Skip to content

Commit b2e3abb

Browse files
ethanalee-workgopherbot
ethanalee-work
authored and
gopherbot
committed
data/reports: add 18 reports
 - data/reports/GO-2025-4176.yaml - data/reports/GO-2025-4177.yaml - data/reports/GO-2025-4178.yaml - data/reports/GO-2025-4179.yaml - data/reports/GO-2025-4180.yaml - data/reports/GO-2025-4181.yaml - data/reports/GO-2025-4182.yaml - data/reports/GO-2025-4183.yaml - data/reports/GO-2025-4184.yaml - data/reports/GO-2025-4185.yaml - data/reports/GO-2025-4186.yaml - data/reports/GO-2025-4187.yaml - data/reports/GO-2025-4189.yaml - data/reports/GO-2025-4190.yaml - data/reports/GO-2025-4192.yaml - data/reports/GO-2025-4193.yaml - data/reports/GO-2025-4197.yaml - data/reports/GO-2025-4198.yaml Fixes #4176 Fixes #4177 Fixes #4178 Fixes #4179 Fixes #4180 Fixes #4181 Fixes #4182 Fixes #4183 Fixes #4184 Fixes #4185 Fixes #4186 Fixes #4187 Fixes #4189 Fixes #4190 Fixes #4192 Fixes #4193 Fixes #4197 Fixes #4198 Change-Id: Ie8193b4e4cf42b40c9071607da08d881014eee44 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/727480 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Markus Kusano <[email protected]> Auto-Submit: Ethan Lee <[email protected]>
1 parent f2effae commit b2e3abb

36 files changed

+1719
-0
lines changed

‎data/osv/GO-2025-4176.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4176",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-65105",
8+
"GHSA-j3rw-fx6g-q46j"
9+
],
10+
"summary": "Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer",
11+
"details": "Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/apptainer/apptainer",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.4.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/apptainer/apptainer/security/advisories/GHSA-j3rw-fx6g-q46j"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65105"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981"
46+
},
47+
{
48+
"type": "FIX",
49+
"url": "https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2"
50+
},
51+
{
52+
"type": "FIX",
53+
"url": "https://github.com/apptainer/apptainer/pull/3226"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87"
62+
}
63+
],
64+
"database_specific": {
65+
"url": "https://pkg.go.dev/vuln/GO-2025-4176",
66+
"review_status": "UNREVIEWED"
67+
}
68+
}

‎data/osv/GO-2025-4177.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4177",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-64750",
8+
"GHSA-wwrx-w7c9-rf87"
9+
],
10+
"summary": "Singluarity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity",
11+
"details": "Singluarity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/sylabs/singularity/v4 before v4.1.11.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/sylabs/singularity",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/sylabs/singularity/v4",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {
46+
"custom_ranges": [
47+
{
48+
"type": "ECOSYSTEM",
49+
"events": [
50+
{
51+
"introduced": "0"
52+
},
53+
{
54+
"fixed": "4.1.11"
55+
}
56+
]
57+
}
58+
]
59+
}
60+
}
61+
],
62+
"references": [
63+
{
64+
"type": "ADVISORY",
65+
"url": "https://github.com/sylabs/singularity/security/advisories/GHSA-wwrx-w7c9-rf87"
66+
},
67+
{
68+
"type": "ADVISORY",
69+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64750"
70+
},
71+
{
72+
"type": "FIX",
73+
"url": "https://github.com/sylabs/singularity/commit/27882963879a7af1699fd6511c3f5f1371d80f33"
74+
},
75+
{
76+
"type": "FIX",
77+
"url": "https://github.com/sylabs/singularity/commit/5af3e790c40593591dfc26d0692e4d4b21c29ba0"
78+
},
79+
{
80+
"type": "FIX",
81+
"url": "https://github.com/sylabs/singularity/pull/3850"
82+
},
83+
{
84+
"type": "WEB",
85+
"url": "https://github.com/advisories/GHSA-fh74-hm69-rqjw"
86+
},
87+
{
88+
"type": "WEB",
89+
"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"
90+
}
91+
],
92+
"database_specific": {
93+
"url": "https://pkg.go.dev/vuln/GO-2025-4177",
94+
"review_status": "UNREVIEWED"
95+
}
96+
}

‎data/osv/GO-2025-4178.json‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4178",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-13870",
8+
"GHSA-58w6-w55x-6wq8"
9+
],
10+
"summary": "Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost",
11+
"details": "Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mattermost/mattermost",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "10.5.0+incompatible"
24+
},
25+
{
26+
"fixed": "10.5.13+incompatible"
27+
},
28+
{
29+
"introduced": "10.11.0+incompatible"
30+
},
31+
{
32+
"fixed": "10.11.5+incompatible"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {}
38+
},
39+
{
40+
"package": {
41+
"name": "github.com/mattermost/mattermost-server",
42+
"ecosystem": "Go"
43+
},
44+
"ranges": [
45+
{
46+
"type": "SEMVER",
47+
"events": [
48+
{
49+
"introduced": "0"
50+
}
51+
]
52+
}
53+
],
54+
"ecosystem_specific": {}
55+
},
56+
{
57+
"package": {
58+
"name": "github.com/mattermost/mattermost-server/v5",
59+
"ecosystem": "Go"
60+
},
61+
"ranges": [
62+
{
63+
"type": "SEMVER",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
}
68+
]
69+
}
70+
],
71+
"ecosystem_specific": {}
72+
},
73+
{
74+
"package": {
75+
"name": "github.com/mattermost/mattermost-server/v6",
76+
"ecosystem": "Go"
77+
},
78+
"ranges": [
79+
{
80+
"type": "SEMVER",
81+
"events": [
82+
{
83+
"introduced": "0"
84+
}
85+
]
86+
}
87+
],
88+
"ecosystem_specific": {}
89+
},
90+
{
91+
"package": {
92+
"name": "github.com/mattermost/mattermost/server/v8",
93+
"ecosystem": "Go"
94+
},
95+
"ranges": [
96+
{
97+
"type": "SEMVER",
98+
"events": [
99+
{
100+
"introduced": "0"
101+
},
102+
{
103+
"fixed": "8.0.0-20250905150616-ba86dfc5876b"
104+
}
105+
]
106+
}
107+
],
108+
"ecosystem_specific": {}
109+
}
110+
],
111+
"references": [
112+
{
113+
"type": "ADVISORY",
114+
"url": "https://github.com/advisories/GHSA-58w6-w55x-6wq8"
115+
},
116+
{
117+
"type": "ADVISORY",
118+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13870"
119+
},
120+
{
121+
"type": "FIX",
122+
"url": "https://github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149"
123+
},
124+
{
125+
"type": "WEB",
126+
"url": "https://mattermost.com/security-updates"
127+
}
128+
],
129+
"database_specific": {
130+
"url": "https://pkg.go.dev/vuln/GO-2025-4178",
131+
"review_status": "UNREVIEWED"
132+
}
133+
}

‎data/osv/GO-2025-4179.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4179",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-64443",
8+
"GHSA-46gc-mwh4-cc5r"
9+
],
10+
"summary": "Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway",
11+
"details": "Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/docker/mcp-gateway",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.28.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/docker/mcp-gateway/security/advisories/GHSA-46gc-mwh4-cc5r"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64443"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/docker/mcp-gateway/commit/6b076b2479d8d1345c50c112119c62978d46858e"
46+
},
47+
{
48+
"type": "FIX",
49+
"url": "https://github.com/docker/mcp-gateway/commit/fe073985c8eb6e0c9317d2f198c07686f70ea06d"
50+
},
51+
{
52+
"type": "FIX",
53+
"url": "https://github.com/docker/mcp-gateway/pull/190"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning"
58+
}
59+
],
60+
"database_specific": {
61+
"url": "https://pkg.go.dev/vuln/GO-2025-4179",
62+
"review_status": "UNREVIEWED"
63+
}
64+
}

0 commit comments

Comments
 (0)