x/vulndb: potential Go vuln in istio.io/istio: GHSA-qcvw-82hh-gq38

[GoVulnBot]

In GitHub Security Advisory GHSA-qcvw-82hh-gq38, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
istio.io/istio	1.2.4	>= 1.2.0, < 1.2.4

Cross references:

• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio/pkg/log: GHSA-6g5f-f5pm-mjrg #633 EFFECTIVELY_PRIVATE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio/pilot/pkg/security/authz/model/matcher: GHSA-82mm-ffjr-h86c #810 NOT_IMPORTABLE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio: CVE-2021-39155, GHSA-7774-7vr3-cc8j #931 NOT_IMPORTABLE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio: CVE-2021-39156, GHSA-hqxw-mm44-gc4r #932 NOT_IMPORTABLE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio: GHSA-6q5m-22mq-q2xv #1908 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: istio.io/istio
      versions:
        - introduced: 1.2.0
          fixed: 1.2.4
      packages:
        - package: istio.io/istio
    - module: istio.io/istio
      versions:
        - fixed: 1.1.13
      packages:
        - package: istio.io/istio
summary: Istio ReDoS Vulnerability
description: |-
    Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for
    long URIs, leading to a denial of service during use of the JWT, VirtualService,
    HTTPAPISpecBinding, or QuotaSpecBinding API.
cves:
    - CVE-2019-14993
ghsas:
    - GHSA-qcvw-82hh-gq38
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-14993
    - report: https://github.com/envoyproxy/envoy/issues/7728
    - web: https://discuss.istio.io/t/upcoming-security-updates-in-istio-1-2-4-and-1-1-13/3383
    - web: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164
    - web: https://istio.io/blog/2019/istio-security-003-004/
    - advisory: https://github.com/advisories/GHSA-qcvw-82hh-gq38

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports