Skip to content

Commit 28c57d9

Browse files
ethanalee-workgopherbot
ethanalee-work
authored and
gopherbot
committed
data/reports: add 15 reports
 - data/reports/GO-2025-3962.yaml - data/reports/GO-2025-3963.yaml - data/reports/GO-2025-3964.yaml - data/reports/GO-2025-3965.yaml - data/reports/GO-2025-3966.yaml - data/reports/GO-2025-3967.yaml - data/reports/GO-2025-3968.yaml - data/reports/GO-2025-3969.yaml - data/reports/GO-2025-3970.yaml - data/reports/GO-2025-3971.yaml - data/reports/GO-2025-3972.yaml - data/reports/GO-2025-3973.yaml - data/reports/GO-2025-3974.yaml - data/reports/GO-2025-3976.yaml - data/reports/GO-2025-3977.yaml Fixes #3962 Fixes #3963 Fixes #3964 Fixes #3965 Fixes #3966 Fixes #3967 Fixes #3968 Fixes #3969 Fixes #3970 Fixes #3971 Fixes #3972 Fixes #3973 Fixes #3974 Fixes #3976 Fixes #3977 Change-Id: I9e030aae978bf9dbd3e83871c1bfa00ee0f3e1df Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/705856 Reviewed-by: Markus Kusano <kusano@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ethan Lee <ethanalee@google.com>
1 parent 7221410 commit 28c57d9

30 files changed

+1429
-0
lines changed

‎data/osv/GO-2025-3962.json‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3962",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59341",
8+
"GHSA-49pv-gwxp-532r"
9+
],
10+
"summary": "esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh",
11+
"details": "esm.sh has File Inclusion issue in github.com/esm-dev/esm.sh",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/esm-dev/esm.sh",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59341"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2025-3962",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2025-3963.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3963",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59348",
8+
"GHSA-2qgr-gfvj-qpcr"
9+
],
10+
"summary": "Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly",
11+
"details": "Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "d7y.io/dragonfly/v2",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "2.1.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/dragonflyoss/dragonfly",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-2qgr-gfvj-qpcr"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59348"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3963",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2025-3964.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3964",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59349",
8+
"GHSA-8425-8r2f-mrv6"
9+
],
10+
"summary": "Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly",
11+
"details": "Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "d7y.io/dragonfly/v2",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "2.1.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/dragonflyoss/dragonfly",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-8425-8r2f-mrv6"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59349"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3964",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2025-3965.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3965",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59345",
8+
"GHSA-89vc-vf32-ch59"
9+
],
10+
"summary": "Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly",
11+
"details": "Dragonfly doesn't have authentication enabled for some Manager’s endpoints in d7y.io/dragonfly",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "d7y.io/dragonfly/v2",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "2.1.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/dragonflyoss/dragonfly",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-89vc-vf32-ch59"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59345"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3965",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2025-3966.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3966",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59347",
8+
"GHSA-98x5-jw98-6c97"
9+
],
10+
"summary": "Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly",
11+
"details": "Dragonfly's manager makes requests to external endpoints with disabled TLS authentication in d7y.io/dragonfly",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "d7y.io/dragonfly/v2",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "2.1.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
},
33+
{
34+
"package": {
35+
"name": "github.com/dragonflyoss/dragonfly",
36+
"ecosystem": "Go"
37+
},
38+
"ranges": [
39+
{
40+
"type": "SEMVER",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-98x5-jw98-6c97"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59347"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/dragonflyoss/dragonfly/blob/main/docs/security/dragonfly-comprehensive-report-2023.pdf"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3966",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2025-3967.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3967",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-59342",
8+
"GHSA-g2h5-cvvr-7gmw"
9+
],
10+
"summary": "esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh",
11+
"details": "esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/esm-dev/esm.sh",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g2h5-cvvr-7gmw"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59342"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/esm-dev/esm.sh/commit/833a29f42aeb0acbd7089a71be11dd0a292d3151"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L116"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/esm-dev/esm.sh/blob/main/server/router.go#L411"
51+
}
52+
],
53+
"database_specific": {
54+
"url": "https://pkg.go.dev/vuln/GO-2025-3967",
55+
"review_status": "UNREVIEWED"
56+
}
57+
}

0 commit comments

Comments
 (0)