commit ca852507e8d390423d43570f73ea88eb6ca827e3
author Neal Patel <nealpatel@google.com> Wed Apr 16 11:29:08 2025 -0400
committer Gopher Robot <gobot@golang.org> Tue Apr 22 10:36:39 2025 -0700
tree 5bd5775fcb8724c4aa7ace9e538125659663b2f5
parent e9f5b2fc522708e6f1ba408bdf0bfc5ed5044ce5

data/reports: add 1 report

  - data/reports/GO-2025-3607.yaml

Updates golang/vulndb#3607

Change-Id: I3d16919738cf1422aad547ff802d483527d39380
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/665976
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
Auto-Submit: Neal Patel <nealpatel@google.com>
Commit-Queue: Neal Patel <nealpatel@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

data/osv/GO-2025-3607.json

diff --git a/data/osv/GO-2025-3607.json b/data/osv/GO-2025-3607.json
new file mode 100644
index 0000000..3ec6d48
--- /dev/null
+++ b/data/osv/GO-2025-3607.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2025-3607",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2025-24358",
+    "GHSA-rq77-p4h8-4crw"
+  ],
+  "summary": "gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf",
+  "details": "gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/gorilla/csrf",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.7.3"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "github.com/gorilla/csrf",
+            "symbols": [
+              "csrf.ServeHTTP"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/gorilla/csrf/security/advisories/GHSA-rq77-p4h8-4crw"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24358"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2025-3607",
+    "review_status": "UNREVIEWED"
+  }
+}
\ No newline at end of file

data/reports/GO-2025-3607.yaml

diff --git a/data/reports/GO-2025-3607.yaml b/data/reports/GO-2025-3607.yaml
new file mode 100644
index 0000000..27c2976
--- /dev/null
+++ b/data/reports/GO-2025-3607.yaml
@@ -0,0 +1,23 @@
+id: GO-2025-3607
+modules:
+    - module: github.com/gorilla/csrf
+      versions:
+        - fixed: 1.7.3
+      vulnerable_at: 1.7.2
+      packages:
+        - package: github.com/gorilla/csrf
+          symbols:
+            - csrf.ServeHTTP
+summary: gorilla/csrf CSRF vulnerability due to broken Referer validation in github.com/gorilla/csrf
+cves:
+    - CVE-2025-24358
+ghsas:
+    - GHSA-rq77-p4h8-4crw
+references:
+    - advisory: https://github.com/gorilla/csrf/security/advisories/GHSA-rq77-p4h8-4crw
+    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-24358
+    - fix: https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb
+source:
+    id: GHSA-rq77-p4h8-4crw
+    created: 2025-04-16T11:22:28.17254-04:00
+review_status: NEEDS_REVIEW