rancher/apiserver
+cves:
+ - CVE-2023-32192
+ghsas:
+ - GHSA-833m-37f7-jq55
+credits:
+ - diego95root
+ - kujalamathias
+references:
+ - advisory: https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55
+ - fix: https://github.com/rancher/apiserver/commit/4df268e250f625fa323349062636496e0aeff4e4
+ - fix: https://github.com/rancher/apiserver/commit/4e102cf0d07b1af3d10d82c3e5a751a869b8a6c7
+ - fix: https://github.com/rancher/apiserver/commit/4fd7d821d952510bfe38c9d4a3e2a65157f50525
+ - fix: https://github.com/rancher/apiserver/commit/69b3c2b56f3fa5a421889c533dada8cd08783cda
+ - fix: https://github.com/rancher/apiserver/commit/97a10a30200cb851afd8ee85ee6b2295c4b6e5ee
+ - fix: https://github.com/rancher/apiserver/commit/a3b9e3721c1b558ee63aec9594e37c223a5c8437
