data/reports: add 3 unreviewed reports
- data/reports/GO-2024-3280.yaml
- data/reports/GO-2024-3281.yaml
- data/reports/GO-2024-3283.yaml
Fixes golang/vulndb#3280
Fixes golang/vulndb#3281
Fixes golang/vulndb#3283
Change-Id: I86c60e8a8bee592cedb756c99695eabff0de5e5e
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/630755
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
diff --git a/data/osv/GO-2024-3280.json b/data/osv/GO-2024-3280.json
new file mode 100644
index 0000000..09787ab
--- /dev/null
+++ b/data/osv/GO-2024-3280.json
@@ -0,0 +1,61 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2024-3280",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2024-52282",
+ "GHSA-9c5p-35gj-jqp4"
+ ],
+ "summary": "Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher",
+ "details": "Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.8.0 before v2.8.10, from v2.9.0 before v2.9.4.",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/rancher/rancher",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {
+ "custom_ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2.8.0"
+ },
+ {
+ "fixed": "2.8.10"
+ },
+ {
+ "introduced": "2.9.0"
+ },
+ {
+ "fixed": "2.9.4"
+ }
+ ]
+ }
+ ]
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2024-3280",
+ "review_status": "UNREVIEWED"
+ }
+}
\ No newline at end of file
diff --git a/data/osv/GO-2024-3281.json b/data/osv/GO-2024-3281.json
new file mode 100644
index 0000000..d0a1f49
--- /dev/null
+++ b/data/osv/GO-2024-3281.json
@@ -0,0 +1,48 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2024-3281",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2024-52280",
+ "GHSA-j5hq-5jcr-xwx7"
+ ],
+ "summary": "github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve",
+ "details": "github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/rancher/steve",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "0.0.0-20241029132712-2175e090fe4b"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {}
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2024-3281",
+ "review_status": "UNREVIEWED"
+ }
+}
\ No newline at end of file
diff --git a/data/osv/GO-2024-3283.json b/data/osv/GO-2024-3283.json
new file mode 100644
index 0000000..3ac0db7
--- /dev/null
+++ b/data/osv/GO-2024-3283.json
@@ -0,0 +1,72 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2024-3283",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2024-52309"
+ ],
+ "summary": "SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo",
+ "details": "SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/drakkan/sftpgo",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {}
+ },
+ {
+ "package": {
+ "name": "github.com/drakkan/sftpgo/v2",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "2.4.0"
+ },
+ {
+ "fixed": "2.6.3"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {}
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52309"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2024-3283",
+ "review_status": "UNREVIEWED"
+ }
+}
\ No newline at end of file
diff --git a/data/reports/GO-2024-3280.yaml b/data/reports/GO-2024-3280.yaml
new file mode 100644
index 0000000..819f70a
--- /dev/null
+++ b/data/reports/GO-2024-3280.yaml
@@ -0,0 +1,20 @@
+id: GO-2024-3280
+modules:
+ - module: github.com/rancher/rancher
+ non_go_versions:
+ - introduced: 2.8.0
+ - fixed: 2.8.10
+ - introduced: 2.9.0
+ - fixed: 2.9.4
+ vulnerable_at: 1.6.30
+summary: Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher
+cves:
+ - CVE-2024-52282
+ghsas:
+ - GHSA-9c5p-35gj-jqp4
+references:
+ - advisory: https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4
+source:
+ id: GHSA-9c5p-35gj-jqp4
+ created: 2024-11-21T14:39:33.619351-05:00
+review_status: UNREVIEWED
diff --git a/data/reports/GO-2024-3281.yaml b/data/reports/GO-2024-3281.yaml
new file mode 100644
index 0000000..069898f
--- /dev/null
+++ b/data/reports/GO-2024-3281.yaml
@@ -0,0 +1,21 @@
+id: GO-2024-3281
+modules:
+ - module: github.com/rancher/steve
+ versions:
+ - fixed: 0.0.0-20241029132712-2175e090fe4b
+summary: |-
+ github.com/rancher/steve's users can issue watch commands for arbitrary
+ resources in github.com/rancher/steve
+cves:
+ - CVE-2024-52280
+ghsas:
+ - GHSA-j5hq-5jcr-xwx7
+references:
+ - advisory: https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7
+ - fix: https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9
+notes:
+ - fix: 'github.com/rancher/steve: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
+source:
+ id: GHSA-j5hq-5jcr-xwx7
+ created: 2024-11-21T14:39:28.380649-05:00
+review_status: UNREVIEWED
diff --git a/data/reports/GO-2024-3283.yaml b/data/reports/GO-2024-3283.yaml
new file mode 100644
index 0000000..041c1e5
--- /dev/null
+++ b/data/reports/GO-2024-3283.yaml
@@ -0,0 +1,23 @@
+id: GO-2024-3283
+modules:
+ - module: github.com/drakkan/sftpgo
+ vulnerable_at: 1.2.2
+ - module: github.com/drakkan/sftpgo/v2
+ versions:
+ - introduced: 2.4.0
+ - fixed: 2.6.3
+ vulnerable_at: 2.6.2
+summary: |-
+ SFTPGo allows administrators to restrict command execution from the EventManager
+ in github.com/drakkan/sftpgo
+cves:
+ - CVE-2024-52309
+references:
+ - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-52309
+ - fix: https://github.com/drakkan/sftpgo/commit/88b1850b5806eee81150873d4e565144b21021fb
+ - fix: https://github.com/drakkan/sftpgo/commit/b524da11e9466d05fe03304713ee1c61bb276ec4
+ - web: https://github.com/drakkan/sftpgo/security/advisories/GHSA-49cc-xrjf-9qf7
+source:
+ id: CVE-2024-52309
+ created: 2024-11-21T14:38:20.406237-05:00
+review_status: UNREVIEWED
