Skip to content

Commit

Permalink
data/reports: add 3 standard library reports
Browse files Browse the repository at this point in the history 
  - data/reports/GO-2024-3105.yaml
  - data/reports/GO-2024-3106.yaml
  - data/reports/GO-2024-3107.yaml

Updates #3105
Updates #3106
Updates #3107

Change-Id: Ic1fcc7db2f64a1be3125bd504f66de12f0492fc4
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/610805
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
  • Loading branch information
@tatianab @gopherbot
tatianab authored and gopherbot committed Sep 6, 2024
1 parent 6c9e647 commit 10c7959
Show file tree
Hide file tree
Showing 9 changed files with 559 additions and 0 deletions.
85 changes: 85 additions & 0 deletions data/cve/v5/GO-2024-3105.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,85 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.0",
"cveMetadata": {
"cveId": "CVE-2024-34155"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
},
"title": "Stack exhaustion in all Parse functions in go/parser",
"descriptions": [
{
"lang": "en",
"value": "Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion."
}
],
"affected": [
{
"vendor": "Go standard library",
"product": "go/parser",
"collectionURL": "https://pkg.go.dev",
"packageName": "go/parser",
"versions": [
{
"version": "0",
"lessThan": "1.22.7",
"status": "affected",
"versionType": "semver"
},
{
"version": "1.23.0-0",
"lessThan": "1.23.1",
"status": "affected",
"versionType": "semver"
}
],
"programRoutines": [
{
"name": "parser.parseLiteralValue"
},
{
"name": "ParseDir"
},
{
"name": "ParseExpr"
},
{
"name": "ParseExprFrom"
},
{
"name": "ParseFile"
}
],
"defaultStatus": "unaffected"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-674: Uncontrolled Recursion"
}
]
}
],
"references": [
{
"url": "https://go.dev/cl/611238"
},
{
"url": "https://go.dev/issue/69138"
},
{
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"url": "https://pkg.go.dev/vuln/GO-2024-3105"
}
]
}
}
}
85 changes: 85 additions & 0 deletions data/cve/v5/GO-2024-3106.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,85 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.0",
"cveMetadata": {
"cveId": "CVE-2024-34156"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
},
"title": "Stack exhaustion in Decoder.Decode in encoding/gob",
"descriptions": [
{
"lang": "en",
"value": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635."
}
],
"affected": [
{
"vendor": "Go standard library",
"product": "encoding/gob",
"collectionURL": "https://pkg.go.dev",
"packageName": "encoding/gob",
"versions": [
{
"version": "0",
"lessThan": "1.22.7",
"status": "affected",
"versionType": "semver"
},
{
"version": "1.23.0-0",
"lessThan": "1.23.1",
"status": "affected",
"versionType": "semver"
}
],
"programRoutines": [
{
"name": "Decoder.decIgnoreOpFor"
},
{
"name": "Decoder.Decode"
},
{
"name": "Decoder.DecodeValue"
}
],
"defaultStatus": "unaffected"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-674: Uncontrolled Recursion"
}
]
}
],
"references": [
{
"url": "https://go.dev/cl/611239"
},
{
"url": "https://go.dev/issue/69139"
},
{
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"url": "https://pkg.go.dev/vuln/GO-2024-3106"
}
],
"credits": [
{
"lang": "en",
"value": "Md Sakib Anwar of The Ohio State University (anwar.40@osu.edu)"
}
]
}
}
}
79 changes: 79 additions & 0 deletions data/cve/v5/GO-2024-3107.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.0",
"cveMetadata": {
"cveId": "CVE-2024-34158"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
},
"title": "Stack exhaustion in Parse in go/build/constraint",
"descriptions": [
{
"lang": "en",
"value": "Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion."
}
],
"affected": [
{
"vendor": "Go standard library",
"product": "go/build/constraint",
"collectionURL": "https://pkg.go.dev",
"packageName": "go/build/constraint",
"versions": [
{
"version": "0",
"lessThan": "1.22.7",
"status": "affected",
"versionType": "semver"
},
{
"version": "1.23.0-0",
"lessThan": "1.23.1",
"status": "affected",
"versionType": "semver"
}
],
"programRoutines": [
{
"name": "parsePlusBuildExpr"
},
{
"name": "exprParser.not"
},
{
"name": "Parse"
}
],
"defaultStatus": "unaffected"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-674: Uncontrolled Recursion"
}
]
}
],
"references": [
{
"url": "https://go.dev/cl/611240"
},
{
"url": "https://go.dev/issue/69141"
},
{
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"url": "https://pkg.go.dev/vuln/GO-2024-3107"
}
]
}
}
}
70 changes: 70 additions & 0 deletions data/osv/GO-2024-3105.json
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
{
"schema_version": "1.3.1",
"id": "GO-2024-3105",
"modified": "0001-01-01T00:00:00Z",
"published": "0001-01-01T00:00:00Z",
"aliases": [
"CVE-2024-34155"
],
"summary": "Stack exhaustion in all Parse functions in go/parser",
"details": "Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.",
"affected": [
{
"package": {
"name": "stdlib",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.22.7"
},
{
"introduced": "1.23.0-0"
},
{
"fixed": "1.23.1"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "go/parser",
"symbols": [
"ParseDir",
"ParseExpr",
"ParseExprFrom",
"ParseFile",
"parser.parseLiteralValue"
]
}
]
}
}
],
"references": [
{
"type": "FIX",
"url": "https://go.dev/cl/611238"
},
{
"type": "REPORT",
"url": "https://go.dev/issue/69138"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
}
],
"database_specific": {
"url": "https://pkg.go.dev/vuln/GO-2024-3105",
"review_status": "REVIEWED"
}
}
Loading

0 comments on commit 10c7959

Please sign in to comment.