x/vulndb: potential Go vuln in github.com/pterodactyl/wings: GHSA-p8r3-83r8-jwj5

[GoVulnBot]

In GitHub Security Advisory GHSA-p8r3-83r8-jwj5, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/pterodactyl/wings	1.11.3	>= 1.11.0, < 1.11.3

Cross references:

• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: GHSA-6rg3-8h8x-5xfv #389 EFFECTIVELY_PRIVATE
• Module github.com/pterodactyl/wings appears in issue x/vulndb: potential Go vuln in github.com/pterodactyl/wings: CVE-2021-32699, GHSA-jj6m-r8jc-2gp7 #919 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/pterodactyl/wings
    versions:
      - introduced: 1.11.0
        fixed: 1.11.3
    packages:
      - package: github.com/pterodactyl/wings
  - module: github.com/pterodactyl/wings
    versions:
      - introduced: 1.7.0
        fixed: 1.7.3
    packages:
      - package: github.com/pterodactyl/wings
description: "### Impact\n\nThis vulnerability impacts anyone running the affected
    versions of Wings.  The vulnerability can be used to create new files and directory
    structures on the host system that previously did not exist, potentially allowing
    attackers to change their resource allocations, promote their containers to privileged
    mode, or potentially add ssh authorized keys to allow the attacker access to a
    remote shell on the target machine.  \n\nIn order to use this exploit, an attacker
    must have an existing \"server\" allocated and controlled by the Wings Daemon.
    \nInformation on how the exploitation of this vulnerability works will be released
    on February 14, 2023 in North America. \n\n### Patches\n\nThis vulnerability has
    been resolved in version `v1.11.3` of the Wings Daemon, and has been back-ported
    to the 1.7 release series in `v1.7.3`.\n\nAnyone running `v1.11.x` should upgrade
    to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`\n\n### Workarounds\n\nNone
    at this time.  \n\n\n\n"
cves:
  - CVE-2023-25152
ghsas:
  - GHSA-p8r3-83r8-jwj5

[gopherbot]

Change https://go.dev/cl/467396 mentions this issue: data/excluded: batch add excluded reports

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606782 mentions this issue: data/reports: unexclude 20 reports (2)