Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

x/vulndb: potential Go vuln in github.com/nmstate/kubernetes-nmstate: GHSA-jw82-xjgr-g6f8 #1918

Closed
GoVulnBot opened this issue Jul 14, 2023 · 4 comments
Assignees
Labels
excluded: WITHDRAWN The source report was withdrawn before we published it in vulndb.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-jw82-xjgr-g6f8, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/nmstate/kubernetes-nmstate < 2.3.0-30

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/nmstate/kubernetes-nmstate
      versions:
        - introduced: TODO (earliest fixed "", vuln range "< 2.3.0-30")
      vulnerable_at: 0.79.0
      packages:
        - package: github.com/nmstate/kubernetes-nmstate
summary: kubernetes-nmstate Insecure Privilege Management
description: |-
    An insecure modification vulnerability flaw was found in containers using
    nmstate/kubernetes-nmstate-handler. An attacker with access to the container
    could use this flaw to modify /etc/passwd and escalate their privileges.
    Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
cves:
    - CVE-2020-1742
ghsas:
    - GHSA-jw82-xjgr-g6f8
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2020-1742
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=1803608
    - advisory: https://github.com/advisories/GHSA-jw82-xjgr-g6f8

@neild neild self-assigned this Jul 25, 2023
@neild neild added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Jul 25, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

@tatianab
Copy link
Contributor

Withdrawn; excluded report should be deleted

@tatianab tatianab reopened this Aug 20, 2024
@tatianab tatianab added excluded: OUT_OF_SCOPE This issue is out of scope for this issue tracker. and removed excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. labels Aug 20, 2024
@tatianab tatianab assigned tatianab and unassigned neild Aug 20, 2024
@tatianab tatianab added excluded: WITHDRAWN The source report was withdrawn before we published it in vulndb. and removed excluded: OUT_OF_SCOPE This issue is out of scope for this issue tracker. labels Aug 23, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607819 mentions this issue: data/excluded: update 5 reports

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
excluded: WITHDRAWN The source report was withdrawn before we published it in vulndb.
Projects
None yet
Development

No branches or pull requests

4 participants