x/vulndb: potential Go vuln in github.com/syncthing/syncthing: GHSA-28xp-g7f6-7mhf

[GoVulnBot]

In GitHub Security Advisory GHSA-28xp-g7f6-7mhf, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/syncthing/syncthing		<= 0.14.33

Cross references:

• Module github.com/syncthing/syncthing appears in issue x/vulndb: potential Go vuln in github.com/syncthing/syncthing: GHSA-x462-89pf-6r5h #888 NOT_IMPORTABLE
• Module github.com/syncthing/syncthing appears in issue x/vulndb: potential Go vuln in github.com/syncthing/syncthing: CVE-2022-46165 #1835 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/syncthing/syncthing
      versions:
        - {}
      vulnerable_at: 1.23.6
      packages:
        - package: github.com/syncthing/syncthing
summary: Syncthing symlink attack vulnerability
description: |-
    Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting
    in arbitrary file overwrite
cves:
    - CVE-2017-1000420
ghsas:
    - GHSA-28xp-g7f6-7mhf
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2017-1000420
    - report: https://github.com/syncthing/syncthing/issues/4286
    - advisory: https://github.com/advisories/GHSA-28xp-g7f6-7mhf

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports