x/vulndb: potential Go vuln in github.com/google/fscrypt: CVE-2022-25326

[GoVulnBot]

In CVE-2022-25326, the reference URL github.com/google/fscrypt (and possibly others) refers to something in Go.

• PR: Metadata validation and other security improvements google/fscrypt#346

module: github.com/google/fscrypt
package: fscrypt
description: |
    fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.
cves:
  - CVE-2022-25326
credit: Matthias Gerstner of SUSE
links:
    pr: https://github.com/google/fscrypt/pull/346

See doc/triage.md for instructions on how to triage this report.

[neild]

The affected package, github.com/google/fscrypt/filesystem, is importable, but has 0 imports according to pkg.go.dev. The commit that fixes this issue introduces a backwards-incompatible change to that package. I think this can be viewed as an effectively internal package.

[gopherbot]

Change https://go.dev/cl/514876 mentions this issue: data/excluded: update GO-2022-0339.yaml to add alias

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607216 mentions this issue: data/reports: unexclude 20 reports (14)