x/vulndb: potential Go vuln in k8s.io/ingress-nginx: GHSA-863x-868h-968x

[GoVulnBot]

In GitHub Security Advisory GHSA-863x-868h-968x, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
k8s.io/ingress-nginx	1.2.1	< 1.2.1

Cross references:

• Module k8s.io/ingress-nginx appears in issue x/vulndb: potential Go vuln in k8s.io/ingress-nginx: GHSA-pvmg-xgmx-9mxh #613 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: k8s.io/ingress-nginx
    versions:
      - fixed: 1.2.1
    packages:
      - package: k8s.io/ingress-nginx
summary: Ingress-nginx `path` sanitization can be bypassed with newline character
description: A security issue was discovered in ingress-nginx where a user that can
    create or update ingress objects can use a newline character to bypass the sanitization
    of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io`
    or `extensions` API group) to obtain the credentials of the ingress-nginx controller.
    In the default configuration, that credential has access to all secrets in the
    cluster.
cves:
  - CVE-2021-25748
ghsas:
  - GHSA-863x-868h-968x
references:
  - web: https://nvd.nist.gov/vuln/detail/CVE-2021-25748
  - report: https://github.com/kubernetes/ingress-nginx/issues/8686
  - web: https://groups.google.com/g/kubernetes-security-announce/c/avaRYa9c7I8
  - fix: https://github.com/kubernetes/ingress-nginx/pull/8623
  - web: https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.2.1
  - advisory: https://github.com/advisories/GHSA-863x-868h-968x

[gopherbot]

Change https://go.dev/cl/498277 mentions this issue: data/excluded: batch add GO-2023-1785, GO-2023-1789, GO-2023-1787

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports