x/vulndb: potential Go vuln in github.com/grafana/alloy: GHSA-chqx-36rm-rf8h

[GoVulnBot]

Advisory GHSA-chqx-36rm-rf8h references a vulnerability in the following Go modules:

Module
github.com/grafana/alloy

Description:
Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM.
This issue affects Alloy: before 1.3.4, from 1.4.0-rc.0 and prior to 1.4.1.

References:

• ADVISORY: GHSA-chqx-36rm-rf8h
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-8975
• FIX: grafana/alloy@88e7798
• FIX: grafana/alloy@f142490
• WEB: https://github.com/grafana/alloy/releases/tag/v1.3.4
• WEB: https://github.com/grafana/alloy/releases/tag/v1.4.0
• WEB: https://github.com/grafana/alloy/releases/tag/v1.4.1
• WEB: https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996
• WEB: https://grafana.com/security/security-advisories/cve-2024-8975

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/grafana/alloy
      versions:
        - fixed: 1.3.4
        - introduced: 1.4.0-rc.0
        - fixed: 1.4.1
      vulnerable_at: 1.4.0
summary: Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy
cves:
    - CVE-2024-8975
ghsas:
    - GHSA-chqx-36rm-rf8h
references:
    - advisory: https://github.com/advisories/GHSA-chqx-36rm-rf8h
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-8975
    - fix: https://github.com/grafana/alloy/commit/88e779887690954c009503598a3f4bf563cb6596
    - fix: https://github.com/grafana/alloy/commit/f14249012fd970d3fd73604e6fff9b6c7990a9bb
    - web: https://github.com/grafana/alloy/releases/tag/v1.3.4
    - web: https://github.com/grafana/alloy/releases/tag/v1.4.0
    - web: https://github.com/grafana/alloy/releases/tag/v1.4.1
    - web: https://grafana.com/blog/2024/09/25/grafana-alloy-and-grafana-agent-flow-security-release-high-severity-fix-for-cve-2024-8975-and-cve-2024-8996
    - web: https://grafana.com/security/security-advisories/cve-2024-8975
source:
    id: GHSA-chqx-36rm-rf8h
    created: 2024-10-01T23:01:15.33240072Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/619135 mentions this issue: data/reports: add 15 reports