x/vulndb: potential Go vuln in www.velocidex.com/golang/velociraptor: GHSA-g5vm-525q-r66c

[GoVulnBot]

In GitHub Security Advisory GHSA-g5vm-525q-r66c, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
www.velocidex.com/golang/velociraptor	0.6.7-5	< 0.6.7-5

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: www.velocidex.com/golang/velociraptor
    versions:
      - fixed: 0.6.7-5
    packages:
      - package: www.velocidex.com/golang/velociraptor
description: Rapid7 Velociraptor allows users to be created with different privileges
    on the server. Administrators are generally allowed to run any command on the
    server including writing arbitrary files. However, lower privilege users are generally
    forbidden from writing or modifying files on the server. The VQL copy() function
    applies permission checks for reading files but does not check for permission
    to write files. This allows a low privilege user (usually, users with the Velociraptor
    "investigator" role) to overwrite files on the server, including Velociraptor
    configuration files. To exploit this vulnerability, the attacker must already
    have a Velociraptor user account at a low privilege level (at least "analyst")
    and be able to log into the GUI and create a notebook where they can run the VQL
    query invoking the copy() VQL function. Typically, most users deploy Velociraptor
    with limited access to a trusted group (most users will be administrators within
    the GUI). This vulnerability is associated with program files https://github.com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go
    https://github.com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go and
    program routines copy(). This issue affects Velociraptor versions before 0.6.7-5.
    Version 0.6.7-5, released January 16, 2023, fixes the issue.
cves:
  - CVE-2023-0242
ghsas:
  - GHSA-g5vm-525q-r66c

[gopherbot]

Change https://go.dev/cl/466475 mentions this issue: data/excluded: batch add GO-2023-1527, GO-2023-1524, GO-2023-1516, GO-2023-1514, GO-2023-1513, GO-2023-1511, GO-2023-1523, GO-2023-1522, GO-2023-1520, GO-2023-1512

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606782 mentions this issue: data/reports: unexclude 20 reports (2)