data/reports: add 3 high-priority reports
- data/reports/GO-2025-3722.yaml
- data/reports/GO-2025-3732.yaml
- data/reports/GO-2025-3735.yaml
Fixes golang/vulndb#3722
Fixes golang/vulndb#3732
Fixes golang/vulndb#3735
Change-Id: Ibb189a18fbfbf60aa63de5bfbd7bb4db1d4467d1
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/678455
Auto-Submit: Neal Patel <nealpatel@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
diff --git a/data/osv/GO-2025-3722.json b/data/osv/GO-2025-3722.json
new file mode 100644
index 0000000..d0bf147
--- /dev/null
+++ b/data/osv/GO-2025-3722.json
@@ -0,0 +1,62 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2025-3722",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2025-48865",
+ "GHSA-q7p4-7xjv-j3wf"
+ ],
+ "summary": "Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio",
+ "details": "Fabio allows HTTP clients to manipulate custom headers it adds in github.com/fabiolb/fabio",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/fabiolb/fabio",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "1.6.6"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {
+ "imports": [
+ {
+ "path": "github.com/fabiolb/fabio/proxy",
+ "symbols": [
+ "HTTPProxy.ServeHTTP",
+ "addHeaders"
+ ]
+ }
+ ]
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/fabiolb/fabio/security/advisories/GHSA-q7p4-7xjv-j3wf"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/fabiolb/fabio/commit/fdaf1e966162e9dd3b347ffdd0647b39dc71a1a3"
+ },
+ {
+ "type": "WEB",
+ "url": "https://github.com/fabiolb/fabio/releases/tag/v1.6.6"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2025-3722",
+ "review_status": "REVIEWED"
+ }
+}
\ No newline at end of file
diff --git a/data/osv/GO-2025-3732.json b/data/osv/GO-2025-3732.json
new file mode 100644
index 0000000..dbd1c10
--- /dev/null
+++ b/data/osv/GO-2025-3732.json
@@ -0,0 +1,58 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2025-3732",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2025-48938",
+ "GHSA-g9f5-x53j-h563"
+ ],
+ "summary": "GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh",
+ "details": "GitHub CLI and extensions can execute arbitrary commands on compromised GitHub Enterprise Server in github.com/cli/go-gh",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/cli/go-gh/v2",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "2.12.1"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {
+ "imports": [
+ {
+ "path": "github.com/cli/go-gh/v2/pkg/browser",
+ "symbols": [
+ "Browser.Browse",
+ "Browser.browse"
+ ]
+ }
+ ]
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2025-3732",
+ "review_status": "REVIEWED"
+ }
+}
\ No newline at end of file
diff --git a/data/osv/GO-2025-3735.json b/data/osv/GO-2025-3735.json
new file mode 100644
index 0000000..17a0476
--- /dev/null
+++ b/data/osv/GO-2025-3735.json
@@ -0,0 +1,64 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2025-3735",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2025-29785",
+ "GHSA-j972-j939-p2v3"
+ ],
+ "summary": "Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go",
+ "details": "Panic in Path Probe Loss Recovery Handling in github.com/quic-go/quic-go",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/quic-go/quic-go",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0.50.0"
+ },
+ {
+ "fixed": "0.50.1"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {
+ "imports": [
+ {
+ "path": "github.com/quic-go/quic-go/internal/ackhandler",
+ "symbols": [
+ "sentPacketHandler.OnLossDetectionTimeout",
+ "sentPacketHandler.ReceivedAck",
+ "sentPacketHandler.detectAndRemoveAckedPackets",
+ "sentPacketHandler.detectLostPathProbes"
+ ]
+ }
+ ]
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-j972-j939-p2v3"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/quic-go/quic-go/commit/b90058aba5f65f48e0e150c89bbaa21a72dda4de"
+ },
+ {
+ "type": "REPORT",
+ "url": "https://github.com/quic-go/quic-go/issues/4981"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2025-3735",
+ "review_status": "REVIEWED"
+ }
+}
\ No newline at end of file
diff --git a/data/reports/GO-2025-3722.yaml b/data/reports/GO-2025-3722.yaml
new file mode 100644
index 0000000..20ed699
--- /dev/null
+++ b/data/reports/GO-2025-3722.yaml
@@ -0,0 +1,27 @@
+id: GO-2025-3722
+modules:
+ - module: github.com/fabiolb/fabio
+ versions:
+ - fixed: 1.6.6
+ vulnerable_at: 1.6.5
+ packages:
+ - package: github.com/fabiolb/fabio/proxy
+ symbols:
+ - addHeaders
+ derived_symbols:
+ - HTTPProxy.ServeHTTP
+summary: |-
+ Fabio allows HTTP clients to manipulate custom headers it adds in
+ github.com/fabiolb/fabio
+cves:
+ - CVE-2025-48865
+ghsas:
+ - GHSA-q7p4-7xjv-j3wf
+references:
+ - advisory: https://github.com/fabiolb/fabio/security/advisories/GHSA-q7p4-7xjv-j3wf
+ - fix: https://github.com/fabiolb/fabio/commit/fdaf1e966162e9dd3b347ffdd0647b39dc71a1a3
+ - web: https://github.com/fabiolb/fabio/releases/tag/v1.6.6
+source:
+ id: GHSA-q7p4-7xjv-j3wf
+ created: 2025-06-03T11:54:28.911416-04:00
+review_status: REVIEWED
diff --git a/data/reports/GO-2025-3732.yaml b/data/reports/GO-2025-3732.yaml
new file mode 100644
index 0000000..d2a38d4
--- /dev/null
+++ b/data/reports/GO-2025-3732.yaml
@@ -0,0 +1,26 @@
+id: GO-2025-3732
+modules:
+ - module: github.com/cli/go-gh/v2
+ versions:
+ - fixed: 2.12.1
+ vulnerable_at: 2.12.0
+ packages:
+ - package: github.com/cli/go-gh/v2/pkg/browser
+ symbols:
+ - Browser.browse
+ derived_symbols:
+ - Browser.Browse
+summary: |-
+ GitHub CLI and extensions can execute arbitrary commands on
+ compromised GitHub Enterprise Server in github.com/cli/go-gh
+cves:
+ - CVE-2025-48938
+ghsas:
+ - GHSA-g9f5-x53j-h563
+references:
+ - advisory: https://github.com/cli/go-gh/security/advisories/GHSA-g9f5-x53j-h563
+ - fix: https://github.com/cli/go-gh/commit/a08820a13f257d6c5b4cb86d37db559ec6d14577
+source:
+ id: GHSA-g9f5-x53j-h563
+ created: 2025-06-03T11:45:17.659032-04:00
+review_status: REVIEWED
diff --git a/data/reports/GO-2025-3735.yaml b/data/reports/GO-2025-3735.yaml
new file mode 100644
index 0000000..1dd3eab
--- /dev/null
+++ b/data/reports/GO-2025-3735.yaml
@@ -0,0 +1,30 @@
+id: GO-2025-3735
+modules:
+ - module: github.com/quic-go/quic-go
+ versions:
+ - introduced: 0.50.0
+ - fixed: 0.50.1
+ vulnerable_at: 0.50.0
+ packages:
+ - package: github.com/quic-go/quic-go/internal/ackhandler
+ symbols:
+ - sentPacketHandler.detectLostPathProbes
+ - sentPacketHandler.detectAndRemoveAckedPackets
+ derived_symbols:
+ - sentPacketHandler.OnLossDetectionTimeout
+ - sentPacketHandler.ReceivedAck
+summary: |-
+ Panic in Path Probe Loss Recovery Handling in
+ github.com/quic-go/quic-go
+cves:
+ - CVE-2025-29785
+ghsas:
+ - GHSA-j972-j939-p2v3
+references:
+ - advisory: https://github.com/quic-go/quic-go/security/advisories/GHSA-j972-j939-p2v3
+ - fix: https://github.com/quic-go/quic-go/commit/b90058aba5f65f48e0e150c89bbaa21a72dda4de
+ - report: https://github.com/quic-go/quic-go/issues/4981
+source:
+ id: GHSA-j972-j939-p2v3
+ created: 2025-06-03T11:45:22.779433-04:00
+review_status: REVIEWED
