x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-j9hf-98c3-wrm8

[tatianab]

In GitHub Security Advisory GHSA-j9hf-98c3-wrm8, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/cri-o/cri-o	1.28.7	= 1.28.6

Cross references:

• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-0811 #354 NOT_IMPORTABLE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-w2j5-3rcx-vx7x #363 NOT_IMPORTABLE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-27652 #426 NOT_IMPORTABLE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-1708 #480 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-jqmc-79gx-7g8p #608 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2022-2995 #1014 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-cm9x-c3rh-7rc4 #1206 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: GHSA-p4rx-7wvg-fwrc #2458 EFFECTIVELY_PRIVATE
• Module github.com/cri-o/cri-o appears in issue x/vulndb: potential Go vuln in github.com/cri-o/cri-o: CVE-2024-3154 #2791

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cri-o/cri-o
      non_go_versions:
        - introduced: TODO (earliest fixed "1.28.7", vuln range "= 1.28.6")
      vulnerable_at: 1.30.2
      packages:
        - package: github.com/cri-o/cri-o
    - module: github.com/cri-o/cri-o
      non_go_versions:
        - introduced: TODO (earliest fixed "1.29.5", vuln range "= 1.29.4")
      vulnerable_at: 1.30.2
      packages:
        - package: github.com/cri-o/cri-o
    - module: github.com/cri-o/cri-o
      non_go_versions:
        - introduced: TODO (earliest fixed "1.30.1", vuln range "= 1.30.0")
      vulnerable_at: 1.30.2
      packages:
        - package: github.com/cri-o/cri-o
summary: malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o
cves:
    - CVE-2024-5154
ghsas:
    - GHSA-j9hf-98c3-wrm8
references:
    - advisory: https://github.com/advisories/GHSA-j9hf-98c3-wrm8
    - advisory: https://github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8
notes:
    - fix: 'module merge error: could not merge versions of module github.com/cri-o/cri-o: invalid or non-canonical semver version (found TODO (earliest fixed "1.28.7", vuln range "= 1.28.6"))'
source:
    id: GHSA-j9hf-98c3-wrm8
    created: 2024-06-07T17:18:15.058375-04:00
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/592456 mentions this issue: data/reports: add 19 unreviewed reports

[tatianab]

Duplicate of #2919