x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-ggjr-2f7v-vhq4

[GoVulnBot]

In GitHub Security Advisory GHSA-ggjr-2f7v-vhq4, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/kiali/kiali	1.31.0	< 1.31.0

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/kiali/kiali
    versions:
      - fixed: 1.31.0
description: An authentication bypass vulnerability was found in Kiali in versions
    before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is
    enabled, Kiali assumes that some of the token validation is handled by the underlying
    cluster. When OpenID `implicit flow` is used with RBAC turned off, this token
    validation doesn't occur, and this allows a malicious user to bypass the authentication.
published: 2021-06-01T21:57:08Z
last_modified: 2021-06-03T21:52:23Z
cves:
  - CVE-2021-20278
ghsas:
  - GHSA-ggjr-2f7v-vhq4
links:
    context:
      - https://github.com/advisories/GHSA-ggjr-2f7v-vhq4

[rolandshoemaker]

Vuln in tool.

[gopherbot]

Change https://go.dev/cl/592770 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607223 mentions this issue: data/reports: unexclude 20 reports (21)