internal/report: add result of Fix to test output for CVEs
Updates tests and golden files for CVE creation to reflect
the whole process, including running Fix.
Change-Id: Ib65482a165dc3e20d1b070fb837d4eae3ac0ff7d
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/579856
Commit-Queue: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
diff --git a/internal/report/cve.go b/internal/report/cve.go
index b7c37cb..42f41bc 100644
--- a/internal/report/cve.go
+++ b/internal/report/cve.go
@@ -36,12 +36,6 @@
// CVEToReport creates a Report struct from a given CVE and modulePath.
func CVEToReport(c *cveschema.CVE, id, modulePath string, pc *proxy.Client) *Report {
- r := cveToReport(c, id, modulePath)
- r.Fix(pc)
- return r
-}
-
-func cveToReport(c *cveschema.CVE, id, modulePath string) *Report {
var description Description
for _, d := range c.Description.Data {
description += Description(d.Value + "\n")
@@ -87,6 +81,8 @@
},
}
r.addCVE(c.Metadata.ID, getCWE(c), isGoCNA(c))
+
+ r.Fix(pc)
return r
}
@@ -113,12 +109,6 @@
}
func CVE5ToReport(c *cveschema5.CVERecord, id, modulePath string, pc *proxy.Client) *Report {
- r := cve5ToReport(c, id, modulePath)
- r.Fix(pc)
- return r
-}
-
-func cve5ToReport(c *cveschema5.CVERecord, id, modulePath string) *Report {
cna := c.Containers.CNAContainer
var description Description
@@ -151,6 +141,7 @@
}
r.addCVE(c.Metadata.ID, getCWE5(&cna), isGoCNA5(&cna))
+ r.Fix(pc)
return r
}
diff --git a/internal/report/cve_test.go b/internal/report/cve_test.go
index a18ccf0..41c62f5 100644
--- a/internal/report/cve_test.go
+++ b/internal/report/cve_test.go
@@ -22,6 +22,7 @@
"golang.org/x/vulndb/internal/cveschema"
"golang.org/x/vulndb/internal/cveschema5"
"golang.org/x/vulndb/internal/gitrepo"
+ "golang.org/x/vulndb/internal/proxy"
"golang.org/x/vulndb/internal/test"
"gopkg.in/yaml.v3"
)
@@ -81,11 +82,16 @@
const placeholderID = "PLACEHOLDER-ID"
func TestCVEToReport(t *testing.T) {
+ pc, err := proxy.NewTestClient(t, *realProxy)
+ if err != nil {
+ t.Fatal(err)
+ }
+
newV4 := func() cvelistrepo.CVE {
return new(cveschema.CVE)
}
toReportV4 := func(cve cvelistrepo.CVE, modulePath string) *Report {
- return cveToReport(cve.(*cveschema.CVE), placeholderID, modulePath)
+ return CVEToReport(cve.(*cveschema.CVE), placeholderID, modulePath, pc)
}
if err := run(t, v4txtar, newV4, toReportV4); err != nil {
t.Fatal(err)
@@ -93,11 +99,16 @@
}
func TestCVE5ToReport(t *testing.T) {
+ pc, err := proxy.NewTestClient(t, *realProxy)
+ if err != nil {
+ t.Fatal(err)
+ }
+
newV5 := func() cvelistrepo.CVE {
return new(cveschema5.CVERecord)
}
toReportV5 := func(cve cvelistrepo.CVE, modulePath string) *Report {
- return cve5ToReport(cve.(*cveschema5.CVERecord), placeholderID, modulePath)
+ return CVE5ToReport(cve.(*cveschema5.CVERecord), placeholderID, modulePath, pc)
}
if err := run(t, v5txtar, newV5, toReportV5); err != nil {
t.Fatal(err)
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2020-9283.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2020-9283.txtar
index 615d1d1..a830a6c 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2020-9283.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2020-9283.txtar
@@ -8,10 +8,15 @@
id: PLACEHOLDER-ID
modules:
- module: golang.org/x/crypto
+ vulnerable_at: 0.22.0
packages:
- package: golang.org/x/crypto
-description: |
- golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
+summary: CVE-2020-9283 in golang.org/x/crypto
+description: |-
+ golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a
+ panic during signature verification in the golang.org/x/crypto/ssh package. A
+ client can attack an SSH server that accepts public keys. Also, a server can
+ attack any SSH client.
cves:
- CVE-2020-9283
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-27919.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-27919.txtar
index 10ba52c..606ab29 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-27919.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-27919.txtar
@@ -10,8 +10,11 @@
- module: std
packages:
- package: archive/zip
-description: |
- archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
+summary: CVE-2021-27919 in archive/zip
+description: |-
+ archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of
+ service (panic) upon attempted use of the Reader.Open API for a ZIP archive in
+ which ../ occurs at the beginning of any filename.
cves:
- CVE-2021-27919
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-3115.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-3115.txtar
index 7e5c3cf..85b0f83 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-3115.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2021-3115.txtar
@@ -10,13 +10,17 @@
- module: cmd
packages:
- package: cmd/go
-description: |
- Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
+summary: CVE-2021-3115 in cmd
+description: |-
+ Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command
+ Injection and remote code execution when using the "go get" command to fetch
+ modules that make use of cgo (for example, cgo can execute a gcc program from an
+ untrusted download).
cves:
- CVE-2021-3115
references:
- web: https://groups.google.com/g/golang-announce/c/mperVMGa98w
- - web: https://blog.golang.org/path-security
+ - web: https://blog.go.dev/path-security
- web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
- web: https://security.netapp.com/advisory/ntap-20210219-0001/
- web: https://security.gentoo.org/glsa/202208-02
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2022-39213.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2022-39213.txtar
index c301030..4e065d0 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2022-39213.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2022-39213.txtar
@@ -11,11 +11,24 @@
versions:
- introduced: 0.2.0
fixed: 0.4.0
+ vulnerable_at: 0.3.0
packages:
- package: github.com/pandatix/go-cvss
-summary: Out-of-bounds Read in go-cvss
-description: |
- go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag `v0.4.0`, by the commit `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As stated in [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the CPE v2.3 to refer to this Go module is `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been requested to the NVD CPE dictionary.
+summary: Out-of-bounds Read in go-cvss in github.com/pandatix/go-cvss
+description: |-
+ go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS).
+ In affected versions when a full CVSS v2.0 vector string is parsed using
+ `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go
+ module will then panic. The problem is patched in tag `v0.4.0`, by the commit
+ `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users
+ unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings
+ that do not have all attributes defined (e.g.
+ `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As
+ stated in
+ [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the
+ CPE v2.3 to refer to this Go module is
+ `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been
+ requested to the NVD CPE dictionary.
cves:
- CVE-2022-39213
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-29407.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-29407.txtar
index 809fdd7..47ef77f 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-29407.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-29407.txtar
@@ -10,15 +10,20 @@
- module: golang.org/x/image
versions:
- fixed: 0.10.0
+ vulnerable_at: 0.9.0
packages:
- package: golang.org/x/image/tiff
symbols:
- newDecoder
- Decode
- DecodeConfig
-summary: Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
-description: |
- A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
+summary: |-
+ Excessive CPU consumption when decoding 0-height images in
+ golang.org/x/image/tiff
+description: |-
+ A maliciously-crafted image can cause excessive CPU consumption in decoding. A
+ tiled image with a height of 0 and a very large width can cause excessive CPU
+ consumption, despite the image size (width * height) appearing to be zero.
credits:
- Philippe Antoine (Catena cyber)
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-44378.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-44378.txtar
index 11efcfa..5ff54bd 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-44378.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-44378.txtar
@@ -12,9 +12,18 @@
- fixed: 0.9.0
packages:
- package: github.com/Consensys/gnark
-summary: gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition
-description: |
- gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values there exists a second decomposition for `a+r` (where `r` is the modulus the values are being reduced by). The second decomposition was possible due to overflowing the field where the values are defined. Upgrading to version 0.9.0 should fix the issue without needing to change the calls to value comparison methods.
+summary: |-
+ gnark vulnerable to unsoundness in variable comparison/non-unique binary
+ decomposition in github.com/Consensys/gnark
+description: |-
+ gnark is a zk-SNARK library that offers a high-level API to design circuits.
+ Prior to version 0.9.0, for some in-circuit values, it is possible to construct
+ two valid decomposition to bits. In addition to the canonical decomposition of
+ `a`, for small values there exists a second decomposition for `a+r` (where `r`
+ is the modulus the values are being reduced by). The second decomposition was
+ possible due to overflowing the field where the values are defined. Upgrading to
+ version 0.9.0 should fix the issue without needing to change the calls to value
+ comparison methods.
cves:
- CVE-2023-44378
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45141.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45141.txtar
index 22cb878..af3261d 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45141.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45141.txtar
@@ -12,9 +12,18 @@
- fixed: 2.50.0
packages:
- package: github.com/gofiber/fiber
-summary: CSRF Token Validation Vulnerability in fiber
-description: |
- Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
+summary: CSRF Token Validation Vulnerability in fiber in github.com/gofiber/fiber
+description: |-
+ Fiber is an express inspired web framework written in Go. A Cross-Site Request
+ Forgery (CSRF) vulnerability has been identified in the application, which
+ allows an attacker to obtain tokens and forge malicious requests on behalf of a
+ user. This can lead to unauthorized actions being taken on the user's behalf,
+ potentially compromising the security and integrity of the application. The
+ vulnerability is caused by improper validation and enforcement of CSRF tokens
+ within the application. This vulnerability has been addressed in version 2.50.0
+ and users are advised to upgrade. Users should take additional security measures
+ like captchas or Two-Factor Authentication (2FA) and set Session cookies with
+ SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
cves:
- CVE-2023-45141
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45283.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45283.txtar
index cf7ce52..fc4217c 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45283.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45283.txtar
@@ -70,8 +70,21 @@
- Walk
- WalkDir
summary: Insecure parsing of Windows paths with a \??\ prefix in path/filepath
-description: |
- The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
+description: |-
+ The filepath package does not recognize paths with a \??\ prefix as special. On
+ Windows, a path beginning with \??\ is a Root Local Device path equivalent to a
+ path beginning with \\?\. Paths with a \??\ prefix may be used to access
+ arbitrary locations on the system. For example, the path \??\c:\x is equivalent
+ to the more common path c:\x. Before fix, Clean could convert a rooted path such
+ as \a\..\??\b into the root local device path \??\b. Clean will now convert this
+ to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence
+ of path elements into the root local device path \??\b. Join will now convert
+ this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths
+ beginning with \??\ as absolute, and VolumeName correctly reports the \??\
+ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed
+ the definition of the volume name in Windows paths starting with \?, resulting
+ in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other
+ effects). The previous behavior has been restored.
references:
- report: https://go.dev/issue/63713
- fix: https://go.dev/cl/540277
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45285.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45285.txtar
index 9c0328b..834bff6 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45285.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45285.txtar
@@ -15,8 +15,12 @@
packages:
- package: cmd/go
summary: Command 'go get' may unexpectedly fallback to insecure git in cmd/go
-description: |
- Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
+description: |-
+ Using go get to fetch a module with the ".git" suffix may unexpectedly fallback
+ to the insecure "git://" protocol if the module is unavailable via the secure
+ "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said
+ module. This only affects users who are not using the module proxy and are
+ fetching modules directly (i.e. GOPROXY=off).
credits:
- David Leadbeater
references:
diff --git a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45286.txtar b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45286.txtar
index a6ee0b9..a7651fc 100644
--- a/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45286.txtar
+++ b/internal/report/testdata/cve/TestCVE5ToReport/CVE-2023-45286.txtar
@@ -11,6 +11,7 @@
unsupported_versions:
- version: 'unaffected from 0 before 2.10.0 (default: affected)'
type: cve_version_range
+ vulnerable_at: 2.12.0
packages:
- package: github.com/go-resty/resty/v2
symbols:
@@ -26,8 +27,16 @@
- Request.Put
- Request.Send
summary: HTTP request body disclosure in github.com/go-resty/resty/v2
-description: |
- A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
+description: |-
+ A race condition in go-resty can result in HTTP request body disclosure across
+ requests. This condition can be triggered by calling sync.Pool.Put with the same
+ *bytes.Buffer more than once, when request retries are enabled and a retry
+ occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't
+ had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP
+ request body from an unrelated request, and go-resty will append the current
+ HTTP request body to it, sending two bodies in one request. The sync.Pool in
+ question is defined at package level scope, so a completely unrelated server
+ could receive the request body.
credits:
- Logan Attwood (@lattwood)
references:
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2020-9283.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2020-9283.txtar
index 0716c01..5bf0aac 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2020-9283.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2020-9283.txtar
@@ -8,10 +8,15 @@
id: PLACEHOLDER-ID
modules:
- module: golang.org/x/crypto
+ vulnerable_at: 0.22.0
packages:
- package: n/a
-description: |
- golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
+summary: CVE-2020-9283 in golang.org/x/crypto
+description: |-
+ golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a
+ panic during signature verification in the golang.org/x/crypto/ssh package. A
+ client can attack an SSH server that accepts public keys. Also, a server can
+ attack any SSH client.
cves:
- CVE-2020-9283
references:
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2021-27919.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2021-27919.txtar
index 8bac068..d44ad14 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2021-27919.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2021-27919.txtar
@@ -10,8 +10,11 @@
- module: std
packages:
- package: archive/zip
-description: |
- archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
+summary: CVE-2021-27919 in archive/zip
+description: |-
+ archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of
+ service (panic) upon attempted use of the Reader.Open API for a ZIP archive in
+ which ../ occurs at the beginning of any filename.
cves:
- CVE-2021-27919
references:
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2021-3115.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2021-3115.txtar
index 3b9dfb5..4d0a5c5 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2021-3115.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2021-3115.txtar
@@ -10,13 +10,17 @@
- module: std
packages:
- package: cmd/go
-description: |
- Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
+summary: CVE-2021-3115 in cmd/go
+description: |-
+ Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command
+ Injection and remote code execution when using the "go get" command to fetch
+ modules that make use of cgo (for example, cgo can execute a gcc program from an
+ untrusted download).
cves:
- CVE-2021-3115
references:
- web: https://groups.google.com/g/golang-announce/c/mperVMGa98w
- - web: https://blog.golang.org/path-security
+ - web: https://blog.go.dev/path-security
- web: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/
- web: https://security.netapp.com/advisory/ntap-20210219-0001/
- web: https://security.gentoo.org/glsa/202208-02
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2022-39213.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2022-39213.txtar
index 5d2e9dc..ccda160 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2022-39213.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2022-39213.txtar
@@ -8,10 +8,24 @@
id: PLACEHOLDER-ID
modules:
- module: github.com/pandatix/go-cvss
+ vulnerable_at: 0.6.2
packages:
- package: go-cvss
-description: |
- go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag `v0.4.0`, by the commit `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As stated in [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the CPE v2.3 to refer to this Go module is `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been requested to the NVD CPE dictionary.
+summary: CVE-2022-39213 in github.com/pandatix/go-cvss
+description: |-
+ go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS).
+ In affected versions when a full CVSS v2.0 vector string is parsed using
+ `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go
+ module will then panic. The problem is patched in tag `v0.4.0`, by the commit
+ `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users
+ unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings
+ that do not have all attributes defined (e.g.
+ `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As
+ stated in
+ [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the
+ CPE v2.3 to refer to this Go module is
+ `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been
+ requested to the NVD CPE dictionary.
cves:
- CVE-2022-39213
references:
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-29407.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-29407.txtar
index 15bf74a..959c21e 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-29407.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-29407.txtar
@@ -8,10 +8,14 @@
id: PLACEHOLDER-ID
modules:
- module: golang.org/x/image
+ vulnerable_at: 0.15.0
packages:
- package: golang.org/x/image/tiff
-description: |
- A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
+summary: CVE-2023-29407 in golang.org/x/image
+description: |-
+ A maliciously-crafted image can cause excessive CPU consumption in decoding. A
+ tiled image with a height of 0 and a very large width can cause excessive CPU
+ consumption, despite the image size (width * height) appearing to be zero.
references:
- report: https://go.dev/issue/61581
- fix: https://go.dev/cl/514897
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-44378.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-44378.txtar
index 5db8c2f..ddcf794 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-44378.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-44378.txtar
@@ -8,10 +8,19 @@
id: PLACEHOLDER-ID
modules:
- module: github.com/Consensys/gnark
+ vulnerable_at: 0.9.1
packages:
- package: gnark
-description: |
- gnark is a zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.9.0, for some in-circuit values, it is possible to construct two valid decomposition to bits. In addition to the canonical decomposition of `a`, for small values there exists a second decomposition for `a+r` (where `r` is the modulus the values are being reduced by). The second decomposition was possible due to overflowing the field where the values are defined. Upgrading to version 0.9.0 should fix the issue without needing to change the calls to value comparison methods.
+summary: CVE-2023-44378 in github.com/Consensys/gnark
+description: |-
+ gnark is a zk-SNARK library that offers a high-level API to design circuits.
+ Prior to version 0.9.0, for some in-circuit values, it is possible to construct
+ two valid decomposition to bits. In addition to the canonical decomposition of
+ `a`, for small values there exists a second decomposition for `a+r` (where `r`
+ is the modulus the values are being reduced by). The second decomposition was
+ possible due to overflowing the field where the values are defined. Upgrading to
+ version 0.9.0 should fix the issue without needing to change the calls to value
+ comparison methods.
cves:
- CVE-2023-44378
references:
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45141.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45141.txtar
index 4a0e9cb..6824202 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45141.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45141.txtar
@@ -8,10 +8,21 @@
id: PLACEHOLDER-ID
modules:
- module: github.com/gofiber/fiber
+ vulnerable_at: 1.14.6
packages:
- package: fiber
-description: |
- Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
+summary: CVE-2023-45141 in github.com/gofiber/fiber
+description: |-
+ Fiber is an express inspired web framework written in Go. A Cross-Site Request
+ Forgery (CSRF) vulnerability has been identified in the application, which
+ allows an attacker to obtain tokens and forge malicious requests on behalf of a
+ user. This can lead to unauthorized actions being taken on the user's behalf,
+ potentially compromising the security and integrity of the application. The
+ vulnerability is caused by improper validation and enforcement of CSRF tokens
+ within the application. This vulnerability has been addressed in version 2.50.0
+ and users are advised to upgrade. Users should take additional security measures
+ like captchas or Two-Factor Authentication (2FA) and set Session cookies with
+ SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
cves:
- CVE-2023-45141
references:
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45283.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45283.txtar
index e0ea2d2..7605417 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45283.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45283.txtar
@@ -10,8 +10,22 @@
- module: std
packages:
- package: path/filepath
-description: |
- The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
+summary: CVE-2023-45283 in path/filepath
+description: |-
+ The filepath package does not recognize paths with a \??\ prefix as special. On
+ Windows, a path beginning with \??\ is a Root Local Device path equivalent to a
+ path beginning with \\?\. Paths with a \??\ prefix may be used to access
+ arbitrary locations on the system. For example, the path \??\c:\x is equivalent
+ to the more common path c:\x. Before fix, Clean could convert a rooted path such
+ as \a\..\??\b into the root local device path \??\b. Clean will now convert this
+ to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence
+ of path elements into the root local device path \??\b. Join will now convert
+ this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths
+ beginning with \??\ as absolute, and VolumeName correctly reports the \??\
+ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed
+ the definition of the volume name in Windows paths starting with \?, resulting
+ in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other
+ effects). The previous behavior has been restored.
references:
- report: https://go.dev/issue/63713
- fix: https://go.dev/cl/540277
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45285.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45285.txtar
index 3deb790..da94dec 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45285.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45285.txtar
@@ -10,8 +10,13 @@
- module: std
packages:
- package: cmd/go
-description: |
- Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
+summary: CVE-2023-45285 in cmd/go
+description: |-
+ Using go get to fetch a module with the ".git" suffix may unexpectedly fallback
+ to the insecure "git://" protocol if the module is unavailable via the secure
+ "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said
+ module. This only affects users who are not using the module proxy and are
+ fetching modules directly (i.e. GOPROXY=off).
references:
- web: https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- report: https://go.dev/issue/63845
diff --git a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45286.txtar b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45286.txtar
index 98e6280..ad6fd36 100644
--- a/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45286.txtar
+++ b/internal/report/testdata/cve/TestCVEToReport/CVE-2023-45286.txtar
@@ -8,10 +8,20 @@
id: PLACEHOLDER-ID
modules:
- module: github.com/go-resty/resty/v2
+ vulnerable_at: 2.12.0
packages:
- package: github.com/go-resty/resty/v2
-description: |
- A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
+summary: CVE-2023-45286 in github.com/go-resty/resty/v2
+description: |-
+ A race condition in go-resty can result in HTTP request body disclosure across
+ requests. This condition can be triggered by calling sync.Pool.Put with the same
+ *bytes.Buffer more than once, when request retries are enabled and a retry
+ occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't
+ had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP
+ request body from an unrelated request, and go-resty will append the current
+ HTTP request body to it, sending two bodies in one request. The sync.Pool in
+ question is defined at package level scope, so a completely unrelated server
+ could receive the request body.
references:
- report: https://github.com/go-resty/resty/issues/743
- report: https://github.com/go-resty/resty/issues/739
diff --git a/internal/report/testdata/proxy/TestCVE5ToReport.json b/internal/report/testdata/proxy/TestCVE5ToReport.json
new file mode 100644
index 0000000..9374175
--- /dev/null
+++ b/internal/report/testdata/proxy/TestCVE5ToReport.json
@@ -0,0 +1,50 @@
+{
+ "github.com/!consensys/gnark/@v/list": {
+ "body": "v0.2.0-alpha\nv0.7.0\nv0.8.1\nv0.3.8\nv0.3.0\nv0.5.2\nv0.3.6\nv0.6.1\nv0.3.4\nv0.8.0\nv0.6.0\nv0.3.7\nv0.6.2\nv0.5.0\nv0.3.5\nv0.2.1-alpha\nv0.3.3\nv0.9.0\nv0.6.5\nv0.4.0\nv0.5.1\nv0.3.1\nv0.7.1\nv0.9.1\nv0.6.3\nv0.3.0-alpha\nv0.9.0-alpha\nv0.1.0-alpha\nv0.6.4\n",
+ "status_code": 200
+ },
+ "github.com/!consensys/gnark/@v/v0.9.0.mod": {
+ "body": "module github.com/consensys/gnark\n\ngo 1.19\n\nrequire (\n\tgithub.com/bits-and-blooms/bitset v1.8.0\n\tgithub.com/blang/semver/v4 v4.0.0\n\tgithub.com/consensys/bavard v0.1.13\n\tgithub.com/consensys/gnark-crypto v0.11.2\n\tgithub.com/fxamacker/cbor/v2 v2.5.0\n\tgithub.com/google/go-cmp v0.5.9\n\tgithub.com/google/pprof v0.0.0-20230817174616-7a8ec2ada47b\n\tgithub.com/leanovate/gopter v0.2.9\n\tgithub.com/rs/zerolog v1.30.0\n\tgithub.com/stretchr/testify v1.8.4\n\tgolang.org/x/crypto v0.12.0\n\tgolang.org/x/exp v0.0.0-20230817173708-d852ddb80c63\n\tgolang.org/x/sys v0.11.0\n)\n\nrequire (\n\tgithub.com/kr/text v0.2.0 // indirect\n\tgithub.com/rogpeppe/go-internal v1.11.0 // indirect\n)\n\nrequire (\n\tgithub.com/davecgh/go-spew v1.1.1 // indirect\n\tgithub.com/mattn/go-colorable v0.1.13 // indirect\n\tgithub.com/mattn/go-isatty v0.0.19 // indirect\n\tgithub.com/mmcloughlin/addchain v0.4.0 // indirect\n\tgithub.com/pmezard/go-difflib v1.0.0 // indirect\n\tgithub.com/x448/float16 v0.8.4 // indirect\n\tgopkg.in/yaml.v3 v3.0.1 // indirect\n\trsc.io/tmplfunc v0.0.3 // indirect\n)\n",
+ "status_code": 200
+ },
+ "github.com/go-resty/resty/v2/@latest": {
+ "body": "{\"Version\":\"v2.12.0\",\"Time\":\"2024-03-17T20:50:19Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://github.com/go-resty/resty\",\"Ref\":\"refs/tags/v2.12.0\",\"Hash\":\"89d25d9d1aed90c422d5dd816e6788ac4e893def\"}}",
+ "status_code": 200
+ },
+ "github.com/go-resty/resty/v2/@v/list": {
+ "body": "v2.3.0\nv2.2.0\nv2.9.1\nv2.6.0\nv2.0.0-rc.3\nv2.3.0-rc.1\nv2.0.0-rc.1\nv2.0.0-rc.4\nv2.0.0\nv2.4.0\nv2.10.0-rc.1\nv2.12.0\nv2.8.0\nv2.7.0\nv2.10.0-rc.3\nv2.1.0\nv2.10.0\nv2.11.0\nv2.9.0\nv2.0.0-rc.2\nv2.3.0-rc.2\nv2.5.0\nv2.10.0-rc.2\n",
+ "status_code": 200
+ },
+ "github.com/gofiber/fiber/@v/list": {
+ "body": "v1.9.0\nv1.0.2\nv1.14.1\nv1.7.0\nv1.13.3\nv1.2.3\nv0.9.3\nv0.7.0\nv0.8.1\nv1.9.6\nv1.13.1\nv1.8.0\nv1.6.0\nv1.4.2\nv1.12.0-alpha\nv1.0.0\nv1.14.0\nv0.8.0\nv1.8.3\nv1.12.0\nv1.4.3\nv0.6.9\nv1.3.3\nv1.14.4\nv1.14.5\nv1.8.2\nv1.12.6\nv1.12.1\nv1.3.1\nv1.5.0\nv1.14.6\nv1.3.4\nv1.7.1\nv1.4.1\nv1.8.31\nv1.14.3\nv1.9.1\nv1.12.3\nv1.10.0\nv0.9.0\nv1.11.0\nv1.4.4\nv1.12.5\nv1.10.2\nv1.9.4\nv1.3.2\nv1.9.3\nv1.4.0\nv0.9.1\nv1.2.0\nv1.13.2\nv1.12.2\nv1.6.1\nv1.12.4\nv1.10.1\nv1.8.32\nv1.8.33\nv1.8.43\nv1.10.5\nv1.0.1-beta\nv1.9.2\nv1.13.0\nv1.9.5\nv1.8.1\nv1.10.3\nv1.14.2\nv1.0.1\nv1.1.0\nv1.11.1\nv1.8.4\nv1.8.41\nv1.8.42\nv1.8.431\n",
+ "status_code": 200
+ },
+ "github.com/pandatix/go-cvss/@v/list": {
+ "body": "v0.3.0\nv0.5.2\nv0.6.1\nv0.6.0\nv0.6.2\nv0.5.0\nv0.4.0\nv0.4.1\nv0.5.1\nv0.1.0\nv0.1.1\nv0.2.0\nv0.4.2\n",
+ "status_code": 200
+ },
+ "github.com/pandatix/go-cvss/@v/v0.2.0.mod": {
+ "body": "module github.com/pandatix/go-cvss\n\ngo 1.18\n\nrequire github.com/stretchr/testify v1.7.5\n\nrequire (\n\tgithub.com/davecgh/go-spew v1.1.1 // indirect\n\tgithub.com/pmezard/go-difflib v1.0.0 // indirect\n\tgopkg.in/yaml.v3 v3.0.1 // indirect\n)\n",
+ "status_code": 200
+ },
+ "github.com/pandatix/go-cvss/@v/v0.4.0.mod": {
+ "body": "module github.com/pandatix/go-cvss\n\ngo 1.19\n\nrequire github.com/stretchr/testify v1.8.0\n\nrequire (\n\tgithub.com/davecgh/go-spew v1.1.1 // indirect\n\tgithub.com/pmezard/go-difflib v1.0.0 // indirect\n\tgopkg.in/yaml.v3 v3.0.1 // indirect\n)\n",
+ "status_code": 200
+ },
+ "golang.org/x/crypto/@latest": {
+ "body": "{\"Version\":\"v0.22.0\",\"Time\":\"2024-04-04T16:59:43Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://go.googlesource.com/crypto\",\"Ref\":\"refs/tags/v0.22.0\",\"Hash\":\"d042a396a6de487c29b6907508ba7e86925f6e09\"}}",
+ "status_code": 200
+ },
+ "golang.org/x/crypto/@v/list": {
+ "body": "v0.15.0\nv0.7.0\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.20.0\nv0.5.0\nv0.22.0\nv0.18.0\nv0.21.0\nv0.12.0\nv0.19.0\nv0.9.0\nv0.4.0\nv0.14.0\nv0.11.0\nv0.1.0\nv0.13.0\nv0.17.0\nv0.2.0\nv0.16.0\n",
+ "status_code": 200
+ },
+ "golang.org/x/image/@v/list": {
+ "body": "v0.15.0\nv0.7.0\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.5.0\nv0.12.0\nv0.9.0\nv0.4.0\nv0.14.0\nv0.11.0\nv0.1.0\nv0.13.0\nv0.2.0\n",
+ "status_code": 200
+ },
+ "golang.org/x/image/@v/v0.10.0.mod": {
+ "body": "module golang.org/x/image\n\ngo 1.12\n\nrequire golang.org/x/text v0.11.0\n",
+ "status_code": 200
+ }
+}
\ No newline at end of file
diff --git a/internal/report/testdata/proxy/TestCVEToReport.json b/internal/report/testdata/proxy/TestCVEToReport.json
new file mode 100644
index 0000000..993a942
--- /dev/null
+++ b/internal/report/testdata/proxy/TestCVEToReport.json
@@ -0,0 +1,50 @@
+{
+ "github.com/!consensys/gnark/@latest": {
+ "body": "{\"Version\":\"v0.9.1\",\"Time\":\"2023-10-16T18:27:07Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://github.com/Consensys/gnark\",\"Ref\":\"refs/tags/v0.9.1\",\"Hash\":\"3421eaa7d544286abf3de8c46282b8d4da6d5da0\"}}",
+ "status_code": 200
+ },
+ "github.com/!consensys/gnark/@v/list": {
+ "body": "v0.2.0-alpha\nv0.7.0\nv0.8.1\nv0.3.8\nv0.3.0\nv0.5.2\nv0.3.6\nv0.6.1\nv0.3.4\nv0.8.0\nv0.6.0\nv0.3.7\nv0.6.2\nv0.5.0\nv0.3.5\nv0.2.1-alpha\nv0.3.3\nv0.9.0\nv0.6.5\nv0.4.0\nv0.5.1\nv0.3.1\nv0.7.1\nv0.9.1\nv0.6.3\nv0.3.0-alpha\nv0.9.0-alpha\nv0.1.0-alpha\nv0.6.4\n",
+ "status_code": 200
+ },
+ "github.com/go-resty/resty/v2/@latest": {
+ "body": "{\"Version\":\"v2.12.0\",\"Time\":\"2024-03-17T20:50:19Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://github.com/go-resty/resty\",\"Ref\":\"refs/tags/v2.12.0\",\"Hash\":\"89d25d9d1aed90c422d5dd816e6788ac4e893def\"}}",
+ "status_code": 200
+ },
+ "github.com/go-resty/resty/v2/@v/list": {
+ "body": "v2.3.0\nv2.2.0\nv2.9.1\nv2.6.0\nv2.0.0-rc.3\nv2.3.0-rc.1\nv2.0.0-rc.1\nv2.0.0-rc.4\nv2.0.0\nv2.4.0\nv2.10.0-rc.1\nv2.12.0\nv2.8.0\nv2.7.0\nv2.10.0-rc.3\nv2.1.0\nv2.10.0\nv2.11.0\nv2.9.0\nv2.0.0-rc.2\nv2.3.0-rc.2\nv2.5.0\nv2.10.0-rc.2\n",
+ "status_code": 200
+ },
+ "github.com/gofiber/fiber/@latest": {
+ "body": "{\"Version\":\"v1.14.6\",\"Time\":\"2020-09-11T18:56:02Z\"}",
+ "status_code": 200
+ },
+ "github.com/gofiber/fiber/@v/list": {
+ "body": "v1.9.0\nv1.0.2\nv1.14.1\nv1.7.0\nv1.13.3\nv1.2.3\nv0.9.3\nv0.7.0\nv0.8.1\nv1.9.6\nv1.13.1\nv1.8.0\nv1.6.0\nv1.4.2\nv1.12.0-alpha\nv1.0.0\nv1.14.0\nv0.8.0\nv1.8.3\nv1.12.0\nv1.4.3\nv0.6.9\nv1.3.3\nv1.14.4\nv1.14.5\nv1.8.2\nv1.12.6\nv1.12.1\nv1.3.1\nv1.5.0\nv1.14.6\nv1.3.4\nv1.7.1\nv1.4.1\nv1.8.31\nv1.14.3\nv1.9.1\nv1.12.3\nv1.10.0\nv0.9.0\nv1.11.0\nv1.4.4\nv1.12.5\nv1.10.2\nv1.9.4\nv1.3.2\nv1.9.3\nv1.4.0\nv0.9.1\nv1.2.0\nv1.13.2\nv1.12.2\nv1.6.1\nv1.12.4\nv1.10.1\nv1.8.32\nv1.8.33\nv1.8.43\nv1.10.5\nv1.0.1-beta\nv1.9.2\nv1.13.0\nv1.9.5\nv1.8.1\nv1.10.3\nv1.14.2\nv1.0.1\nv1.1.0\nv1.11.1\nv1.8.4\nv1.8.41\nv1.8.42\nv1.8.431\n",
+ "status_code": 200
+ },
+ "github.com/pandatix/go-cvss/@latest": {
+ "body": "{\"Version\":\"v0.6.2\",\"Time\":\"2023-10-29T09:33:31Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://github.com/pandatix/go-cvss\",\"Ref\":\"refs/tags/v0.6.2\",\"Hash\":\"c469bad96b51674ff275fa1a76fcd9fa409c180a\"}}",
+ "status_code": 200
+ },
+ "github.com/pandatix/go-cvss/@v/list": {
+ "body": "v0.3.0\nv0.5.2\nv0.6.1\nv0.6.0\nv0.6.2\nv0.5.0\nv0.4.0\nv0.4.1\nv0.5.1\nv0.1.0\nv0.1.1\nv0.2.0\nv0.4.2\n",
+ "status_code": 200
+ },
+ "golang.org/x/crypto/@latest": {
+ "body": "{\"Version\":\"v0.22.0\",\"Time\":\"2024-04-04T16:59:43Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://go.googlesource.com/crypto\",\"Ref\":\"refs/tags/v0.22.0\",\"Hash\":\"d042a396a6de487c29b6907508ba7e86925f6e09\"}}",
+ "status_code": 200
+ },
+ "golang.org/x/crypto/@v/list": {
+ "body": "v0.15.0\nv0.7.0\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.20.0\nv0.5.0\nv0.22.0\nv0.18.0\nv0.21.0\nv0.12.0\nv0.19.0\nv0.9.0\nv0.4.0\nv0.14.0\nv0.11.0\nv0.1.0\nv0.13.0\nv0.17.0\nv0.2.0\nv0.16.0\n",
+ "status_code": 200
+ },
+ "golang.org/x/image/@latest": {
+ "body": "{\"Version\":\"v0.15.0\",\"Time\":\"2023-12-19T18:03:06Z\",\"Origin\":{\"VCS\":\"git\",\"URL\":\"https://go.googlesource.com/image\",\"Ref\":\"refs/tags/v0.15.0\",\"Hash\":\"9e190ae4a3c5edc736fd99ba38be1c9d08ea5320\"}}",
+ "status_code": 200
+ },
+ "golang.org/x/image/@v/list": {
+ "body": "v0.15.0\nv0.7.0\nv0.3.0\nv0.8.0\nv0.6.0\nv0.10.0\nv0.5.0\nv0.12.0\nv0.9.0\nv0.4.0\nv0.14.0\nv0.11.0\nv0.1.0\nv0.13.0\nv0.2.0\n",
+ "status_code": 200
+ }
+}
\ No newline at end of file
