x/vulndb: potential Go vuln in github.com/hasura/graphql-engine: CVE-2023-27588

[GoVulnBot]

CVE-2023-27588 references github.com/hasura/graphql-engine, which may be a Go module.

Description:
Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-27588
• JSON: https://github.com/CVEProject/cvelist/tree/322be1fb2feb3886bc1abbc5b2acf3253b41b116/2023/27xxx/CVE-2023-27588.json
• advisory: GHSA-c9rw-rw2f-mj4x
• fix: hasura/graphql-engine@dda5454
• web: https://github.com/hasura/graphql-engine/releases/tag/v1.3.4
• web: https://github.com/hasura/graphql-engine/releases/tag/v2.11.5
• web: https://github.com/hasura/graphql-engine/releases/tag/v2.20.1
• web: https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1
• Imported by: https://pkg.go.dev/github.com/hasura/graphql-engine?tab=importedby

Cross references:

• Module github.com/hasura/graphql-engine appears in issue x/vulndb: potential Go vuln in github.com/hasura/graphql-engine: CVE-2022-46792 #1150 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/hasura/graphql-engine
    packages:
      - package: graphql-engine
description: |
    Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.
cves:
  - CVE-2023-27588
references:
  - advisory: https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x
  - fix: https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158
  - web: https://github.com/hasura/graphql-engine/releases/tag/v1.3.4
  - web: https://github.com/hasura/graphql-engine/releases/tag/v2.11.5
  - web: https://github.com/hasura/graphql-engine/releases/tag/v2.20.1
  - web: https://github.com/hasura/graphql-engine/releases/tag/v2.21.0-beta.1

[tatianab]

Fix does not affect Go code

[gopherbot]

Change https://go.dev/cl/607819 mentions this issue: data/excluded: update 5 reports