x/vulndb: potential Go vuln in github.com/IceWhaleTech/CasaOS: GHSA-m5q5-8mfw-p2hr

[GoVulnBot]

In GitHub Security Advisory GHSA-m5q5-8mfw-p2hr, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/IceWhaleTech/CasaOS	0.4.4	< 0.4.4

Cross references:

• Module github.com/IceWhaleTech/CasaOS appears in issue x/vulndb: potential Go vuln in github.com/IceWhaleTech/CasaOS: GHSA-jh63-28gx-7p26 #606 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/IceWhaleTech/CasaOS
      versions:
        - fixed: 0.4.4
      vulnerable_at: 0.4.4-alpha5
      packages:
        - package: github.com/IceWhaleTech/CasaOS
summary: CasaOS contains weak JWT secrets
description: |-
    ### Impact

    Unauthenticated attackers can craft arbitrary JWTs and access features that
    usually require authentication and execute arbitrary commands as `root` on
    CasaOS instances.

    ### Patches

    The problem was addressed by improving the validation of JWTs in 705bf1f. This
    patch is part of CasaOS 0.4.4.

    ### Workarounds

    Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily
    restrict access to CasaOS to untrusted users, for instance by not exposing it
    publicly.

    ### References

    - 705bf1f
cves:
    - CVE-2023-37266
ghsas:
    - GHSA-m5q5-8mfw-p2hr
references:
    - advisory: https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-m5q5-8mfw-p2hr
    - fix: https://github.com/IceWhaleTech/CasaOS/commit/705bf1facbffd2ca40b159b0303132b6fdf657ad
    - advisory: https://github.com/advisories/GHSA-m5q5-8mfw-p2hr

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)