x/vulndb: potential Go vuln in github.com/juju/juju: GHSA-x5rv-w9pm-8qp8

[GoVulnBot]

In GitHub Security Advisory GHSA-x5rv-w9pm-8qp8, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/juju/juju	3.0.3	>= 3.0.0, < 3.0.3

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/juju/juju
    versions:
      - introduced: 3.0.0
        fixed: 3.0.3
    packages:
      - package: github.com/juju/juju
  - module: github.com/juju/juju
    versions:
      - introduced: 2.9.22
        fixed: 2.9.38
    packages:
      - package: github.com/juju/juju
description: |
    ### Impact
    An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

    ### Patches
    Patched in juju 2.9.38 and juju 3.0.3
    [juju/juju#ef803e2](https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556)

    ### Workarounds
    Limit read access to the controller model to only trusted users.
cves:
  - CVE-2023-0092
ghsas:
  - GHSA-x5rv-w9pm-8qp8
references:
  - advisory: https://github.com/juju/juju/security/advisories/GHSA-x5rv-w9pm-8qp8
  - fix: https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556
  - web: https://bugs.launchpad.net/juju/+bug/1999622
  - advisory: https://github.com/advisories/GHSA-x5rv-w9pm-8qp8

[zpavlinovic]

juju is a CLI tool and the fix is in the server package whose only imports are clones.

[gopherbot]

Change https://go.dev/cl/472715 mentions this issue: data/excluded: batch add GO-2023-1599, GO-2023-1598

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports