Skip to content

Commit d134167

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 12 reports
 - data/reports/GO-2025-3657.yaml - data/reports/GO-2025-3670.yaml - data/reports/GO-2025-3671.yaml - data/reports/GO-2025-3672.yaml - data/reports/GO-2025-3678.yaml - data/reports/GO-2025-3679.yaml - data/reports/GO-2025-3680.yaml - data/reports/GO-2025-3682.yaml - data/reports/GO-2025-3684.yaml - data/reports/GO-2025-3686.yaml - data/reports/GO-2025-3687.yaml - data/reports/GO-2025-3688.yaml Fixes #3657 Fixes #3670 Fixes #3671 Fixes #3672 Fixes #3678 Fixes #3679 Fixes #3680 Fixes #3682 Fixes #3684 Fixes #3686 Fixes #3687 Fixes #3688 Change-Id: Ic1e450f615e770e3e2e5bd1112a7f18cda8aa189 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/673317 Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com> Auto-Submit: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
1 parent adedd96 commit d134167

24 files changed

+897
-0
lines changed

‎data/osv/GO-2025-3657.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3657",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-46331",
8+
"GHSA-w222-m46c-mgh6"
9+
],
10+
"summary": "OpenFGA Authorization Bypass in github.com/openfga/openfga",
11+
"details": "OpenFGA Authorization Bypass in github.com/openfga/openfga",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/openfga/openfga",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.3.6"
24+
},
25+
{
26+
"fixed": "1.8.11"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46331"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3657",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3670.json

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3670",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-46735",
8+
"GHSA-4vgf-2cm4-mp7c"
9+
],
10+
"summary": "Terraform WinDNS Provider improperly sanitizes input variables in `windns_record` in github.com/nrkno/terraform-provider-windns",
11+
"details": "Terraform WinDNS Provider improperly sanitizes input variables in `windns_record` in github.com/nrkno/terraform-provider-windns",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/nrkno/terraform-provider-windns",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/nrkno/terraform-provider-windns/security/advisories/GHSA-4vgf-2cm4-mp7c"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46735"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/nrkno/terraform-provider-windns/commit/c76f69610c1b502f90aaed8c4f102194530b5bce"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2025-3670",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2025-3671.json

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3671",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-46815",
8+
"GHSA-g4r8-mp7g-85fq"
9+
],
10+
"summary": "ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel",
11+
"details": "ZITADEL Allows IdP Intent Token Reuse in github.com/zitadel/zitadel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/zitadel/zitadel before v2.70.10, from v2.71.0 before v2.71.9, from v3.0.0-rc.1 before v3.0.0.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/zitadel/zitadel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0"
35+
},
36+
{
37+
"fixed": "2.70.10"
38+
},
39+
{
40+
"introduced": "2.71.0"
41+
},
42+
{
43+
"fixed": "2.71.9"
44+
},
45+
{
46+
"introduced": "3.0.0-rc.1"
47+
},
48+
{
49+
"fixed": "3.0.0"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-g4r8-mp7g-85fq"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46815"
65+
},
66+
{
67+
"type": "FIX",
68+
"url": "https://github.com/zitadel/zitadel/commit/b1e60e7398d677f08b06fd7715227f70b7ca1162"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.70.10"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.71.9"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://github.com/zitadel/zitadel/releases/tag/v3.0.0"
81+
}
82+
],
83+
"database_specific": {
84+
"url": "https://pkg.go.dev/vuln/GO-2025-3671",
85+
"review_status": "UNREVIEWED"
86+
}
87+
}

‎data/osv/GO-2025-3672.json

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3672",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-46816",
8+
"GHSA-rwj2-w85g-5cmm"
9+
],
10+
"summary": "goshs route not protected, allows command execution in github.com/patrickhener/goshs",
11+
"details": "goshs route not protected, allows command execution in github.com/patrickhener/goshs",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/patrickhener/goshs",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0.3.4"
24+
},
25+
{
26+
"fixed": "1.0.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmm"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46816"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfa"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3672",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3678.json

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3678",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-4432"
8+
],
9+
"summary": "Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring",
10+
"details": "Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/briansmith/ring",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
}
29+
],
30+
"references": [
31+
{
32+
"type": "ADVISORY",
33+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4432"
34+
},
35+
{
36+
"type": "FIX",
37+
"url": "https://github.com/briansmith/ring/commit/ec2d3cf1d91f148c84e4806b4f0b3c98f6df3b38"
38+
},
39+
{
40+
"type": "FIX",
41+
"url": "https://github.com/briansmith/ring/pull/2447"
42+
},
43+
{
44+
"type": "REPORT",
45+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350655"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://access.redhat.com/security/cve/CVE-2025-4432"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/briansmith/ring"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://rustsec.org/advisories/RUSTSEC-2025-0009.html"
62+
}
63+
],
64+
"database_specific": {
65+
"url": "https://pkg.go.dev/vuln/GO-2025-3678",
66+
"review_status": "UNREVIEWED"
67+
}
68+
}

‎data/osv/GO-2025-3679.json

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3679",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-3757",
8+
"GHSA-537f-gxgm-3jjq"
9+
],
10+
"summary": "OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey",
11+
"details": "OpenPubkey Vulnerable to Authentication Bypass in github.com/openpubkey/openpubkey",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/openpubkey/openpubkey",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.10.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/openpubkey/openpubkey/security/advisories/GHSA-537f-gxgm-3jjq"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3757"
42+
}
43+
],
44+
"database_specific": {
45+
"url": "https://pkg.go.dev/vuln/GO-2025-3679",
46+
"review_status": "UNREVIEWED"
47+
}
48+
}

0 commit comments

Comments
 (0)