Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-gq98-53rq-qr5h #1849

Closed
GoVulnBot opened this issue Jun 9, 2023 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-gq98-53rq-qr5h #1849

GoVulnBot opened this issue Jun 9, 2023 · 3 comments
Assignees
@neild
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-gq98-53rq-qr5h, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/hashicorp/vault 1.13.3 >= 1.13.0, < 1.13.3

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hashicorp/vault
      versions:
        - introduced: 1.13.0
          fixed: 1.13.3
      packages:
        - package: github.com/hashicorp/vault
    - module: github.com/hashicorp/vault
      versions:
        - introduced: 1.12.0
          fixed: 1.12.7
      packages:
        - package: github.com/hashicorp/vault
    - module: github.com/hashicorp/vault
      versions:
        - fixed: 1.11.11
      packages:
        - package: github.com/hashicorp/vault
summary: Hashicorp Vault vulnerable to Cross-site Scripting
description: Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
cves:
    - CVE-2023-2121
ghsas:
    - GHSA-gq98-53rq-qr5h
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-2121
    - web: https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814
    - advisory: https://github.com/advisories/GHSA-gq98-53rq-qr5h
@neild neild self-assigned this Jun 14, 2023
@neild neild added the excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. label Jun 14, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/503837 mentions this issue: data/excluded: batch add 21 excluded reports

This was referenced Jul 6, 2023
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Aug 1, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Sep 15, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Sep 30, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Nov 10, 2023
Closed
@GoVulnBot GoVulnBot mentioned this issue Dec 12, 2023
Closed
This was referenced Feb 1, 2024
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Mar 6, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 4, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Jun 12, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

@GoVulnBot GoVulnBot mentioned this issue Jul 12, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)

gopherbot pushed a commit that referenced this issue Aug 20, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (6)
34d5974 
  - data/reports/GO-2023-1785.yaml
  - data/reports/GO-2023-1793.yaml
  - data/reports/GO-2023-1795.yaml
  - data/reports/GO-2023-1800.yaml
  - data/reports/GO-2023-1801.yaml
  - data/reports/GO-2023-1803.yaml
  - data/reports/GO-2023-1804.yaml
  - data/reports/GO-2023-1806.yaml
  - data/reports/GO-2023-1808.yaml
  - data/reports/GO-2023-1809.yaml
  - data/reports/GO-2023-1819.yaml
  - data/reports/GO-2023-1827.yaml
  - data/reports/GO-2023-1828.yaml
  - data/reports/GO-2023-1829.yaml
  - data/reports/GO-2023-1831.yaml
  - data/reports/GO-2023-1849.yaml
  - data/reports/GO-2023-1850.yaml
  - data/reports/GO-2023-1851.yaml
  - data/reports/GO-2023-1852.yaml
  - data/reports/GO-2023-1853.yaml

Updates #1785
Updates #1793
Updates #1795
Updates #1800
Updates #1801
Updates #1803
Updates #1804
Updates #1806
Updates #1808
Updates #1809
Updates #1819
Updates #1827
Updates #1828
Updates #1829
Updates #1831
Updates #1849
Updates #1850
Updates #1851
Updates #1852
Updates #1853

Change-Id: Ib6fb15714358b0a9d7644d6ed43de25bdbd8434b
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606786
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
@GoVulnBot GoVulnBot mentioned this issue Sep 3, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Sep 26, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Oct 10, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Oct 31, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@neild neild

Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @gopherbot @GoVulnBot