Skip to content

Commit 3d8b4cf

Browse files
thatnealpatelgopherbot
thatnealpatel
authored and
gopherbot
committed
data/reports: add 2 first party reports
 - data/reports/GO-2025-4134.yaml - data/reports/GO-2025-4135.yaml Fixes #4134 Fixes #4135 Change-Id: I4c9bc8ba649f0d686821a4cdfee0ebbdfa614c0d Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/721982 Reviewed-by: Roland Shoemaker <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Neal Patel <[email protected]>
1 parent 9545107 commit 3d8b4cf

File tree

6 files changed

+353
-0
lines changed

6 files changed

+353
-0
lines changed

‎data/cve/v5/GO-2025-4134.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-58181"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "CVE-2025-58181 in golang.org/x/crypto/ssh",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "golang.org/x/crypto",
22+
"product": "golang.org/x/crypto/ssh",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "golang.org/x/crypto/ssh",
25+
"programRoutines": [
26+
{
27+
"name": "parseGSSAPIPayload"
28+
},
29+
{
30+
"name": "NewServerConn"
31+
}
32+
],
33+
"defaultStatus": "affected"
34+
}
35+
],
36+
"problemTypes": [
37+
{
38+
"descriptions": [
39+
{
40+
"lang": "en",
41+
"description": "CWE-1284"
42+
}
43+
]
44+
}
45+
],
46+
"references": [
47+
{
48+
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
49+
},
50+
{
51+
"url": "https://go.dev/cl/721961"
52+
},
53+
{
54+
"url": "https://go.dev/issue/76363"
55+
},
56+
{
57+
"url": "https://pkg.go.dev/vuln/GO-2025-4134"
58+
}
59+
],
60+
"credits": [
61+
{
62+
"lang": "en",
63+
"value": "Jakub Ciolek"
64+
}
65+
]
66+
}
67+
}
68+
}

‎data/cve/v5/GO-2025-4135.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-47914"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "CVE-2025-47914 in golang.org/x/crypto/ssh/agent",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "golang.org/x/crypto",
22+
"product": "golang.org/x/crypto/ssh/agent",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "golang.org/x/crypto/ssh/agent",
25+
"programRoutines": [
26+
{
27+
"name": "parseConstraints"
28+
},
29+
{
30+
"name": "ForwardToAgent"
31+
},
32+
{
33+
"name": "ServeAgent"
34+
}
35+
],
36+
"defaultStatus": "affected"
37+
}
38+
],
39+
"problemTypes": [
40+
{
41+
"descriptions": [
42+
{
43+
"lang": "en",
44+
"description": "CWE-237"
45+
}
46+
]
47+
}
48+
],
49+
"references": [
50+
{
51+
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
52+
},
53+
{
54+
"url": "https://go.dev/cl/721960"
55+
},
56+
{
57+
"url": "https://go.dev/issue/76364"
58+
},
59+
{
60+
"url": "https://pkg.go.dev/vuln/GO-2025-4135"
61+
}
62+
],
63+
"credits": [
64+
{
65+
"lang": "en",
66+
"value": "Jakub Ciolek"
67+
}
68+
]
69+
}
70+
}
71+
}

‎data/osv/GO-2025-4134.json‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4134",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58181"
8+
],
9+
"summary": "CVE-2025-58181 in golang.org/x/crypto/ssh",
10+
"details": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "golang.org/x/crypto",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {
28+
"imports": [
29+
{
30+
"path": "golang.org/x/crypto/ssh",
31+
"symbols": [
32+
"NewServerConn",
33+
"parseGSSAPIPayload"
34+
]
35+
}
36+
],
37+
"custom_ranges": [
38+
{
39+
"type": "ECOSYSTEM",
40+
"events": [
41+
{
42+
"introduced": "0"
43+
},
44+
{
45+
"fixed": "0.45.0"
46+
}
47+
]
48+
}
49+
]
50+
}
51+
}
52+
],
53+
"references": [
54+
{
55+
"type": "ADVISORY",
56+
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
57+
},
58+
{
59+
"type": "FIX",
60+
"url": "https://go.dev/cl/721961"
61+
},
62+
{
63+
"type": "REPORT",
64+
"url": "https://go.dev/issue/76363"
65+
}
66+
],
67+
"credits": [
68+
{
69+
"name": "Jakub Ciolek"
70+
}
71+
],
72+
"database_specific": {
73+
"url": "https://pkg.go.dev/vuln/GO-2025-4134",
74+
"review_status": "REVIEWED"
75+
}
76+
}

‎data/osv/GO-2025-4135.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4135",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-47914"
8+
],
9+
"summary": "CVE-2025-47914 in golang.org/x/crypto/ssh/agent",
10+
"details": "SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "golang.org/x/crypto",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {
28+
"imports": [
29+
{
30+
"path": "golang.org/x/crypto/ssh/agent",
31+
"symbols": [
32+
"ForwardToAgent",
33+
"ServeAgent",
34+
"parseConstraints"
35+
]
36+
}
37+
],
38+
"custom_ranges": [
39+
{
40+
"type": "ECOSYSTEM",
41+
"events": [
42+
{
43+
"introduced": "0"
44+
},
45+
{
46+
"fixed": "0.45.0"
47+
}
48+
]
49+
}
50+
]
51+
}
52+
}
53+
],
54+
"references": [
55+
{
56+
"type": "ADVISORY",
57+
"url": "https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA"
58+
},
59+
{
60+
"type": "FIX",
61+
"url": "https://go.dev/cl/721960"
62+
},
63+
{
64+
"type": "REPORT",
65+
"url": "https://go.dev/issue/76364"
66+
}
67+
],
68+
"credits": [
69+
{
70+
"name": "Jakub Ciolek"
71+
}
72+
],
73+
"database_specific": {
74+
"url": "https://pkg.go.dev/vuln/GO-2025-4135",
75+
"review_status": "REVIEWED"
76+
}
77+
}

‎data/reports/GO-2025-4134.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
id: GO-2025-4134
2+
modules:
3+
- module: golang.org/x/crypto
4+
non_go_versions:
5+
- fixed: 0.45.0
6+
vulnerable_at: 0.44.0
7+
packages:
8+
- package: golang.org/x/crypto/ssh
9+
symbols:
10+
- parseGSSAPIPayload
11+
derived_symbols:
12+
- NewServerConn
13+
summary: CVE-2025-58181 in golang.org/x/crypto/ssh
14+
description: |-
15+
SSH servers parsing GSSAPI authentication requests do not validate the number of
16+
mechanisms specified in the request, allowing an attacker to cause unbounded
17+
memory consumption.
18+
credits:
19+
- Jakub Ciolek
20+
references:
21+
- advisory: https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
22+
- fix: https://go.dev/cl/721961
23+
- report: https://go.dev/issue/76363
24+
cve_metadata:
25+
id: CVE-2025-58181
26+
cwe: CWE-1284
27+
source:
28+
id: go-security-team
29+
created: 2025-11-19T13:45:59.697504-05:00
30+
review_status: REVIEWED

‎data/reports/GO-2025-4135.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: GO-2025-4135
2+
modules:
3+
- module: golang.org/x/crypto
4+
non_go_versions:
5+
- fixed: 0.45.0
6+
vulnerable_at: 0.44.0
7+
packages:
8+
- package: golang.org/x/crypto/ssh/agent
9+
symbols:
10+
- parseConstraints
11+
derived_symbols:
12+
- ForwardToAgent
13+
- ServeAgent
14+
summary: CVE-2025-47914 in golang.org/x/crypto/ssh/agent
15+
description: |-
16+
SSH Agent servers do not validate the size of messages when processing new
17+
identity requests, which may cause the program to panic if the message is
18+
malformed due to an out of bounds read.
19+
credits:
20+
- Jakub Ciolek
21+
references:
22+
- advisory: https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
23+
- fix: https://go.dev/cl/721960
24+
- report: https://go.dev/issue/76364
25+
cve_metadata:
26+
id: CVE-2025-47914
27+
cwe: CWE-237
28+
source:
29+
id: go-security-team
30+
created: 2025-11-19T13:46:02.007781-05:00
31+
review_status: REVIEWED

0 commit comments

Comments
 (0)