x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-6hwg-w5jg-9c6x

[GoVulnBot]

In GitHub Security Advisory GHSA-6hwg-w5jg-9c6x, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/moby/moby	19.03.9	< 19.03.9

Cross references:

• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-24769 #390 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-8fvr-5rqf-3wwh #638 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-v4h8-794j-g8mm #708 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vj3f-3286-r4pf #751 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-36109 #985 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vp35-85q5-9f25 #1107 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28840 #1699 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28841 #1700 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28842 #1701 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2017-16539 #2199 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-10892 #2207 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-12608 #2209 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-15664 #2212 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2019-13139 #2236 LEGACY_FALSE_POSITIVE
• CVE-2020-27534 appears in issue x/vulndb: potential Go vuln in github.com/moby/buildkit: CVE-2020-27534 #2296 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2021-21284 #2316 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2021-21285 #2317 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/moby/moby
      versions:
        - fixed: 19.03.9
      packages:
        - package: github.com/moby/moby
summary: Path Traversal in Moby builder
cves:
    - CVE-2020-27534
ghsas:
    - GHSA-6hwg-w5jg-9c6x
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2020-27534
    - fix: https://github.com/moby/buildkit/pull/1462
    - fix: https://github.com/moby/moby/pull/40877
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=1921154
    - web: http://web.archive.org/web/20200530054359/https://docs.docker.com/engine/release-notes/
    - advisory: https://github.com/advisories/GHSA-6hwg-w5jg-9c6x

[gopherbot]

Change https://go.dev/cl/565379 mentions this issue: data/excluded: batch add 7 excluded reports

[tatianab]

Duplicate of #2296