Skip to content

Commit c183779

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 3 reports
 - data/reports/GO-2025-3581.yaml - data/reports/GO-2025-3583.yaml - data/reports/GO-2025-3584.yaml Fixes #3581 Fixes #3583 Fixes #3584 Change-Id: I730e8b64e025d9f3972fd8c3e9e3e1b46ea0d050 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/661836 Reviewed-by: Damien Neil <[email protected]> Commit-Queue: Neal Patel <[email protected]> Auto-Submit: Neal Patel <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 20f822f commit c183779

File tree

6 files changed

+233
-0
lines changed

6 files changed

+233
-0
lines changed

Diff for: ‎data/osv/GO-2025-3581.json

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3581",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-j95m-rcjp-q69h"
8+
],
9+
"summary": "github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
10+
"details": "github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/jaredallard/archives",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.0.1"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h"
37+
}
38+
],
39+
"database_specific": {
40+
"url": "https://pkg.go.dev/vuln/GO-2025-3581",
41+
"review_status": "UNREVIEWED"
42+
}
43+
}

Diff for: ‎data/osv/GO-2025-3583.json

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3583",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-29072",
8+
"GHSA-wq32-8rp4-w2mc"
9+
],
10+
"summary": "Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow in github.com/NethermindEth/juno",
11+
"details": "Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow in github.com/NethermindEth/juno",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/NethermindEth/juno",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.12.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-wq32-8rp4-w2mc"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29072"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/NethermindEth/juno/commit/51074875941aa111c5dd2b41f2ec890a4a15b587"
46+
},
47+
{
48+
"type": "FIX",
49+
"url": "https://github.com/NethermindEth/juno/commit/b9fe28df6a4339a66f91bff723c61dc063f9ed50"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314"
54+
}
55+
],
56+
"database_specific": {
57+
"url": "https://pkg.go.dev/vuln/GO-2025-3583",
58+
"review_status": "UNREVIEWED"
59+
}
60+
}

Diff for: ‎data/osv/GO-2025-3584.json

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3584",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-p799-q2pr-6mxj"
8+
],
9+
"summary": "go.rgst.io/stencil/v2 vulnerable to Path Traversal",
10+
"details": "go.rgst.io/stencil/v2 vulnerable to Path Traversal",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "go.rgst.io/stencil",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "go.rgst.io/stencil/v2",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
},
41+
{
42+
"fixed": "2.3.0"
43+
}
44+
]
45+
}
46+
],
47+
"ecosystem_specific": {}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/rgst-io/stencil/security/advisories/GHSA-p799-q2pr-6mxj"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/rgst-io/stencil/commit/5482fcada0c6f77d903d13129bd656b7df80ac3a"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/rgst-io/stencil/pull/255"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2025-3584",
70+
"review_status": "UNREVIEWED"
71+
}
72+
}

Diff for: ‎data/reports/GO-2025-3581.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
id: GO-2025-3581
2+
modules:
3+
- module: github.com/jaredallard/archives
4+
versions:
5+
- fixed: 1.0.1
6+
vulnerable_at: 1.0.0
7+
summary: |-
8+
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a
9+
Restricted Directory ('Path Traversal')
10+
ghsas:
11+
- GHSA-j95m-rcjp-q69h
12+
references:
13+
- advisory: https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h
14+
source:
15+
id: GHSA-j95m-rcjp-q69h
16+
created: 2025-03-31T13:06:03.925815-04:00
17+
review_status: UNREVIEWED

Diff for: ‎data/reports/GO-2025-3583.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: GO-2025-3583
2+
modules:
3+
- module: github.com/NethermindEth/juno
4+
versions:
5+
- fixed: 0.12.5
6+
vulnerable_at: 0.12.4
7+
summary: Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow in github.com/NethermindEth/juno
8+
cves:
9+
- CVE-2025-29072
10+
ghsas:
11+
- GHSA-wq32-8rp4-w2mc
12+
references:
13+
- advisory: https://github.com/advisories/GHSA-wq32-8rp4-w2mc
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-29072
15+
- fix: https://github.com/NethermindEth/juno/commit/51074875941aa111c5dd2b41f2ec890a4a15b587
16+
- fix: https://github.com/NethermindEth/juno/commit/b9fe28df6a4339a66f91bff723c61dc063f9ed50
17+
- web: https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314
18+
source:
19+
id: GHSA-wq32-8rp4-w2mc
20+
created: 2025-03-31T13:06:06.144569-04:00
21+
review_status: UNREVIEWED

Diff for: ‎data/reports/GO-2025-3584.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: GO-2025-3584
2+
modules:
3+
- module: go.rgst.io/stencil
4+
vulnerable_at: 0.15.4
5+
- module: go.rgst.io/stencil/v2
6+
versions:
7+
- fixed: 2.3.0
8+
vulnerable_at: 2.2.0
9+
summary: go.rgst.io/stencil/v2 vulnerable to Path Traversal
10+
ghsas:
11+
- GHSA-p799-q2pr-6mxj
12+
references:
13+
- advisory: https://github.com/rgst-io/stencil/security/advisories/GHSA-p799-q2pr-6mxj
14+
- web: https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h
15+
- web: https://github.com/rgst-io/stencil/commit/5482fcada0c6f77d903d13129bd656b7df80ac3a
16+
- web: https://github.com/rgst-io/stencil/pull/255
17+
source:
18+
id: GHSA-p799-q2pr-6mxj
19+
created: 2025-03-31T13:06:11.572598-04:00
20+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)