x/vulndb: potential Go vuln in github.com/syncthing/syncthing: GHSA-x462-89pf-6r5h

[GoVulnBot]

In GitHub Security Advisory GHSA-x462-89pf-6r5h, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/syncthing/syncthing	1.15.0	< 1.15.0

Cross references:

• CVE-2021-21404 appears in issue x/vulndb: potential Go vuln in github.com/syncthing/syncthing: GHSA-x462-89pf-6r5h #888 NOT_IMPORTABLE
• GHSA-x462-89pf-6r5h appears in issue x/vulndb: potential Go vuln in github.com/syncthing/syncthing: GHSA-x462-89pf-6r5h #888 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - fixed: 1.15.0
    packages:
      - package: github.com/syncthing/syncthing
description: |-
    ### Impact

    1. `syncthing` can be caused to crash and exit if sent a malformed relay
       protocol message message with a negative length field.

    2. The relay server `strelaysrv` can be caused to crash and exit if sent
       a malformed relay protocol message with a negative length field.

    At no point is sensitive data exposed or liable to be altered due to this
    issue. Sensitive data is never exposed to relay operators. Syncthing itself
    would need to be lured to connect to a malicious relay server in order to
    exploit the issue.

    ### Patches

    Fixed in version 1.15.0.

    ### Workarounds

    1. No known workaround for `strelaysrv`.

    2. `syncthing` can be configured to not use relays, or to only use specific,
       trusted relays. If Syncthing is used in a closed environment or with
       relaying disabled, i.e., it does not communicate with unknown relays,
       Syncthing is not vulnerable.

    ### For more information

    If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).

    Thanks to Wojciech Paciorek for discovering and reporting this issue.
cves:
  - CVE-2021-21404
ghsas:
  - GHSA-x462-89pf-6r5h

[tatianab]

Duplicate of #888