x/vulndb: potential Go vuln in github.com/containers/podman/v3: CVE-2022-2989, GHSA-4wjj-jwc9-2x96

[tatianab]

In GitHub Security Advisory GHSA-4wjj-jwc9-2x96, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/containers/podman/v3	3.0.1	< 3.0.1

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - fixed: 3.0.1
    packages:
      - package: github.com/containers/podman/v3
  - module: TODO
    versions:
      - fixed: 4.2.0
    packages:
      - package: github.com/containers/podman/v4
description: An incorrect handling of the supplementary groups in the Podman container
    engine might lead to the sensitive information disclosure or possible data modification
    if an attacker has direct access to the affected container where supplementary
    groups are used to set access permissions and is able to execute a binary code
    in that container.
cves:
  - CVE-2022-2989
ghsas:
  - GHSA-4wjj-jwc9-2x96

[neild]

This vulnerability does appear in the importable libpod package, but:

The libpod library is not stable and we do not support use cases outside of this repository.

[gopherbot]

Change https://go.dev/cl/432165 mentions this issue: data/excluded: add GO-2022-1007.yaml for CVE-2022-2989

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports