x/vulndb: potential Go vuln in github.com/deis/workflow-manager: CVE-2016-15036

[GoVulnBot]

CVE-2016-15036 references github.com/deis/workflow-manager, which may be a Go module.

Description:
** UNSUPPPORTED WHEN ASSIGNED ** ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown part. The manipulation leads to race condition. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 2.3.3 is able to address this issue. The patch is named 31fe3bccbdde134a185752e53380330d16053f7f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248847. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2016-15036
• JSON: https://github.com/CVEProject/cvelist/tree/01b433bbd76cebf81bd6b0b329ccc5dde9e55aba/2016/15xxx/CVE-2016-15036.json
• web: https://vuldb.com/?id.248847
• web: https://vuldb.com/?ctiid.248847
• fix: cluster_id is vulnerable to race condition when called concurrently deis/workflow-manager#94
• fix: deis/workflow-manager@31fe3bc
• web: https://github.com/deis/workflow-manager/releases/tag/v2.3.3
• Imported by: https://pkg.go.dev/github.com/deis/workflow-manager?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/deis/workflow-manager
      vulnerable_at: 2.5.1+incompatible
      packages:
        - package: Workflow Manager
cves:
    - CVE-2016-15036
references:
    - web: https://vuldb.com/?id.248847
    - web: https://vuldb.com/?ctiid.248847
    - fix: https://github.com/deis/workflow-manager/pull/94
    - fix: https://github.com/deis/workflow-manager/commit/31fe3bccbdde134a185752e53380330d16053f7f
    - web: https://github.com/deis/workflow-manager/releases/tag/v2.3.3

[jba]

No importers.
All mains are either in this module or a likely fork of it, github.com/jackfrancis/workflow-manager.

[gopherbot]

Change https://go.dev/cl/553636 mentions this issue: data/excluded: batch add 6 excluded reports

[gopherbot]

Change https://go.dev/cl/592764 mentions this issue: data/reports: unexclude 31 reports

[gopherbot]

Change https://go.dev/cl/606793 mentions this issue: data/reports: unexclude 15 reports (12)