Skip to content

Commit b85fc85

Browse files
rolandshoemakerrolandshoemaker
committed
data/reports: add GO-2025-3849
 - data/reports/GO-2025-3849.yaml Fixes #3849 Change-Id: I0e5b1c9d3ec3f857457ef421545df0ad6ff0331f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/693775 Reviewed-by: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
1 parent 8ab41ab commit b85fc85

3 files changed

Lines changed: 189 additions & 0 deletions

File tree

‎data/cve/v5/GO-2025-3849.json‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-47907"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Incorrect results returned from Rows.Scan in database/sql",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go standard library",
22+
"product": "database/sql",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "database/sql",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.23.12",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.24.0",
34+
"lessThan": "1.24.6",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"programRoutines": [
40+
{
41+
"name": "Rows.Scan"
42+
},
43+
{
44+
"name": "Row.Scan"
45+
}
46+
],
47+
"defaultStatus": "unaffected"
48+
}
49+
],
50+
"problemTypes": [
51+
{
52+
"descriptions": [
53+
{
54+
"lang": "en",
55+
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
56+
}
57+
]
58+
}
59+
],
60+
"references": [
61+
{
62+
"url": "https://go.dev/cl/693735"
63+
},
64+
{
65+
"url": "https://go.dev/issue/74831"
66+
},
67+
{
68+
"url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
69+
},
70+
{
71+
"url": "https://pkg.go.dev/vuln/GO-2025-3849"
72+
}
73+
],
74+
"credits": [
75+
{
76+
"lang": "en",
77+
"value": "Spike Curtis from Coder"
78+
}
79+
]
80+
}
81+
}
82+
}

‎data/osv/GO-2025-3849.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3849",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-47907"
8+
],
9+
"summary": "Incorrect results returned from Rows.Scan in database/sql",
10+
"details": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "stdlib",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.23.12"
26+
},
27+
{
28+
"introduced": "1.24.0"
29+
},
30+
{
31+
"fixed": "1.24.6"
32+
}
33+
]
34+
}
35+
],
36+
"ecosystem_specific": {
37+
"imports": [
38+
{
39+
"path": "database/sql",
40+
"symbols": [
41+
"Row.Scan",
42+
"Rows.Scan"
43+
]
44+
}
45+
]
46+
}
47+
}
48+
],
49+
"references": [
50+
{
51+
"type": "FIX",
52+
"url": "https://go.dev/cl/693735"
53+
},
54+
{
55+
"type": "REPORT",
56+
"url": "https://go.dev/issue/74831"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
61+
}
62+
],
63+
"credits": [
64+
{
65+
"name": "Spike Curtis from Coder"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2025-3849",
70+
"review_status": "REVIEWED"
71+
}
72+
}

‎data/reports/GO-2025-3849.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
id: GO-2025-3849
2+
modules:
3+
- module: std
4+
versions:
5+
- fixed: 1.23.12
6+
- introduced: 1.24.0
7+
- fixed: 1.24.6
8+
vulnerable_at: 1.24.5
9+
packages:
10+
- package: database/sql
11+
symbols:
12+
- Rows.Scan
13+
derived_symbols:
14+
- Row.Scan
15+
summary: Incorrect results returned from Rows.Scan in database/sql
16+
description: |-
17+
Cancelling a query (e.g. by cancelling the context passed to one of the query
18+
methods) during a call to the Scan method of the returned Rows can result in
19+
unexpected results if other queries are being made in parallel. This can result
20+
in a race condition that may overwrite the expected results with those of
21+
another query, causing the call to Scan to return either unexpected results
22+
from the other query or an error.
23+
credits:
24+
- Spike Curtis from Coder
25+
references:
26+
- fix: https://go.dev/cl/693735
27+
- report: https://go.dev/issue/74831
28+
- web: https://groups.google.com/g/golang-announce/c/x5MKroML2yM
29+
cve_metadata:
30+
id: CVE-2025-47907
31+
cwe: 'CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (''Race Condition'')'
32+
source:
33+
id: go-security-team
34+
created: 2025-08-06T13:30:59.171585-07:00
35+
review_status: REVIEWED

0 commit comments

Comments
 (0)