x/vulndb: potential Go vuln in github.com/vmware-tanzu/velero: CVE-2020-3996

[tatianab]

CVE-2020-3996 references github.com/vmware-tanzu/velero, which may be a Go module.

Description:
Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in information leakage to unauthorized users.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-3996
• advisory: GHSA-72xg-3mcq-52v4
• Imported by: https://pkg.go.dev/github.com/vmware-tanzu/velero?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/vmware-tanzu/velero
      vulnerable_at: 1.12.1
      packages:
        - package: Velero
cves:
    - CVE-2020-3996
references:
    - advisory: https://github.com/vmware-tanzu/velero/security/advisories/GHSA-72xg-3mcq-52v4

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports