x/vulndb: potential Go vuln in github.com/bishopfox/sliver: GHSA-8jxm-xp43-qh3q

[GoVulnBot]

In GitHub Security Advisory GHSA-8jxm-xp43-qh3q, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/bishopfox/sliver	1.5.40	>= 1.5.0, < 1.5.40

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/bishopfox/sliver
      versions:
        - introduced: 1.5.0
          fixed: 1.5.40
      packages:
        - package: github.com/bishopfox/sliver
summary: Silver vulnerable to MitM attack against implants due to a cryptography vulnerability
description: "### Summary\nThe current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)\n\n### Details\nPlease see [the PoC repo](https://github.com/tangent65536/Slivjacker).\n\n### PoC\nPlease also see [the PoC repo](https://github.com/tangent65536/Slivjacker).\nTo setup a simple PoC environment,  \n 1. Generate an implant with its C2 set to the PoC server's address and copy the embedded private implant key and public server key into the config json.  \n 2. Run the implant on a separate VM and a `notepad.exe` window should pop up on the implanted VM.  \n\n### Impact\nA successful attack grants the attacker permission to execute arbitrary code on the implanted device.  \n  \n### References\nhttps://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go  \nhttps://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go  \nhttps://github.com/tangent65536/Slivjacker  \n\n### Credits\n[Ting-Wei Hsieh](https://github.com/tangent65536) from [CHT Security Co. Ltd.](https://www.chtsecurity.com/?lang=en)"
cves:
    - CVE-2023-35170
ghsas:
    - GHSA-8jxm-xp43-qh3q
references:
    - advisory: https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q
    - fix: https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516
    - web: https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go
    - web: https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go
    - web: https://github.com/BishopFox/sliver/releases/tag/v1.5.40
    - web: https://github.com/tangent65536/Slivjacker
    - advisory: https://github.com/advisories/GHSA-8jxm-xp43-qh3q

[zpavlinovic]

Binary. The fixed packages are not imported by anyone: there are two clones, one of which seems not to exist anymore.

[gopherbot]

Change https://go.dev/cl/505195 mentions this issue: data/excluded: add GO-2023-1866.yaml

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606787 mentions this issue: data/reports: unexclude 20 reports (7)