Skip to content

Commit 0d2bb18

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 5 reports
 - data/reports/GO-2025-3699.yaml - data/reports/GO-2025-3700.yaml - data/reports/GO-2025-3701.yaml - data/reports/GO-2025-3702.yaml - data/reports/GO-2025-3703.yaml Fixes #3699 Fixes #3700 Fixes #3701 Fixes #3702 Fixes #3703 Change-Id: Id128994ca9efa96807f9501412a4b5fe15010690 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/675635 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Commit-Queue: Neal Patel <nealpatel@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Neal Patel <nealpatel@google.com>
1 parent d8fdcb3 commit 0d2bb18

10 files changed

+428
-0
lines changed

‎data/osv/GO-2025-3699.json

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3699",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-47290",
8+
"GHSA-cm76-qm8v-3j95"
9+
],
10+
"summary": "containerd allows host filesystem access on pull in github.com/containerd/containerd",
11+
"details": "containerd allows host filesystem access on pull in github.com/containerd/containerd",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/containerd/containerd",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/containerd/containerd/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "2.1.0"
41+
},
42+
{
43+
"fixed": "2.1.1"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47290"
59+
},
60+
{
61+
"type": "FIX",
62+
"url": "https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/containerd/containerd/releases/tag/v2.1.1"
67+
}
68+
],
69+
"database_specific": {
70+
"url": "https://pkg.go.dev/vuln/GO-2025-3699",
71+
"review_status": "UNREVIEWED"
72+
}
73+
}

‎data/osv/GO-2025-3700.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3700",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-48056",
8+
"GHSA-274q-79q9-52j7"
9+
],
10+
"summary": "Character injection in Hubble CLI in github.com/cilium/hubble",
11+
"details": "Character injection in Hubble CLI in github.com/cilium/hubble",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/cilium/hubble",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.17.2"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/cilium/hubble/security/advisories/GHSA-274q-79q9-52j7"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48056"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/cilium/cilium/pull/37401"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3700",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3701.json

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3701",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-47291",
8+
"GHSA-cxfp-7pvr-95ff"
9+
],
10+
"summary": "containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. in github.com/containerd/containerd",
11+
"details": "containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. in github.com/containerd/containerd",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/containerd/containerd",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/containerd/containerd/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "2.0.1"
41+
},
42+
{
43+
"fixed": "2.0.5"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47291"
59+
}
60+
],
61+
"database_specific": {
62+
"url": "https://pkg.go.dev/vuln/GO-2025-3701",
63+
"review_status": "UNREVIEWED"
64+
}
65+
}

‎data/osv/GO-2025-3702.json

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3702",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-48069",
8+
"GHSA-2c47-m757-32g6"
9+
],
10+
"summary": "Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env",
11+
"details": "Insufficient input sanitization in ejson2env in github.com/Shopify/ejson2env",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/Shopify/ejson2env",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/Shopify/ejson2env/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.0.8"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48069"
59+
},
60+
{
61+
"type": "FIX",
62+
"url": "https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3702",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2025-3703.json

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3703",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-5031",
8+
"GHSA-pqqp-7cp8-vxvf"
9+
],
10+
"summary": "Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg",
11+
"details": "Ackites KillWxapkg Zip Bomb Resource Exhaustion in github.com/Ackites/KillWxapkg",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/Ackites/KillWxapkg",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-pqqp-7cp8-vxvf"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5031"
39+
},
40+
{
41+
"type": "REPORT",
42+
"url": "https://github.com/Ackites/KillWxapkg/issues/86"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://vuldb.com/?ctiid.309851"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://vuldb.com/?id.309851"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://vuldb.com/?submit.580524"
55+
}
56+
],
57+
"database_specific": {
58+
"url": "https://pkg.go.dev/vuln/GO-2025-3703",
59+
"review_status": "UNREVIEWED"
60+
}
61+
}

‎data/reports/GO-2025-3699.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: GO-2025-3699
2+
modules:
3+
- module: github.com/containerd/containerd
4+
vulnerable_at: 1.7.27
5+
- module: github.com/containerd/containerd/v2
6+
versions:
7+
- introduced: 2.1.0
8+
- fixed: 2.1.1
9+
vulnerable_at: 2.1.0
10+
summary: containerd allows host filesystem access on pull in github.com/containerd/containerd
11+
cves:
12+
- CVE-2025-47290
13+
ghsas:
14+
- GHSA-cm76-qm8v-3j95
15+
references:
16+
- advisory: https://github.com/containerd/containerd/security/advisories/GHSA-cm76-qm8v-3j95
17+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-47290
18+
- fix: https://github.com/containerd/containerd/commit/cada13298fba85493badb6fecb6ccf80e49673cc
19+
- web: https://github.com/containerd/containerd/releases/tag/v2.1.1
20+
source:
21+
id: GHSA-cm76-qm8v-3j95
22+
created: 2025-05-22T12:45:54.914854-04:00
23+
review_status: UNREVIEWED

‎data/reports/GO-2025-3700.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
id: GO-2025-3700
2+
modules:
3+
- module: github.com/cilium/hubble
4+
versions:
5+
- fixed: 1.17.2
6+
vulnerable_at: 1.17.1
7+
summary: Character injection in Hubble CLI in github.com/cilium/hubble
8+
cves:
9+
- CVE-2025-48056
10+
ghsas:
11+
- GHSA-274q-79q9-52j7
12+
references:
13+
- advisory: https://github.com/cilium/hubble/security/advisories/GHSA-274q-79q9-52j7
14+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-48056
15+
- web: https://github.com/cilium/cilium/pull/37401
16+
source:
17+
id: GHSA-274q-79q9-52j7
18+
created: 2025-05-22T12:45:49.667737-04:00
19+
review_status: UNREVIEWED

‎data/reports/GO-2025-3701.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
id: GO-2025-3701
2+
modules:
3+
- module: github.com/containerd/containerd
4+
vulnerable_at: 1.7.27
5+
- module: github.com/containerd/containerd/v2
6+
versions:
7+
- introduced: 2.0.1
8+
- fixed: 2.0.5
9+
vulnerable_at: 2.0.4
10+
summary: |-
11+
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers
12+
running in usernamespaced Kubernetes pods. in github.com/containerd/containerd
13+
cves:
14+
- CVE-2025-47291
15+
ghsas:
16+
- GHSA-cxfp-7pvr-95ff
17+
references:
18+
- advisory: https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff
19+
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-47291
20+
source:
21+
id: GHSA-cxfp-7pvr-95ff
22+
created: 2025-05-22T12:45:45.287959-04:00
23+
review_status: UNREVIEWED

0 commit comments

Comments
 (0)