x/vulndb: potential Go vuln in github.com/containers/podman/v4: GHSA-wp7w-vx86-vj9h

[GoVulnBot]

In GitHub Security Advisory GHSA-wp7w-vx86-vj9h, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/containers/podman/v4	0.6.1	< 0.6.1

Cross references:

• Module github.com/containers/podman/v4 appears in issue x/vulndb: potential Go vuln in github.com/containers/podman/v4: GHSA-rprg-4v7q-87v7 #1159
• Module github.com/containers/podman/v4 appears in issue x/vulndb: potential Go vuln in github.com/containers/podman/v4: GHSA-qwqv-rqgf-8qh8 #1681

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/containers/podman/v4
      versions:
        - fixed: 0.6.1
      packages:
        - package: github.com/containers/podman/v4
summary: Podman Elevated Container Privileges
description: |-
    It has been discovered that podman before version 0.6.1 does not drop
    capabilities when executing a container as a non-root user. This results in
    unnecessary privileges being granted to the container.
cves:
    - CVE-2018-10856
ghsas:
    - GHSA-wp7w-vx86-vj9h
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2018-10856
    - fix: https://github.com/projectatomic/libpod/commit/bae80a0b663925ec751ad2784ca32989403cdc24
    - web: https://access.redhat.com/errata/RHSA-2018:2037
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10856
    - advisory: https://github.com/advisories/GHSA-wp7w-vx86-vj9h

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606789 mentions this issue: data/reports: unexclude 20 reports (9)