x/vulndb: potential Go vuln in github.com/IceWhaleTech/CasaOS-Gateway: GHSA-vjh7-5r6x-xh6g

[GoVulnBot]

In GitHub Security Advisory GHSA-vjh7-5r6x-xh6g, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/IceWhaleTech/CasaOS-Gateway	0.4.4	< 0.4.4

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/IceWhaleTech/CasaOS-Gateway
      versions:
        - fixed: 0.4.4
      vulnerable_at: 0.4.4-alpha1
      packages:
        - package: github.com/IceWhaleTech/CasaOS-Gateway
summary: CasaOS Gateway vulnerable to incorrect identification of source IP addresses
description: |-
    ### Impact

    Unauthenticated attackers can execute arbitrary commands as `root` on CasaOS
    instances.

    ### Patches

    The problem was addressed by improving the detection of client IP addresses in
    391dd7f. This patch is part of CasaOS 0.4.4.

    ### Workarounds

    Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily
    restrict access to CasaOS to untrusted users, for instance by not exposing it
    publicly.

    ### References

    - 391dd7f
cves:
    - CVE-2023-37265
ghsas:
    - GHSA-vjh7-5r6x-xh6g
references:
    - advisory: https://github.com/IceWhaleTech/CasaOS-Gateway/security/advisories/GHSA-vjh7-5r6x-xh6g
    - fix: https://github.com/IceWhaleTech/CasaOS-Gateway/commit/391dd7f0f239020c46bf057cfa25f82031fc15f7
    - advisory: https://github.com/advisories/GHSA-vjh7-5r6x-xh6g

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)