x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2: GHSA-fr2g-9hjm-wr23

[GoVulnBot]

In GitHub Security Advisory GHSA-fr2g-9hjm-wr23, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/nats-io/nats-server/v2	2.10.2	>= 2.10.0, < 2.10.2

Cross references:

• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2: GHSA-gwj5-3vfq-q992 #398 EFFECTIVELY_PRIVATE
• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2/server: GHSA-jp4j-47f9-2vc3 #852 NOT_IMPORTABLE
• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2/server: GHSA-m4jx-6526-vvhm #855 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/nats-io/nats-server/v2
      versions:
        - introduced: 2.10.0
          fixed: 2.10.2
      vulnerable_at: 2.10.1
      packages:
        - package: github.com/nats-io/nats-server/v2
    - module: github.com/nats-io/nats-server/v2
      versions:
        - introduced: 2.2.0
          fixed: 2.9.23
      vulnerable_at: 2.9.22
      packages:
        - package: github.com/nats-io/nats-server/v2
summary: 'NATS.io: Adding accounts for just the system account adds auth bypass'
ghsas:
    - GHSA-fr2g-9hjm-wr23
references:
    - advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23
    - fix: https://github.com/nats-io/nats-server/pull/4605
    - fix: https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478
    - web: https://advisories.nats.io/CVE/secnote-2023-01.txt
    - web: https://github.com/nats-io/nats-server/discussions/4535
    - web: https://github.com/nats-io/nats-server/releases/tag/v2.10.2
    - web: https://github.com/nats-io/nats-server/releases/tag/v2.9.23
    - advisory: https://github.com/advisories/GHSA-fr2g-9hjm-wr23

[gopherbot]

Change https://go.dev/cl/537435 mentions this issue: data/reports: add GO-2023-2133.yaml