Skip to content

Commit bfd27ad

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add 2 needs review reports
 - data/reports/GO-2024-3279.yaml - data/reports/GO-2024-3282.yaml Updates #3279 Updates #3282 Change-Id: I198fb77d1510d966d66fd34906f15ae24a1f2364 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/630756 Auto-Submit: Tatiana Bradley <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 842487c commit bfd27ad

File tree

4 files changed

+166
-0
lines changed

4 files changed

+166
-0
lines changed

‎data/osv/GO-2024-3279.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3279",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-7225-m954-23v7"
8+
],
9+
"summary": "ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic",
10+
"details": "ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "cosmossdk.io/math",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.4.0"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862"
41+
}
42+
],
43+
"database_specific": {
44+
"url": "https://pkg.go.dev/vuln/GO-2024-3279",
45+
"review_status": "UNREVIEWED"
46+
}
47+
}

‎data/osv/GO-2024-3282.json‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3282",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-r4pg-vg54-wxx4"
8+
],
9+
"summary": "cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager",
10+
"details": "cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/cert-manager/cert-manager",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.12.14"
26+
},
27+
{
28+
"introduced": "1.13.0-alpha.0"
29+
},
30+
{
31+
"fixed": "1.15.4"
32+
},
33+
{
34+
"introduced": "1.16.0-alpha.0"
35+
},
36+
{
37+
"fixed": "1.16.2"
38+
}
39+
]
40+
}
41+
],
42+
"ecosystem_specific": {}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4"
49+
},
50+
{
51+
"type": "FIX",
52+
"url": "https://github.com/cert-manager/cert-manager/pull/7400"
53+
},
54+
{
55+
"type": "FIX",
56+
"url": "https://github.com/cert-manager/cert-manager/pull/7401"
57+
},
58+
{
59+
"type": "FIX",
60+
"url": "https://github.com/cert-manager/cert-manager/pull/7402"
61+
},
62+
{
63+
"type": "FIX",
64+
"url": "https://github.com/cert-manager/cert-manager/pull/7403"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://go.dev/issue/50116"
69+
}
70+
],
71+
"database_specific": {
72+
"url": "https://pkg.go.dev/vuln/GO-2024-3282",
73+
"review_status": "UNREVIEWED"
74+
}
75+
}

‎data/reports/GO-2024-3279.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: GO-2024-3279
2+
modules:
3+
- module: cosmossdk.io/math
4+
versions:
5+
- fixed: 1.4.0
6+
vulnerable_at: 1.3.0
7+
summary: |-
8+
ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and
9+
sdk.Dec can lead to panic
10+
ghsas:
11+
- GHSA-7225-m954-23v7
12+
references:
13+
- advisory: https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-7225-m954-23v7
14+
- web: https://github.com/cosmos/cosmos-sdk/commit/c6522a72a45c34897f9fc85d438c0b74d52f8862
15+
source:
16+
id: GHSA-7225-m954-23v7
17+
created: 2024-11-21T14:39:42.980234-05:00
18+
review_status: NEEDS_REVIEW

‎data/reports/GO-2024-3282.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
id: GO-2024-3282
2+
modules:
3+
- module: github.com/cert-manager/cert-manager
4+
versions:
5+
- fixed: 1.12.14
6+
- introduced: 1.13.0-alpha.0
7+
- fixed: 1.15.4
8+
- introduced: 1.16.0-alpha.0
9+
- fixed: 1.16.2
10+
vulnerable_at: 1.16.1
11+
summary: |-
12+
cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM
13+
inputs in github.com/cert-manager/cert-manager
14+
ghsas:
15+
- GHSA-r4pg-vg54-wxx4
16+
references:
17+
- advisory: https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4
18+
- fix: https://github.com/cert-manager/cert-manager/pull/7400
19+
- fix: https://github.com/cert-manager/cert-manager/pull/7401
20+
- fix: https://github.com/cert-manager/cert-manager/pull/7402
21+
- fix: https://github.com/cert-manager/cert-manager/pull/7403
22+
- web: https://go.dev/issue/50116
23+
source:
24+
id: GHSA-r4pg-vg54-wxx4
25+
created: 2024-11-21T14:39:18.975104-05:00
26+
review_status: NEEDS_REVIEW

0 commit comments

Comments
 (0)