x/vulndb: potential Go vuln in github.com/gravitational/teleport: CVE-2022-36633, GHSA-6xf3-5hp7-xqqg

[tatianab]

In GitHub Security Advisory GHSA-6xf3-5hp7-xqqg, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/gravitational/teleport	10.1.2	>= 10.0.0, < 10.1.2

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: 10.0.0
        fixed: 10.1.2
    packages:
      - package: github.com/gravitational/teleport
  - module: TODO
    versions:
      - introduced: 9.0.0
        fixed: 9.3.13
    packages:
      - package: github.com/gravitational/teleport
  - module: TODO
    versions:
      - fixed: 8.3.17
    packages:
      - package: github.com/gravitational/teleport
description: Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code
    Execution. An attacker can craft a malicious ssh agent installation link by URL
    encoding a bash escape with carriage return line feed. This url encoded payload
    can be used in place of a token and sent to a user in a social engineering attack.
    This is fully unauthenticated attack utilizing the trusted teleport server to
    deliver the payload.
cves:
  - CVE-2022-36633
ghsas:
  - GHSA-6xf3-5hp7-xqqg

[zpavlinovic]

This does not seem to be importable in the classical sense that vulnerability tools can detect as a dependency. All the places where this module is imported seem to fork this repo.

Also, the go.mod file is not following the module naming scheme when it comes to major versions >= 2. For instance:
go get github.com/gravitational/teleport@v10.1.2 go: github.com/gravitational/teleport@v10.1.2: invalid version: module contains a go.mod file, so module path must match major version ("github.com/gravitational/teleport/v10")

or

go get github.com/gravitational/teleport/v10@v10.1.2 go: github.com/gravitational/teleport@v10.1.2: invalid version: module contains a go.mod file, so module path must match major version ("github.com/gravitational/teleport/v10")

[gopherbot]

Change https://go.dev/cl/431196 mentions this issue: data/excluded: add GO-2022-0984.yaml for CVE-2022-36633

[gopherbot]

Change https://go.dev/cl/592774 mentions this issue: data/reports: unexclude 50 reports