x/vulndb: potential Go vuln in github.com/hashicorp/consul/acl: GHSA-h65h-v7fw-4p38

[GoVulnBot]

In GitHub Security Advisory GHSA-h65h-v7fw-4p38, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/consul/acl	1.5.1	>= 1.4.0, < 1.5.1

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hashicorp/consul/acl
      versions:
        - introduced: 1.4.0
          fixed: 1.5.1
      packages:
        - package: github.com/hashicorp/consul/acl
summary: HashiCorp Consul Incorrect Access Control vulnerability
description: HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
cves:
    - CVE-2019-12291
ghsas:
    - GHSA-h65h-v7fw-4p38
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-12291
    - report: https://github.com/hashicorp/consul/issues/5888
    - fix: https://github.com/hashicorp/consul/commit/36ebca1fd0129278487c6570449bc8cc03987890
    - web: https://www.hashicorp.com/blog/category/consul
    - advisory: https://github.com/advisories/GHSA-h65h-v7fw-4p38

[gopherbot]

Change https://go.dev/cl/503837 mentions this issue: data/excluded: batch add 21 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)