x/vulndb: potential Go vuln in github.com/IceWhaleTech/CasaOS: CVE-2023-37266

[GoVulnBot]

CVE-2023-37266 references github.com/IceWhaleTech/CasaOS, which may be a Go module.

Description:
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-37266
• JSON: https://github.com/CVEProject/cvelist/tree/e082053196b468f512ce2fa6ab1b7dabb2461f94/2023/37xxx/CVE-2023-37266.json
• advisory: GHSA-m5q5-8mfw-p2hr
• fix: IceWhaleTech/CasaOS@705bf1f
• Imported by: https://pkg.go.dev/github.com/IceWhaleTech/CasaOS?tab=importedby

Cross references:

• Module github.com/IceWhaleTech/CasaOS appears in issue x/vulndb: potential Go vuln in github.com/IceWhaleTech/CasaOS: GHSA-jh63-28gx-7p26 #606 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/IceWhaleTech/CasaOS
      vulnerable_at: 0.4.4
      packages:
        - package: CasaOS
description: |-
    CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can
    craft arbitrary JWTs and access features that usually require authentication and
    execute arbitrary commands as `root` on CasaOS instances. This problem was
    addressed by improving the validation of JWTs in commit `705bf1f`. This patch is
    part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they
    should temporarily restrict access to CasaOS to untrusted users, for instance by
    not exposing it publicly.
cves:
    - CVE-2023-37266
references:
    - advisory: https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr
    - fix: https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad

[neild]

Duplicate of #1931