commit b47082c55f886b88d537621fb0bc4476fac51174
author Damien Neil <dneil@google.com> Wed Jun 29 16:21:14 2022 -0700
committer Damien Neil <dneil@google.com> Fri Jul 01 20:15:30 2022 +0000
tree 72e60c23793efe6cf1ca8d62c631c3d7c576cf46
parent 5d6610cb6f14b499f14fea15b1011de44f2d48f9

x/vulndb: add reports/GO-2022-0211.yaml for CVE-2019-14809

Fixes golang/vulndb#0211

Change-Id: Ib460c640cea4b022e378dcec383f176059a1af10
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/415277
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>

reports/GO-2022-0211.yaml

diff --git a/reports/GO-2022-0211.yaml b/reports/GO-2022-0211.yaml
new file mode 100644
index 0000000..597f115
--- /dev/null
+++ b/reports/GO-2022-0211.yaml
@@ -0,0 +1,25 @@
+packages:
+  - module: std
+    package: net/url
+    symbols:
+      - parseHost
+      - URL.Hostname
+      - URL.Port
+    versions:
+      - fixed: 1.11.13
+      - introduced: 1.12.0
+        fixed: 1.12.8
+    vulnerable_at: 1.12.7
+description: |
+    The url.Parse function accepts URLs with malformed hosts, such that the Host
+    field can have arbitrary suffixes that appear in neither Hostname() nor Port(),
+    allowing authorization bypasses in certain applications.
+cves:
+  - CVE-2019-14809
+credit: Julian Hector and Nikolai Krein from Cure53, and Adi Cohen (adico.me)
+links:
+    pr: https://go.dev/cl/189258
+    commit: https://go.googlesource.com/go/+/61bb56ad63992a3199acc55b2537c8355ef887b6
+    context:
+      - https://go.dev/issue/29098
+      - https://groups.google.com/g/golang-announce/c/65QixT3tcmg