Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-32cj-5wx4-gq8p #2921

Closed
GoVulnBot opened this issue Jun 12, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-32cj-5wx4-gq8p #2921

GoVulnBot opened this issue Jun 12, 2024 · 2 comments
Assignees
@tatianab
Labels
triaged

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-32cj-5wx4-gq8p, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/hashicorp/vault 1.15.9 >= 0.11.0, < 1.15.9

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/hashicorp/vault
      non_go_versions:
        - introduced: TODO (earliest fixed "1.17.0", vuln range "= 1.17.0-rc1")
      vulnerable_at: 1.17.0
      packages:
        - package: github.com/hashicorp/vault
    - module: github.com/hashicorp/vault
      versions:
        - introduced: 0.11.0
          fixed: 1.15.9
      packages:
        - package: github.com/hashicorp/vault
    - module: github.com/hashicorp/vault
      versions:
        - introduced: 1.16.0-rc1
          fixed: 1.16.3
      vulnerable_at: 1.16.2
      packages:
        - package: github.com/hashicorp/vault
summary: HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault
cves:
    - CVE-2024-5798
ghsas:
    - GHSA-32cj-5wx4-gq8p
references:
    - advisory: https://github.com/advisories/GHSA-32cj-5wx4-gq8p
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-5798
    - web: https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770
notes:
    - fix: 'module merge error: could not merge versions of module github.com/hashicorp/vault: invalid or non-canonical semver version (found TODO (earliest fixed "1.17.0", vuln range "= 1.17.0-rc1"))'
    - fix: 'github.com/hashicorp/vault: could not add vulnerable_at: version 1.15.9 does not exist'
source:
    id: GHSA-32cj-5wx4-gq8p
    created: 2024-06-12T23:01:21.799534403Z
review_status: UNREVIEWED
@tatianab tatianab self-assigned this Jun 25, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/595957 mentions this issue: data/reports: add 5 reports

@GoVulnBot GoVulnBot mentioned this issue Jul 12, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606360 mentions this issue: data/reports: regenerate 8 reports

gopherbot pushed a commit that referenced this issue Aug 19, 2024
@tatianab @gopherbot
data/reports: regenerate 8 reports
9fd9786 
  - data/reports/GO-2024-2993.yaml
  - data/reports/GO-2024-2997.yaml
  - data/reports/GO-2024-3033.yaml
  - data/reports/GO-2024-3039.yaml
  - data/reports/GO-2024-2921.yaml
  - data/reports/GO-2024-2982.yaml
  - data/reports/GO-2024-3066.yaml
  - data/reports/GO-2024-3070.yaml

Updates #2993
Updates #2997
Updates #3033
Updates #3039
Updates #2921
Updates #2982
Updates #3066
Updates #3070

Change-Id: I5a682ceba4983a42b0d7783535488c5ecf049f25
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606360
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
@GoVulnBot GoVulnBot mentioned this issue Sep 3, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot