Skip to content

Commit 0175e93

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 6 reports
 - data/reports/GO-2025-3645.yaml - data/reports/GO-2025-3646.yaml - data/reports/GO-2025-3647.yaml - data/reports/GO-2025-3648.yaml - data/reports/GO-2025-3649.yaml - data/reports/GO-2025-3650.yaml Fixes #3645 Fixes #3646 Fixes #3647 Fixes #3648 Fixes #3649 Fixes #3650 Change-Id: I92892fe49dd61cbf3d95e2f65e304a96fff4a715 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/668935 Auto-Submit: Neal Patel <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent b80abdd commit 0175e93

12 files changed

+595
-0
lines changed

‎data/osv/GO-2025-3645.json

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3645",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2019-11243",
8+
"GHSA-gc2p-g4fg-29vh"
9+
],
10+
"summary": "Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes",
11+
"details": "Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "k8s.io/kubernetes",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.12.0"
24+
},
25+
{
26+
"fixed": "1.12.5"
27+
},
28+
{
29+
"introduced": "1.13.0"
30+
},
31+
{
32+
"fixed": "1.13.1"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
}
39+
],
40+
"references": [
41+
{
42+
"type": "ADVISORY",
43+
"url": "https://github.com/advisories/GHSA-gc2p-g4fg-29vh"
44+
},
45+
{
46+
"type": "ADVISORY",
47+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11243"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/kubernetes/kubernetes/issues/76797"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://security.netapp.com/advisory/ntap-20190509-0002"
56+
}
57+
],
58+
"database_specific": {
59+
"url": "https://pkg.go.dev/vuln/GO-2025-3645",
60+
"review_status": "UNREVIEWED"
61+
}
62+
}

‎data/osv/GO-2025-3646.json

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3646",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-46599",
8+
"GHSA-864f-7xjm-2jp2"
9+
],
10+
"summary": "CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s",
11+
"details": "CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/k3s-io/k3s from v1.32.0-rc1 before v1.32.4-rc1.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/k3s-io/k3s",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "1.32.0-rc1"
35+
},
36+
{
37+
"fixed": "1.32.4-rc1"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/advisories/GHSA-864f-7xjm-2jp2"
49+
},
50+
{
51+
"type": "ADVISORY",
52+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46599"
53+
},
54+
{
55+
"type": "FIX",
56+
"url": "https://github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a"
57+
},
58+
{
59+
"type": "REPORT",
60+
"url": "https://github.com/k3s-io/k3s/issues/12164"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/f1veT/BUG/issues/2"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1"
73+
}
74+
],
75+
"database_specific": {
76+
"url": "https://pkg.go.dev/vuln/GO-2025-3646",
77+
"review_status": "UNREVIEWED"
78+
}
79+
}

‎data/osv/GO-2025-3647.json

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3647",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-22031",
8+
"GHSA-8h6m-wv39-239m"
9+
],
10+
"summary": "Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher",
11+
"details": "Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.8.0 before v2.9.9, from v2.10.0 before v2.10.5, from v2.11.0 before v2.11.1.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/rancher",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "2.8.0"
35+
},
36+
{
37+
"fixed": "2.9.9"
38+
},
39+
{
40+
"introduced": "2.10.0"
41+
},
42+
{
43+
"fixed": "2.10.5"
44+
},
45+
{
46+
"introduced": "2.11.0"
47+
},
48+
{
49+
"fixed": "2.11.1"
50+
}
51+
]
52+
}
53+
]
54+
}
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m"
61+
}
62+
],
63+
"database_specific": {
64+
"url": "https://pkg.go.dev/vuln/GO-2025-3647",
65+
"review_status": "UNREVIEWED"
66+
}
67+
}

‎data/osv/GO-2025-3648.json

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3648",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-32198",
8+
"GHSA-95fc-g4gj-mqmx"
9+
],
10+
"summary": "Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev",
11+
"details": "Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/steve from v0.3.0 before v0.3.3.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/steve",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "0.3.0"
35+
},
36+
{
37+
"fixed": "0.3.3"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
},
44+
{
45+
"package": {
46+
"name": "github.com/rancher/steve",
47+
"ecosystem": "Go"
48+
},
49+
"ranges": [
50+
{
51+
"type": "SEMVER",
52+
"events": [
53+
{
54+
"introduced": "0.2.0"
55+
},
56+
{
57+
"fixed": "0.2.1"
58+
},
59+
{
60+
"introduced": "0.4.0"
61+
},
62+
{
63+
"fixed": "0.4.4"
64+
},
65+
{
66+
"introduced": "0.5.0"
67+
},
68+
{
69+
"fixed": "0.5.13"
70+
}
71+
]
72+
}
73+
],
74+
"ecosystem_specific": {}
75+
}
76+
],
77+
"references": [
78+
{
79+
"type": "ADVISORY",
80+
"url": "https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx"
81+
}
82+
],
83+
"database_specific": {
84+
"url": "https://pkg.go.dev/vuln/GO-2025-3648",
85+
"review_status": "UNREVIEWED"
86+
}
87+
}

‎data/osv/GO-2025-3649.json

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3649",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-23390",
8+
"GHSA-xgpc-q899-67p8"
9+
],
10+
"summary": "Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet",
11+
"details": "Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/rancher/fleet",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0.9.0-rc.1"
24+
},
25+
{
26+
"fixed": "0.10.12"
27+
},
28+
{
29+
"introduced": "0.11.0"
30+
},
31+
{
32+
"fixed": "0.11.7"
33+
},
34+
{
35+
"introduced": "0.12.0"
36+
},
37+
{
38+
"fixed": "0.12.2"
39+
}
40+
]
41+
}
42+
],
43+
"ecosystem_specific": {}
44+
}
45+
],
46+
"references": [
47+
{
48+
"type": "ADVISORY",
49+
"url": "https://github.com/rancher/fleet/security/advisories/GHSA-xgpc-q899-67p8"
50+
},
51+
{
52+
"type": "FIX",
53+
"url": "https://github.com/rancher/fleet/pull/3571"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/rancher/fleet/pull/3572"
58+
},
59+
{
60+
"type": "FIX",
61+
"url": "https://github.com/rancher/fleet/pull/3573"
62+
},
63+
{
64+
"type": "WEB",
65+
"url": "https://github.com/rancher/fleet/releases/tag/v0.10.12"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://github.com/rancher/fleet/releases/tag/v0.11.7"
70+
},
71+
{
72+
"type": "WEB",
73+
"url": "https://github.com/rancher/fleet/releases/tag/v0.12.2"
74+
}
75+
],
76+
"database_specific": {
77+
"url": "https://pkg.go.dev/vuln/GO-2025-3649",
78+
"review_status": "UNREVIEWED"
79+
}
80+
}

0 commit comments

Comments
 (0)