x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-qv95-g3gm-x542

[julieqiu]

In GitHub Security Advisory GHSA-qv95-g3gm-x542, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/vault	1.8.4	>= 1.8.0, < 1.8.4

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/hashicorp/vault
    versions:
      - introduced: 1.8.0
        fixed: 1.8.4
  - package: github.com/hashicorp/vault
    versions:
      - fixed: 1.7.5
description: HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed
    a user with write permission to an entity alias ID sharing a mount accessor with
    another user to acquire this other user’s policies by merging their identities.
    Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
published: 2021-10-12T16:39:01Z
last_modified: 2021-10-20T17:39:35Z
cves:
  - CVE-2021-41802
ghsas:
  - GHSA-qv95-g3gm-x542
links:
    context:
      - https://github.com/advisories/GHSA-qv95-g3gm-x542

[julieqiu]

Vulnerability in tool. Not importable.

[gopherbot]

Change https://go.dev/cl/592769 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607222 mentions this issue: data/reports: unexclude 20 reports (20)