Skip to content

Commit 9b1b2fa

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2464-8j7c-4cjm GHSA-86rf-68f4-2cph GHSA-86rf-68f4-2cph
1 parent 231982e commit 9b1b2fa

3 files changed

Lines changed: 88 additions & 50 deletions

File tree

‎advisories/github-reviewed/2025/08/GHSA-2464-8j7c-4cjm/GHSA-2464-8j7c-4cjm.json‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2464-8j7c-4cjm",
4-
"modified": "2025-08-29T20:44:25Z",
4+
"modified": "2026-01-27T21:01:22Z",
55
"published": "2025-08-21T14:37:19Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2025-11065"
8+
],
79
"summary": "go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data",
810
"details": "### Summary\n\nUse of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.\n\n### Details\n\nOpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:\n\nhttps://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50\n\n```go\n\t\t\t_, _, err := d.getPrimitive(field, schema)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error converting input for field %q: %w\", field, err)\n\t\t\t}\n```\n\nwhere this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193\n\n```go\n\nfunc (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {\n\traw, ok := d.Raw[k]\n\tif !ok {\n\t\treturn nil, false, nil\n\t}\n\n\tswitch t := schema.Type; t {\n\tcase TypeBool:\n\t\tvar result bool\n\t\tif err := mapstructure.WeakDecode(raw, &result); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\treturn result, true, nil\n```\n\nNotably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers:\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180\n\n& more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.\n\n### PoC\n\nTo reproduce with OpenBao:\n\n```\n$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300\n```\n\nand in a new tab:\n\n```\n$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass\nSuccess! Enabled userpass auth method at: userpass/\n$ curl -X PUT -H \"X-Vault-Request: true\" -H \"X-Vault-Token: root\" -d '{\"ttl\":\"asdf\"}' \"http://localhost:8200/v1/auth/userpass/users/asdf\"\n\n--> server logs:\n\n2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error=\"error converting input for field \\\"ttl\\\": time: invalid duration \\\"asdf\\\"\"\n```\n\n### Impact\n\nThis is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).\n\nThis was rated 4.5 Medium by HashiCorp in the past iteration.",
911
"severity": [
@@ -41,10 +43,22 @@
4143
"type": "WEB",
4244
"url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
4345
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11065"
49+
},
4450
{
4551
"type": "WEB",
4652
"url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
4753
},
54+
{
55+
"type": "WEB",
56+
"url": "https://access.redhat.com/security/cve/CVE-2025-11065"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
61+
},
4862
{
4963
"type": "PACKAGE",
5064
"url": "https://github.com/go-viper/mapstructure"

‎advisories/github-reviewed/2026/01/GHSA-86rf-68f4-2cph/GHSA-86rf-68f4-2cph.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-86rf-68f4-2cph",
4+
"modified": "2026-01-27T21:00:31Z",
5+
"published": "2026-01-26T21:30:36Z",
6+
"withdrawn": "2026-01-27T21:00:31Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2464-8j7c-4cjm. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
14+
}
15+
],
16+
"affected": [
17+
{
18+
"package": {
19+
"ecosystem": "Go",
20+
"name": "github.com/go-viper/mapstructure/v2"
21+
},
22+
"ranges": [
23+
{
24+
"type": "ECOSYSTEM",
25+
"events": [
26+
{
27+
"introduced": "0"
28+
},
29+
{
30+
"fixed": "2.4.0"
31+
}
32+
]
33+
}
34+
]
35+
}
36+
],
37+
"references": [
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
41+
},
42+
{
43+
"type": "ADVISORY",
44+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11065"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://access.redhat.com/security/cve/CVE-2025-11065"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
57+
},
58+
{
59+
"type": "PACKAGE",
60+
"url": "https://github.com/go-viper/mapstructure"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-117"
66+
],
67+
"severity": "MODERATE",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-01-27T21:00:31Z",
70+
"nvd_published_at": "2026-01-26T20:16:06Z"
71+
}
72+
}

‎advisories/unreviewed/2026/01/GHSA-86rf-68f4-2cph/GHSA-86rf-68f4-2cph.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)