Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/istio/istio: GHSA-6c6p-h79f-g6p4 #1101

Closed
GoVulnBot opened this issue Nov 9, 2022 · 4 comments
Closed

x/vulndb: potential Go vuln in github.com/istio/istio: GHSA-6c6p-h79f-g6p4 #1101

GoVulnBot opened this issue Nov 9, 2022 · 4 comments
Assignees
@zpavlinovic
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-6c6p-h79f-g6p4, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/istio/istio 1.15.3 >= 1.15.0-beta.0, < 1.15.3

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: 1.15.0-beta.0
        fixed: 1.15.3
    packages:
      - package: github.com/istio/istio
description: |
    ### Impact

    User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.

    ### Patches
    1.15.3

    ### Workarounds
    No. If using 1.15.2 please upgrade to 1.15.3 or later.

    ### References
    None at this time.

    ### For more information
    If you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)
cves:
  - CVE-2022-39388
ghsas:
  - GHSA-6c6p-h79f-g6p4
@zpavlinovic
Copy link
Contributor

Not importable. The module serves the purpose of a binary and all the packages involving fixes have not been imported by anyone.

@zpavlinovic zpavlinovic self-assigned this Nov 10, 2022
@zpavlinovic zpavlinovic added the excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. label Nov 10, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/449575 mentions this issue: data/excluded: add GO-2022-1101.yaml

@tatianab tatianab mentioned this issue Nov 18, 2022
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/451279 mentions this issue: data/excluded: delete duplicate GO-2022-1103

gopherbot pushed a commit that referenced this issue Nov 18, 2022
@tatianab
data/excluded: delete duplicate GO-2022-1103
d524846 
Duplicate of GO-2022-1101

For #1103, #1101

Change-Id: Ib7bb56af9e294241300cc16672f462f027d71b11
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/451279
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Tatiana Bradley <tatiana@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
This was referenced Nov 8, 2023
Closed
Closed
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592835 mentions this issue: data/reports: unexclude 50 reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zpavlinovic zpavlinovic

Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zpavlinovic @gopherbot @GoVulnBot