data/reports: add 7 unreviewed reports

- data/reports/GO-2024-2968.yaml - data/reports/GO-2024-2969.yaml - data/reports/GO-2024-2970.yaml - data/reports/GO-2024-2971.yaml - data/reports/GO-2024-2972.yaml - data/reports/GO-2024-2973.yaml - data/reports/GO-2024-2974.yaml Fixes #2968 Fixes #2969 Fixes #2970 Fixes #2971 Fixes #2972 Fixes #2973 Fixes #2974 Change-Id: I0dd8dd80accdd5842a9cb7ebdd49b7698f162f57 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/597158 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Damien Neil <[email protected]>
golang · Jul 9, 2024 · f268f3b · f268f3b
1 parent f272f63
commit f268f3b
Show file tree

Hide file tree

Showing 14 changed files with 630 additions and 0 deletions.
diff --git a/data/osv/GO-2024-2968.json b/data/osv/GO-2024-2968.json
@@ -0,0 +1,107 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2968",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-39683",
+    "GHSA-cvw9-c57h-3397"
+  ],
+  "summary": "ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel",
+  "details": "ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel from v2.0.0 before v2.53.8, from v2.54.0 before v2.54.5, from v2.55.0 before v2.55.1.",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/zitadel/zitadel",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "custom_ranges": [
+          {
+            "type": "ECOSYSTEM",
+            "events": [
+              {
+                "introduced": "2.0.0"
+              },
+              {
+                "fixed": "2.53.8"
+              },
+              {
+                "introduced": "2.54.0"
+              },
+              {
+                "fixed": "2.54.5"
+              },
+              {
+                "introduced": "2.55.0"
+              },
+              {
+                "fixed": "2.55.1"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39683"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/zitadel/zitadel/pull/8231"
+    },
+    {
+      "type": "REPORT",
+      "url": "https://github.com/zitadel/zitadel/issues/8213"
+    },
+    {
+      "type": "WEB",
+      "url": "https://discord.com/channels/927474939156643850/1254096852937347153"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.1"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2968",
+    "review_status": "UNREVIEWED"
+  }
+}
diff --git a/data/osv/GO-2024-2969.json b/data/osv/GO-2024-2969.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2969",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-39930"
+  ],
+  "summary": "CVE-2024-39930 in github.com/gogs/gogs",
+  "details": "CVE-2024-39930 in github.com/gogs/gogs",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/gogs/gogs",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {}
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39930"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/releases"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2969",
+    "review_status": "UNREVIEWED"
+  }
+}
diff --git a/data/osv/GO-2024-2970.json b/data/osv/GO-2024-2970.json
@@ -0,0 +1,53 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2970",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-39931",
+    "GHSA-2vgj-3pvg-xh4w"
+  ],
+  "summary": "Gogs allows deletion of internal files in github.com/gogs/gogs",
+  "details": "Gogs allows deletion of internal files in github.com/gogs/gogs",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/gogs/gogs",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {}
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-2vgj-3pvg-xh4w"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39931"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/releases"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2970",
+    "review_status": "UNREVIEWED"
+  }
+}
diff --git a/data/osv/GO-2024-2971.json b/data/osv/GO-2024-2971.json
@@ -0,0 +1,53 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2971",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-39932",
+    "GHSA-hf29-9hfh-w63j"
+  ],
+  "summary": "Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs",
+  "details": "Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/gogs/gogs",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {}
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-hf29-9hfh-w63j"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39932"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gogs/gogs/releases"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2971",
+    "review_status": "UNREVIEWED"
+  }
+}
diff --git a/data/osv/GO-2024-2972.json b/data/osv/GO-2024-2972.json
@@ -0,0 +1,49 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2972",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-39933",
+    "GHSA-8mm6-wmpp-mmm3"
+  ],
+  "summary": "Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs",
+  "details": "Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/gogs/gogs",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {}
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-8mm6-wmpp-mmm3"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39933"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2972",
+    "review_status": "UNREVIEWED"
+  }
+}