Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-465w-gg5p-85c9 #626

Closed
julieqiu opened this issue Aug 1, 2022 · 3 comments
Closed
Assignees
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@julieqiu
Copy link
Member

julieqiu commented Aug 1, 2022

In GitHub Security Advisory GHSA-465w-gg5p-85c9, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/kiali/kiali 1.15.1 >= 0.4.0, < 1.15.1

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/kiali/kiali
    versions:
      - introduced: 0.4.0
        fixed: 1.15.1
description: An insufficient JWT validation vulnerability was found in Kiali versions
    0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker
    could abuse this flaw by stealing a valid JWT cookie and using that to spoof a
    user session, possibly gaining privileges to view and alter the Istio configuration.
published: 2021-05-18T21:09:01Z
last_modified: 2021-05-18T21:09:01Z
cves:
  - CVE-2020-1762
ghsas:
  - GHSA-465w-gg5p-85c9
links:
    context:
      - https://github.com/advisories/GHSA-465w-gg5p-85c9

@rolandshoemaker
Copy link
Member

Vuln in tool.

@neild neild added excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. and removed NotGoVuln labels Aug 10, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592770 mentions this issue: data/reports: unexclude 50 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607222 mentions this issue: data/reports: unexclude 20 reports (20)

gopherbot pushed a commit that referenced this issue Aug 21, 2024
  - data/reports/GO-2022-0609.yaml
  - data/reports/GO-2022-0611.yaml
  - data/reports/GO-2022-0612.yaml
  - data/reports/GO-2022-0615.yaml
  - data/reports/GO-2022-0616.yaml
  - data/reports/GO-2022-0617.yaml
  - data/reports/GO-2022-0618.yaml
  - data/reports/GO-2022-0620.yaml
  - data/reports/GO-2022-0622.yaml
  - data/reports/GO-2022-0623.yaml
  - data/reports/GO-2022-0625.yaml
  - data/reports/GO-2022-0626.yaml
  - data/reports/GO-2022-0630.yaml
  - data/reports/GO-2022-0631.yaml
  - data/reports/GO-2022-0632.yaml
  - data/reports/GO-2022-0634.yaml
  - data/reports/GO-2022-0636.yaml
  - data/reports/GO-2022-0638.yaml
  - data/reports/GO-2022-0640.yaml
  - data/reports/GO-2022-0641.yaml

Updates #609
Updates #611
Updates #612
Updates #615
Updates #616
Updates #617
Updates #618
Updates #620
Updates #622
Updates #623
Updates #625
Updates #626
Updates #630
Updates #631
Updates #632
Updates #634
Updates #636
Updates #638
Updates #640
Updates #641

Change-Id: I9fc909832a7e4eb1d23e5eee482674e307e3ee5c
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607222
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Development

No branches or pull requests

4 participants