Skip to content

Commit 4f75616

Browse files
neildgopherbot
neild
authored and
gopherbot
committed
data/reports: add GO-2025-4008
 - data/reports/GO-2025-4008.yaml Fixes #4008 Change-Id: If7c395bd20ac2a177677ed48bd0ac513cd854f4a Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/715900 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Damien Neil <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]>
1 parent 0666e39 commit 4f75616

File tree

3 files changed

+229
-0
lines changed

3 files changed

+229
-0
lines changed

‎data/cve/v5/GO-2025-4008.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-58189"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "ALPN negotiation error contains attacker controlled information in crypto/tls",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go standard library",
22+
"product": "crypto/tls",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "crypto/tls",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.24.8",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.25.0",
34+
"lessThan": "1.25.2",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"programRoutines": [
40+
{
41+
"name": "negotiateALPN"
42+
},
43+
{
44+
"name": "Conn.Handshake"
45+
},
46+
{
47+
"name": "Conn.HandshakeContext"
48+
},
49+
{
50+
"name": "Conn.Read"
51+
},
52+
{
53+
"name": "Conn.Write"
54+
},
55+
{
56+
"name": "Dial"
57+
},
58+
{
59+
"name": "DialWithDialer"
60+
},
61+
{
62+
"name": "Dialer.Dial"
63+
},
64+
{
65+
"name": "Dialer.DialContext"
66+
},
67+
{
68+
"name": "QUICConn.Start"
69+
}
70+
],
71+
"defaultStatus": "unaffected"
72+
}
73+
],
74+
"problemTypes": [
75+
{
76+
"descriptions": [
77+
{
78+
"lang": "en",
79+
"description": "CWE-117: Improper Output Neutralization for Logs"
80+
}
81+
]
82+
}
83+
],
84+
"references": [
85+
{
86+
"url": "https://go.dev/cl/707776"
87+
},
88+
{
89+
"url": "https://go.dev/issue/75652"
90+
},
91+
{
92+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
93+
},
94+
{
95+
"url": "https://pkg.go.dev/vuln/GO-2025-4008"
96+
}
97+
],
98+
"credits": [
99+
{
100+
"lang": "en",
101+
"value": "National Cyber Security Centre Finland"
102+
}
103+
]
104+
}
105+
}
106+
}

‎data/osv/GO-2025-4008.json‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4008",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58189",
8+
"CVE-2025-58189"
9+
],
10+
"summary": "ALPN negotiation error contains attacker controlled information in crypto/tls",
11+
"details": "When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "stdlib",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.24.8"
27+
},
28+
{
29+
"introduced": "1.25.0"
30+
},
31+
{
32+
"fixed": "1.25.2"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "crypto/tls",
41+
"symbols": [
42+
"Conn.Handshake",
43+
"Conn.HandshakeContext",
44+
"Conn.Read",
45+
"Conn.Write",
46+
"Dial",
47+
"DialWithDialer",
48+
"Dialer.Dial",
49+
"Dialer.DialContext",
50+
"QUICConn.Start",
51+
"negotiateALPN"
52+
]
53+
}
54+
]
55+
}
56+
}
57+
],
58+
"references": [
59+
{
60+
"type": "FIX",
61+
"url": "https://go.dev/cl/707776"
62+
},
63+
{
64+
"type": "REPORT",
65+
"url": "https://go.dev/issue/75652"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
70+
}
71+
],
72+
"credits": [
73+
{
74+
"name": "National Cyber Security Centre Finland"
75+
}
76+
],
77+
"database_specific": {
78+
"url": "https://pkg.go.dev/vuln/GO-2025-4008",
79+
"review_status": "REVIEWED"
80+
}
81+
}

‎data/reports/GO-2025-4008.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
id: GO-2025-4008
2+
modules:
3+
- module: std
4+
versions:
5+
- fixed: 1.24.8
6+
- introduced: 1.25.0
7+
- fixed: 1.25.2
8+
vulnerable_at: 1.25.1
9+
packages:
10+
- package: crypto/tls
11+
symbols:
12+
- negotiateALPN
13+
derived_symbols:
14+
- Conn.Handshake
15+
- Conn.HandshakeContext
16+
- Conn.Read
17+
- Conn.Write
18+
- Dial
19+
- DialWithDialer
20+
- Dialer.Dial
21+
- Dialer.DialContext
22+
- QUICConn.Start
23+
summary: ALPN negotiation error contains attacker controlled information in crypto/tls
24+
description: |-
25+
When Conn.Handshake fails during ALPN negotiation the error contains attacker
26+
controlled information (the ALPN protocols sent by the client) which is not
27+
escaped.
28+
cves:
29+
- CVE-2025-58189
30+
credits:
31+
- National Cyber Security Centre Finland
32+
references:
33+
- fix: https://go.dev/cl/707776
34+
- report: https://go.dev/issue/75652
35+
- web: https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
36+
cve_metadata:
37+
id: CVE-2025-58189
38+
cwe: 'CWE-117: Improper Output Neutralization for Logs'
39+
source:
40+
id: go-security-team
41+
created: 2025-10-28T17:17:13.707819-07:00
42+
review_status: REVIEWED

0 commit comments

Comments
 (0)