Skip to content

Commit 36dff84

Browse files
ethanalee-workMarkus Kusano
ethanalee-work
authored and
Markus Kusano
committed
data/reports: add 19 reports
 - data/reports/GO-2025-3979.yaml - data/reports/GO-2025-3981.yaml - data/reports/GO-2025-3982.yaml - data/reports/GO-2025-3983.yaml - data/reports/GO-2025-3984.yaml - data/reports/GO-2025-3985.yaml - data/reports/GO-2025-3986.yaml - data/reports/GO-2025-3989.yaml - data/reports/GO-2025-3990.yaml - data/reports/GO-2025-3991.yaml - data/reports/GO-2025-3992.yaml - data/reports/GO-2025-3993.yaml - data/reports/GO-2025-3994.yaml - data/reports/GO-2025-3995.yaml - data/reports/GO-2025-3996.yaml - data/reports/GO-2025-3997.yaml - data/reports/GO-2025-3998.yaml - data/reports/GO-2025-4018.yaml - data/reports/GO-2025-4019.yaml Fixes #3979 Fixes #3981 Fixes #3982 Fixes #3983 Fixes #3984 Fixes #3985 Fixes #3986 Fixes #3989 Fixes #3990 Fixes #3991 Fixes #3992 Fixes #3993 Fixes #3994 Fixes #3995 Fixes #3996 Fixes #3997 Fixes #3998 Fixes #4018 Fixes #4019 Change-Id: I5e2e6c611b668c8b227cbc5907681deba187347a Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/711220 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Markus Kusano <[email protected]>
1 parent 7159bc7 commit 36dff84

38 files changed

+2151
-0
lines changed

‎data/osv/GO-2025-3979.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3979",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59824",
8+
"GHSA-hqrf-67pm-wgfq"
9+
],
10+
"summary": "Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni",
11+
"details": "Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/siderolabs/omni",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.48.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/siderolabs/omni/security/advisories/GHSA-hqrf-67pm-wgfq"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59824"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/siderolabs/omni/commit/a5efd816a239e6c9e5ea7c0d43c02c04504d7b60"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3979",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3981.json‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3981",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59823",
8+
"GHSA-227x-7mh8-3cf6"
9+
],
10+
"summary": "Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws",
11+
"details": "Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/gardener/gardener-extension-provider-aws",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.64.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/gardener/gardener-extension-provider-azure",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
},
45+
{
46+
"fixed": "1.55.0"
47+
}
48+
]
49+
}
50+
],
51+
"ecosystem_specific": {}
52+
},
53+
{
54+
"package": {
55+
"name": "github.com/gardener/gardener-extension-provider-gcp",
56+
"ecosystem": "Go"
57+
},
58+
"ranges": [
59+
{
60+
"type": "SEMVER",
61+
"events": [
62+
{
63+
"introduced": "0"
64+
},
65+
{
66+
"fixed": "1.46.0"
67+
}
68+
]
69+
}
70+
],
71+
"ecosystem_specific": {}
72+
},
73+
{
74+
"package": {
75+
"name": "github.com/gardener/gardener-extension-provider-openstack",
76+
"ecosystem": "Go"
77+
},
78+
"ranges": [
79+
{
80+
"type": "SEMVER",
81+
"events": [
82+
{
83+
"introduced": "0"
84+
},
85+
{
86+
"fixed": "1.49.0"
87+
}
88+
]
89+
}
90+
],
91+
"ecosystem_specific": {}
92+
}
93+
],
94+
"references": [
95+
{
96+
"type": "ADVISORY",
97+
"url": "https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6"
98+
},
99+
{
100+
"type": "ADVISORY",
101+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59823"
102+
},
103+
{
104+
"type": "FIX",
105+
"url": "https://github.com/gardener/gardener-extension-provider-aws/commit/cb5045fc146248296994804bbfe27bd896938bf2"
106+
},
107+
{
108+
"type": "FIX",
109+
"url": "https://github.com/gardener/gardener-extension-provider-azure/commit/4573a4404969f89781ed6cf72e90554bc6ae2020"
110+
},
111+
{
112+
"type": "FIX",
113+
"url": "https://github.com/gardener/gardener-extension-provider-gcp/commit/51111b4f60c33c60dfdf18b1fc50f7ec8d8f70ac"
114+
},
115+
{
116+
"type": "FIX",
117+
"url": "https://github.com/gardener/gardener-extension-provider-openstack/commit/2ed6f0fe1be90fbef5d6093eb0b8325c8421b8d8"
118+
},
119+
{
120+
"type": "WEB",
121+
"url": "https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0"
122+
},
123+
{
124+
"type": "WEB",
125+
"url": "https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0"
126+
},
127+
{
128+
"type": "WEB",
129+
"url": "https://github.com/gardener/gardener-extension-provider-gcp/releases/tag/v1.46.0"
130+
},
131+
{
132+
"type": "WEB",
133+
"url": "https://github.com/gardener/gardener-extension-provider-openstack/releases/tag/v1.49.0"
134+
}
135+
],
136+
"database_specific": {
137+
"url": "https://pkg.go.dev/vuln/GO-2025-3981",
138+
"review_status": "UNREVIEWED"
139+
}
140+
}

‎data/osv/GO-2025-3982.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3982",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-54468",
8+
"GHSA-mjcp-rj3c-36fr"
9+
],
10+
"summary": "Rancher sends sensitive information to external services through the `/meta/proxy` endpoint in github.com/rancher/rancher",
11+
"details": "Rancher sends sensitive information to external services through the `/meta/proxy` endpoint in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.9.0 before v2.9.12, from v2.10.0 before v2.10.10, from v2.11.0 before v2.11.6, from v2.12.0 before v2.12.2.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/rancher",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "2.9.0"
35+
},
36+
{
37+
"fixed": "2.9.12"
38+
},
39+
{
40+
"introduced": "2.10.0"
41+
},
42+
{
43+
"fixed": "2.10.10"
44+
},
45+
{
46+
"introduced": "2.11.0"
47+
},
48+
{
49+
"fixed": "2.11.6"
50+
},
51+
{
52+
"introduced": "2.12.0"
53+
},
54+
{
55+
"fixed": "2.12.2"
56+
}
57+
]
58+
}
59+
]
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "ADVISORY",
66+
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-mjcp-rj3c-36fr"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54468"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54468"
75+
}
76+
],
77+
"database_specific": {
78+
"url": "https://pkg.go.dev/vuln/GO-2025-3982",
79+
"review_status": "UNREVIEWED"
80+
}
81+
}

‎data/osv/GO-2025-3983.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3983",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-58260",
8+
"GHSA-q82v-h4rq-5c86"
9+
],
10+
"summary": "Rancher update on users can deny the service to the admin in github.com/rancher/rancher",
11+
"details": "Rancher update on users can deny the service to the admin in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.9.0 before v2.9.12, from v2.10.0 before v2.10.10, from v2.11.0 before v2.11.6, from v2.12.0 before v2.12.2.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/rancher",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "2.9.0"
35+
},
36+
{
37+
"fixed": "2.9.12"
38+
},
39+
{
40+
"introduced": "2.10.0"
41+
},
42+
{
43+
"fixed": "2.10.10"
44+
},
45+
{
46+
"introduced": "2.11.0"
47+
},
48+
{
49+
"fixed": "2.11.6"
50+
},
51+
{
52+
"introduced": "2.12.0"
53+
},
54+
{
55+
"fixed": "2.12.2"
56+
}
57+
]
58+
}
59+
]
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "ADVISORY",
66+
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-q82v-h4rq-5c86"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58260"
71+
},
72+
{
73+
"type": "WEB",
74+
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58260"
75+
}
76+
],
77+
"database_specific": {
78+
"url": "https://pkg.go.dev/vuln/GO-2025-3983",
79+
"review_status": "UNREVIEWED"
80+
}
81+
}

0 commit comments

Comments
 (0)