Skip to content

Commit 91bf12f

Browse files
rolandshoemakerrolandshoemaker
committed
reports: add a handful of CVEs
Results of testing new CVE triaging tooling. Also adds a file which tracks which CVEs have been triaged. Still need to add all of the false positives, but would like to fine tune the triage tooling first to hopefully cut down the number of them. Change-Id: I7591b10f5abc5e73b6a3291beeaedca0032ad02f Reviewed-on: https://team-review.git.corp.google.com/c/golang/vulndb/+/1053804 Reviewed-by: Roland Shoemaker <[email protected]>
1 parent 0cb7a21 commit 91bf12f

28 files changed

+601
-7
lines changed

Diff for: ‎reports/GO-2020-0005.toml

-3
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,6 @@ credit = "Trail of Bits"
1414
symbols = ["WAL.ReadAll"]
1515

1616
[[versions]]
17-
# Do we also need a way to indicate "fixed after this version, but also these specific
18-
# earlier point releases are also fixed"? In this case >= 3.4.10 is fixed, but so was
19-
# 3.3.23
2017
fixed = "v0.5.0-alpha.5.0.20200423152442-f4b650b51dc4"
2118

2219
[links]

Diff for: ‎reports/GO-2021-0056.toml

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
module = "github.com/russellhaering/goxmldsig"
1+
module = "github.com/dexidp/dex"
2+
package = "github.com/dexidp/dex/connector/saml"
23

34
description = """
45
An XML message can be maliciously crafted such that signature
@@ -9,11 +10,11 @@ cve = "CVE-2020-15216"
910

1011
credit = "Juho Nurminen (Mattermost)"
1112

12-
symbols = ["ValidationContext.findSignature"]
13+
symbols = ["provider.HandlePOST"]
1314

1415
[[versions]]
15-
fixed = "v1.1.0"
16+
fixed = "v0.0.0-20201214082111-324b1c886b40"
1617

1718
[links]
1819
commit = "https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8"
19-
context = ["https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7"]
20+
context = ["https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5"]

Diff for: ‎reports/GO-2021-0070.toml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
module = "github.com/opencontainers/runc"
2+
package = "github.com/opencontainers/runc/libcontainer/user"
3+
4+
description = """
5+
GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will
6+
improperly interpred numeric UIDs as usernames. If the method is used without
7+
verify usernames are formatted as expected, it may allow a user to gain unexpected
8+
privileges.
9+
"""
10+
11+
cve = "CVE-2016-3697"
12+
13+
symbols = ["GetExecUser"]
14+
15+
[[versions]]
16+
fixed = "v0.1.0"
17+
18+
[links]
19+
commit = "https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091"
20+
pr = "https://github.com/opencontainers/runc/pull/708"
21+
context = [
22+
"https://github.com/docker/docker/issues/21436",
23+
"http://rhn.redhat.com/errata/RHSA-2016-1034.html",
24+
"http://rhn.redhat.com/errata/RHSA-2016-2634.html",
25+
"https://security.gentoo.org/glsa/201612-28"
26+
]

Diff for: ‎reports/GO-2021-0071.toml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
module = "github.com/lxc/lxd"
2+
package = "github.com/lxc/lxd/shared"
3+
4+
description = """
5+
A race between chown and chmod operations during a container filesystem shift
6+
may allow a user who can modify the filesystem to chmod an arbitary path of
7+
their choice, rather than the expected path.
8+
"""
9+
10+
cve = "CVE-2015-1340"
11+
12+
credit = "Seth Arnold"
13+
14+
symbols = ["IdmapSet.doUidshiftIntoContainer"]
15+
16+
[[versions]]
17+
fixed = "v0.0.0-20151004155856-19c6961cc101"
18+
19+
[links]
20+
commit = "https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4"
21+
pr = "https://github.com/lxc/lxd/pull/1189"
22+
context = ["https://bugs.launchpad.net/ubuntu/+source/lxd/+bug/1502270"]

Diff for: ‎reports/GO-2021-0072.toml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
module = "github.com/docker/distribution"
2+
package = "github.com/docker/distribution/registry/handlers"
3+
4+
description = """
5+
Various storage methods do not impose limits on how much content is accepted
6+
from user requests, allowing a malicious user to force the caller to allocate
7+
an arbitary amount of memory.
8+
"""
9+
10+
cve = "CVE-2017-11468"
11+
12+
symbols = ["copyFullPayload"]
13+
14+
[[versions]]
15+
fixed = "v2.7.0-rc.0+incompatible"
16+
17+
[[additional_packages]]
18+
module = "github.com/docker/distribution"
19+
package = "github.com/docker/distribution/registry/storage"
20+
symbols = ["blobStore.Get"]
21+
[[additional_packages.versions]]
22+
fixed = "v2.7.0-rc.0+incompatible"
23+
24+
[links]
25+
commit = "https://github.com/distribution/distribution/commit/91c507a39abfce14b5c8541cf284330e22208c0f"
26+
pr = "https://github.com/distribution/distribution/pull/2340"
27+
context = [
28+
"https://access.redhat.com/errata/RHSA-2017:2603",
29+
"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00047.html"
30+
]

Diff for: ‎reports/GO-2021-0073.toml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
module = "github.com/git-lfs/git-lfs"
2+
package = "github.com/git-lfs/git-lfs/lfsapi"
3+
4+
description = """
5+
Arbitary command execution can be triggered by improperly
6+
sanitized SSH URLs in LFS configuration files. This can be
7+
triggered by cloning a malicious repoistory.
8+
"""
9+
10+
cve = "CVE-2017-17831"
11+
12+
symbols = ["sshGetLFSExeAndArgs"]
13+
14+
[[versions]]
15+
fixed = "v2.1.1-0.20170519163204-f913f5f9c7c6+incompatible"
16+
17+
[links]
18+
commit = "https://github.com/git-lfs/git-lfs/commit/f913f5f9c7c6d1301785fdf9884a2942d59cdf19"
19+
pr = "https://github.com/git-lfs/git-lfs/pull/2241"
20+
context = [
21+
"http://blog.recurity-labs.com/2017-08-10/scm-vulns",
22+
"https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html",
23+
"http://www.securityfocus.com/bid/102926"
24+
]

Diff for: ‎reports/GO-2021-0075.toml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
module = "github.com/ethereum/go-ethereum"
2+
package = "github.com/ethereum/go-ethereum/les"
3+
4+
description = """
5+
Due to improper argument validation in RPC messages, a maliciously crafted
6+
message can cause a panic, leading to denial of service.
7+
"""
8+
9+
cve = "CVE-2018-12018"
10+
11+
symbols = ["protocolManager.handleMsg"]
12+
13+
[[versions]]
14+
fixed = "v1.8.11"
15+
16+
[links]
17+
commit = "https://github.com/ethereum/go-ethereum/commit/a5237a27eaf81946a3edb4fafe13ed6359d119e4"
18+
pr = "https://github.com/ethereum/go-ethereum/pull/16891"
19+
context = ["https://peckshield.com/2018/06/27/EPoD/"]

Diff for: ‎reports/GO-2021-0076.toml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
module = "github.com/evanphx/json-patch"
2+
3+
description = """
4+
A malicious JSON patch can cause a panic due to an out-of-bounds
5+
write attempt. This can be used as a denial of service vector if
6+
exposed to arbitary user input.
7+
"""
8+
9+
cve = "CVE-2018-14632"
10+
11+
symbols = ["partialArray.add"]
12+
13+
[[versions]]
14+
fixed = "v0.5.2"
15+
16+
[links]
17+
commit = "https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03"
18+
pr = "https://github.com/evanphx/json-patch/pull/57"

Diff for: ‎reports/GO-2021-0077.toml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
module = "go.etcd.io/etcd"
2+
package = "go.etcd.io/etcd/auth"
3+
4+
description = """
5+
A user can use a valid client certificate that contains a CommonName that matches a
6+
valid RBAC username to authenticate themselves as that user, despite lacking the
7+
required credentials. This may allow authentication bypass, but requires a certificate
8+
that is issued by a CA trusted by the server.
9+
"""
10+
11+
cve = "CVE-2018-16886"
12+
13+
symbols = ["authStore.AuthInfoFromTLS"]
14+
15+
[[versions]]
16+
fixed = "v0.5.0-alpha.5.0.20190108173120-83c051b701d3"
17+
18+
[links]
19+
commit = "https://github.com/etcd-io/etcd/commit/bf9d0d8291dc71ecbfb2690612954e1a298154b2"
20+
pr = "https://github.com/etcd-io/etcd/pull/10366"

Diff for: ‎reports/GO-2021-0078.toml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
module = "golang.org/x/net"
2+
package = "golang.org/x/net/html"
3+
4+
description = """
5+
The HTML parser does not properly handle "in frameset" insertion mode, and can be made
6+
to panic when operating on malformed HTML that contains <template> tags. If operating
7+
on user input, this may be a vector for a denial of service attack.
8+
"""
9+
10+
cve = "CVE-2018-17075"
11+
12+
credit = "Kunpei Sakai"
13+
14+
symbols = ["inBodyIM", "inFramesetIM"]
15+
16+
[[versions]]
17+
fixed = "v0.0.0-20180816102801-aaf60122140d"
18+
19+
[links]
20+
commit = "https://github.com/golang/net/commit/aaf60122140d3fcf75376d319f0554393160eb50"
21+
pr = "https://go-review.googlesource.com/123776"
22+
context = [
23+
"https://github.com/golang/go/issues/27016",
24+
"https://bugs.chromium.org/p/chromium/issues/detail?id=829668",
25+
"https://go-review.googlesource.com/c/net/+/94838/9/html/parse.go#1906"
26+
]

Diff for: ‎reports/GO-2021-0079.toml

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
module = "github.com/bytom/bytom"
2+
package = "github.com/bytom/bytom/p2p/discover"
3+
4+
description = """
5+
A malformed query can cause an out-of-bounds panic due to improper
6+
validation of arguments. If processing queries from untrusted
7+
parties, this may be used as a vector for denial of service
8+
attacks.
9+
"""
10+
11+
cve = "CVE-2018-18206"
12+
13+
credit = "@yahtoo"
14+
15+
symbols = ["Network.checkTopicRegister"]
16+
17+
[[versions]]
18+
fixed = "v1.0.4-0.20180831054840-1ac3c8ac4f2b"
19+
20+
[links]
21+
commit = "https://github.com/Bytom/bytom/commit/1ac3c8ac4f2b1e1df9675228290bda6b9586ba42"
22+
pr = "https://github.com/Bytom/bytom/pull/1307"

Diff for: ‎reports/GO-2021-0081.toml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
module = "github.com/containers/image"
2+
package = "github.com/containers/image/docker"
3+
4+
description = """
5+
The HTTP client used to connect to the container registry authorization
6+
service explicitly disables TLS verification, allowing an attacker that
7+
is able to MITM the connection to steal credentials.
8+
"""
9+
10+
cve = "CVE-2019-10214"
11+
12+
symbols = ["dockerClient.getBearerToken"]
13+
14+
[[versions]]
15+
introduced = ""
16+
fixed = "v2.0.2-0.20190802080134-634605d06e73+incompatible"
17+
18+
[links]
19+
commit = "https://github.com/containers/image/commit/634605d06e738aec8332bcfd69162e7509ac7aaf"
20+
pr = "https://github.com/containers/image/pull/669"
21+
context = [
22+
"https://github.com/containers/image/issues/654",
23+
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214"
24+
]

Diff for: ‎reports/GO-2021-0082.toml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
module = "github.com/facebook/fbthrift"
2+
package = "github.com/facebook/fbthrift/thrift/lib/go/thrift"
3+
4+
description = """
5+
Thirft Servers preallocate memory for the declared size of messages before
6+
checking the actual size of the message. This allows a malicious user to
7+
send messages that declare that they are significantly larger than they
8+
actually are, allowing them to force the server to allocate significant
9+
amounts of memory. This can be used as a denial of service vector.
10+
"""
11+
12+
cve = "CVE-2019-11939"
13+
14+
[[versions]]
15+
fixed = "v0.31.1-0.20200311080807-483ed864d69f"
16+
17+
[links]
18+
commit = "https://github.com/facebook/fbthrift/commit/483ed864d69f307e9e3b9dadec048216100c0757"
19+
context = ["https://www.facebook.com/security/advisories/cve-2019-11939"]

Diff for: ‎reports/GO-2021-0083.toml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
module = "github.com/hybridgroup/gobot"
2+
package = "github.com/hybridgroup/gobot/platforms/mqtt"
3+
4+
description = """
5+
TLS certificate verification is skipped when connecting to a MQTT server.
6+
This allows an attacker who can MITM the connection to read, or forge,
7+
messages passed between the client and server.
8+
"""
9+
10+
cve = "CVE-2019-12496"
11+
12+
symbols = ["Adaptor.newTLSConfig"]
13+
14+
[[versions]]
15+
fixed = "v1.12.1-0.20190521122906-c1aa4f867846"
16+
17+
[links]
18+
commit = "https://github.com/hybridgroup/gobot/commit/c1aa4f867846da4669ecf3bc3318bd96b7ee6f3f"
19+
context = ["https://github.com/hybridgroup/gobot/releases/tag/v1.13.0"]

Diff for: ‎reports/GO-2021-0084.toml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
module = "github.com/astaxie/beego"
2+
package = "github.com/astaxie/beego/session"
3+
4+
description = """
5+
Session data is stored using permissive permissions, allowing local users
6+
with filesystem access to read arbitary data.
7+
"""
8+
9+
cve = "CVE-2019-16354"
10+
11+
credit = "@nicowaisman"
12+
13+
symbols = ["FileProvider.SessionRead", "FileProvider.SessionRegenerate"]
14+
15+
[[versions]]
16+
fixed = "v1.12.2-0.20200613154013-bac2b31afecc"
17+
18+
[links]
19+
commit = "https://github.com/beego/beego/commit/bac2b31afecc65d9a89f9e473b8006c5edc0c8d1"
20+
pr = "https://github.com/beego/beego/pull/3975"
21+
context = ["https://github.com/beego/beego/issues/3763"]

Diff for: ‎reports/GO-2021-0085.toml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
module = "github.com/opencontainers/runc"
2+
package = "github.com/opencontainers/runc/libcontainer"
3+
4+
description = """
5+
AppArmor restrictions may be bypassed due to improper validation of mount
6+
targets, allowing a malicious image to mount volumes over e.g. /proc.
7+
"""
8+
9+
cve = "CVE-2019-16884"
10+
11+
credit = "Leopold Schabel"
12+
13+
[[versions]]
14+
fixed = "v1.0.0-rc8.0.20190930145003-cad42f6e0932"
15+
16+
[[additional_packages]]
17+
module = "github.com/opencontainers/selinux"
18+
package = "github.com/opencontainers/selinux/go-selinux"
19+
[[additional_packages.versions]]
20+
fixed = "v1.3.1-0.20190929122143-5215b1806f52"
21+
22+
[links]
23+
commit = "https://github.com/opencontainers/runc/commit/cad42f6e0932db0ce08c3a3d9e89e6063ec283e4"
24+
pr = "https://github.com/opencontainers/runc/pull/2130"
25+
context = ["https://github.com/opencontainers/runc/issues/2128"]

Diff for: ‎reports/GO-2021-0086.toml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
module = "github.com/documize/community"
2+
package = "github.com/documize/community/domain/section/markdown"
3+
4+
description = """
5+
HTML content in mardkwon is not santized during rendering, possibly allowing
6+
XSS if used to render untrusted user input.
7+
"""
8+
9+
cve = "CVE-2019-19619"
10+
11+
symbols = ["Provider.Render"]
12+
13+
[[versions]]
14+
fixed = "v1.76.3-0.20191119114751-a4384210d4d0"
15+
16+
[links]
17+
commit = "https://github.com/documize/community/commit/a4384210d4d0d6b18e6fdb7e155de96d4a1cf9f3"

0 commit comments

Comments
 (0)