data/reports: review 1 report
Fixes golang/vulndb#3676
Change-Id: I3f3a9dfda445bac4ac053abe58ee776b6d58f4a5
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/672255
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
Auto-Submit: Neal Patel <nealpatel@google.com>
diff --git a/data/osv/GO-2025-3561.json b/data/osv/GO-2025-3561.json
index 1065adb..dff58c6 100644
--- a/data/osv/GO-2025-3561.json
+++ b/data/osv/GO-2025-3561.json
@@ -8,7 +8,7 @@
"GHSA-c6pf-2v8j-96mc"
],
"summary": "Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium",
- "details": "Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/cilium/cilium from v1.17.0 before v1.17.2.",
+ "details": "Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium",
"affected": [
{
"package": {
@@ -20,41 +20,16 @@
"type": "SEMVER",
"events": [
{
- "introduced": "0"
- }
- ]
- }
- ],
- "ecosystem_specific": {
- "custom_ranges": [
- {
- "type": "ECOSYSTEM",
- "events": [
- {
- "introduced": "1.17.0"
- },
- {
- "fixed": "1.17.2"
- }
- ]
- }
- ]
- }
- },
- {
- "package": {
- "name": "github.com/cilium/cilium",
- "ecosystem": "Go"
- },
- "ranges": [
- {
- "type": "SEMVER",
- "events": [
- {
"introduced": "1.16.0"
},
{
"fixed": "1.16.8"
+ },
+ {
+ "introduced": "1.17.0"
+ },
+ {
+ "fixed": "1.17.2"
}
]
}
@@ -68,10 +43,6 @@
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-c6pf-2v8j-96mc"
},
{
- "type": "ADVISORY",
- "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30163"
- },
- {
"type": "FIX",
"url": "https://github.com/cilium/cilium/pull/36657"
},
@@ -82,6 +53,6 @@
],
"database_specific": {
"url": "https://pkg.go.dev/vuln/GO-2025-3561",
- "review_status": "UNREVIEWED"
+ "review_status": "REVIEWED"
}
}
\ No newline at end of file
diff --git a/data/reports/GO-2025-3561.yaml b/data/reports/GO-2025-3561.yaml
index 0d3ba42..e86b3a9 100644
--- a/data/reports/GO-2025-3561.yaml
+++ b/data/reports/GO-2025-3561.yaml
@@ -1,14 +1,12 @@
id: GO-2025-3561
modules:
- module: github.com/cilium/cilium
- non_go_versions:
- - introduced: 1.17.0
- - fixed: 1.17.2
- - module: github.com/cilium/cilium
versions:
- introduced: 1.16.0
- fixed: 1.16.8
- vulnerable_at: 1.16.7
+ - introduced: 1.17.0
+ - fixed: 1.17.2
+ vulnerable_at: 1.17.1
summary: |-
Cilium node based network policies may incorrectly allow workload traffic in
github.com/cilium/cilium
@@ -18,10 +16,9 @@
- GHSA-c6pf-2v8j-96mc
references:
- advisory: https://github.com/cilium/cilium/security/advisories/GHSA-c6pf-2v8j-96mc
- - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-30163
- fix: https://github.com/cilium/cilium/pull/36657
- web: https://docs.cilium.io/en/stable/security/policy/language/#node-based
source:
id: GHSA-c6pf-2v8j-96mc
created: 2025-03-25T12:05:12.880469-04:00
-review_status: UNREVIEWED
+review_status: REVIEWED
