Skip to content

Commit 5530387

Browse files
jbajba
committed
data/reports: add GO-2023-2113.yaml
Aliases: CVE-2022-21698, CVE-2023-25151, CVE-2023-45142, GHSA-5r5m-65gx-7vrh, GHSA-cg3q-j54f-5p7p Fixes #2113 Change-Id: I07a9bf749be5714572a13d962ea37a5455b5dd9e Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/535155 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jonathan Amsterdam <jba@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
1 parent 03ba437 commit 5530387

File tree

2 files changed

+350
-0
lines changed

2 files changed

+350
-0
lines changed

‎data/osv/GO-2023-2113.json

+254
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2023-2113",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-45142",
8+
"GHSA-rcjv-mgp8-qvmr"
9+
],
10+
"summary": "Memory exhaustion in github.com/open-telemetry/opentelemetry-go-contrib",
11+
"details": "Memory exhaustion in github.com/open-telemetry/opentelemetry-go-contrib",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.44.0"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful/internal/semconvutil",
35+
"symbols": [
36+
"HTTPClientRequest",
37+
"HTTPServerRequest",
38+
"httpConv.ClientRequest",
39+
"httpConv.ServerRequest",
40+
"httpConv.proto"
41+
]
42+
}
43+
]
44+
}
45+
},
46+
{
47+
"package": {
48+
"name": "go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin",
49+
"ecosystem": "Go"
50+
},
51+
"ranges": [
52+
{
53+
"type": "SEMVER",
54+
"events": [
55+
{
56+
"introduced": "0"
57+
},
58+
{
59+
"fixed": "0.44.0"
60+
}
61+
]
62+
}
63+
],
64+
"ecosystem_specific": {
65+
"imports": [
66+
{
67+
"path": "go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin/internal/semconvutil",
68+
"symbols": [
69+
"HTTPClientRequest",
70+
"HTTPServerRequest",
71+
"httpConv.ClientRequest",
72+
"httpConv.ServerRequest",
73+
"httpConv.proto"
74+
]
75+
}
76+
]
77+
}
78+
},
79+
{
80+
"package": {
81+
"name": "go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux",
82+
"ecosystem": "Go"
83+
},
84+
"ranges": [
85+
{
86+
"type": "SEMVER",
87+
"events": [
88+
{
89+
"introduced": "0"
90+
},
91+
{
92+
"fixed": "0.44.0"
93+
}
94+
]
95+
}
96+
],
97+
"ecosystem_specific": {
98+
"imports": [
99+
{
100+
"path": "go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux/internal/semconvutil",
101+
"symbols": [
102+
"HTTPClientRequest",
103+
"HTTPServerRequest",
104+
"httpConv.ClientRequest",
105+
"httpConv.ServerRequest",
106+
"httpConv.proto"
107+
]
108+
}
109+
]
110+
}
111+
},
112+
{
113+
"package": {
114+
"name": "go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho",
115+
"ecosystem": "Go"
116+
},
117+
"ranges": [
118+
{
119+
"type": "SEMVER",
120+
"events": [
121+
{
122+
"introduced": "0"
123+
},
124+
{
125+
"fixed": "0.44.0"
126+
}
127+
]
128+
}
129+
],
130+
"ecosystem_specific": {
131+
"imports": [
132+
{
133+
"path": "go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho/internal/semconvutil",
134+
"symbols": [
135+
"HTTPClientRequest",
136+
"HTTPServerRequest",
137+
"httpConv.ClientRequest",
138+
"httpConv.ServerRequest",
139+
"httpConv.proto"
140+
]
141+
}
142+
]
143+
}
144+
},
145+
{
146+
"package": {
147+
"name": "go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron",
148+
"ecosystem": "Go"
149+
},
150+
"ranges": [
151+
{
152+
"type": "SEMVER",
153+
"events": [
154+
{
155+
"introduced": "0"
156+
},
157+
{
158+
"fixed": "0.44.0"
159+
}
160+
]
161+
}
162+
],
163+
"ecosystem_specific": {
164+
"imports": [
165+
{
166+
"path": "go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron/internal/semconvutil",
167+
"symbols": [
168+
"HTTPClientRequest",
169+
"HTTPServerRequest",
170+
"httpConv.ClientRequest",
171+
"httpConv.ServerRequest",
172+
"httpConv.proto"
173+
]
174+
}
175+
]
176+
}
177+
},
178+
{
179+
"package": {
180+
"name": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace",
181+
"ecosystem": "Go"
182+
},
183+
"ranges": [
184+
{
185+
"type": "SEMVER",
186+
"events": [
187+
{
188+
"introduced": "0"
189+
},
190+
{
191+
"fixed": "0.44.0"
192+
}
193+
]
194+
}
195+
],
196+
"ecosystem_specific": {
197+
"imports": [
198+
{
199+
"path": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace/internal/semconvutil",
200+
"symbols": [
201+
"HTTPClientRequest",
202+
"HTTPServerRequest",
203+
"httpConv.ClientRequest",
204+
"httpConv.ServerRequest",
205+
"httpConv.proto"
206+
]
207+
}
208+
]
209+
}
210+
},
211+
{
212+
"package": {
213+
"name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
214+
"ecosystem": "Go"
215+
},
216+
"ranges": [
217+
{
218+
"type": "SEMVER",
219+
"events": [
220+
{
221+
"introduced": "0"
222+
},
223+
{
224+
"fixed": "0.44.0"
225+
}
226+
]
227+
}
228+
],
229+
"ecosystem_specific": {
230+
"imports": [
231+
{
232+
"path": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
233+
"symbols": [
234+
"middleware.serveHTTP"
235+
]
236+
}
237+
]
238+
}
239+
}
240+
],
241+
"references": [
242+
{
243+
"type": "ADVISORY",
244+
"url": "https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr"
245+
},
246+
{
247+
"type": "FIX",
248+
"url": "https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277"
249+
}
250+
],
251+
"database_specific": {
252+
"url": "https://pkg.go.dev/vuln/GO-2023-2113"
253+
}
254+
}

‎data/reports/GO-2023-2113.yaml

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
id: GO-2023-2113
2+
modules:
3+
- module: go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful
4+
versions:
5+
- fixed: 0.44.0
6+
vulnerable_at: 0.43.0
7+
packages:
8+
- package: go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful/internal/semconvutil
9+
symbols:
10+
- httpConv.proto
11+
derived_symbols:
12+
- HTTPClientRequest
13+
- HTTPServerRequest
14+
- httpConv.ClientRequest
15+
- httpConv.ServerRequest
16+
- module: go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin
17+
versions:
18+
- fixed: 0.44.0
19+
vulnerable_at: 0.43.0
20+
packages:
21+
- package: go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin/internal/semconvutil
22+
symbols:
23+
- httpConv.proto
24+
derived_symbols:
25+
- HTTPClientRequest
26+
- HTTPServerRequest
27+
- httpConv.ClientRequest
28+
- httpConv.ServerRequest
29+
- module: go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux
30+
versions:
31+
- fixed: 0.44.0
32+
vulnerable_at: 0.43.0
33+
packages:
34+
- package: go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux/internal/semconvutil
35+
symbols:
36+
- httpConv.proto
37+
derived_symbols:
38+
- HTTPClientRequest
39+
- HTTPServerRequest
40+
- httpConv.ClientRequest
41+
- httpConv.ServerRequest
42+
- module: go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho
43+
versions:
44+
- fixed: 0.44.0
45+
vulnerable_at: 0.43.0
46+
packages:
47+
- package: go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho/internal/semconvutil
48+
symbols:
49+
- httpConv.proto
50+
derived_symbols:
51+
- HTTPClientRequest
52+
- HTTPServerRequest
53+
- httpConv.ClientRequest
54+
- httpConv.ServerRequest
55+
- module: go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron
56+
versions:
57+
- fixed: 0.44.0
58+
vulnerable_at: 0.43.0
59+
packages:
60+
- package: go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron/internal/semconvutil
61+
symbols:
62+
- httpConv.proto
63+
derived_symbols:
64+
- HTTPClientRequest
65+
- HTTPServerRequest
66+
- httpConv.ClientRequest
67+
- httpConv.ServerRequest
68+
- module: go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
69+
versions:
70+
- fixed: 0.44.0
71+
vulnerable_at: 0.43.0
72+
packages:
73+
- package: go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace/internal/semconvutil
74+
symbols:
75+
- httpConv.proto
76+
derived_symbols:
77+
- HTTPClientRequest
78+
- HTTPServerRequest
79+
- httpConv.ClientRequest
80+
- httpConv.ServerRequest
81+
- module: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
82+
versions:
83+
- fixed: 0.44.0
84+
vulnerable_at: 0.43.0
85+
packages:
86+
- package: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
87+
symbols:
88+
- middleware.serveHTTP
89+
summary: Memory exhaustion in github.com/open-telemetry/opentelemetry-go-contrib
90+
cves:
91+
- CVE-2023-45142
92+
ghsas:
93+
- GHSA-rcjv-mgp8-qvmr
94+
references:
95+
- advisory: https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr
96+
- fix: https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277

0 commit comments

Comments
 (0)