diff --git a/data/osv/GO-2024-3250.json b/data/osv/GO-2024-3250.json new file mode 100644 index 00000000..8758d5fd --- /dev/null +++ b/data/osv/GO-2024-3250.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3250", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-51744", + "GHSA-29wx-vh33-7x7r" + ], + "summary": "Bad documentation of error handling in ParseWithClaims may lead to dangerous situations in github.com/golang-jwt/jwt", + "details": "Bad documentation of error handling in ParseWithClaims may lead to dangerous situations in github.com/golang-jwt/jwt", + "affected": [ + { + "package": { + "name": "github.com/golang-jwt/jwt/v4", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.5.1" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/golang-jwt/jwt/v4", + "symbols": [ + "Parse", + "ParseWithClaims", + "Parser.Parse", + "Parser.ParseWithClaims" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r" + }, + { + "type": "FIX", + "url": "https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3250", + "review_status": "REVIEWED" + } +} \ No newline at end of file diff --git a/data/reports/GO-2024-3250.yaml b/data/reports/GO-2024-3250.yaml new file mode 100644 index 00000000..165090e3 --- /dev/null +++ b/data/reports/GO-2024-3250.yaml @@ -0,0 +1,28 @@ +id: GO-2024-3250 +modules: + - module: github.com/golang-jwt/jwt/v4 + versions: + - fixed: 4.5.1 + vulnerable_at: 4.5.0 + packages: + - package: github.com/golang-jwt/jwt/v4 + symbols: + - Parser.ParseWithClaims + derived_symbols: + - Parse + - ParseWithClaims + - Parser.Parse +summary: |- + Bad documentation of error handling in ParseWithClaims may lead to + dangerous situations in github.com/golang-jwt/jwt +cves: + - CVE-2024-51744 +ghsas: + - GHSA-29wx-vh33-7x7r +references: + - advisory: https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r + - fix: https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c +source: + id: GHSA-29wx-vh33-7x7r + created: 2024-11-08T12:21:43.987103-05:00 +review_status: REVIEWED