x/vulndb: potential Go vuln in github.com/nats-io/nats-server: CVE-2022-26652

[GoVulnBot]

In CVE-2022-26652, the reference URL github.com/nats-io/nats-server (and possibly others) refers to something in Go.

module: github.com/nats-io/nats-server
package: n/a
description: |
    NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
cves:
  - CVE-2022-26652
links:
    context:
      - http://www.openwall.com/lists/oss-security/2022/03/10/1
      - https://advisories.nats.io/CVE/CVE-2022-26652.txt
      - https://github.com/nats-io/nats-server/releases
      - https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68

See doc/triage.md for instructions on how to triage this report.

[neild]

This a bug in the nast-server daemon, not a user-imported package.

[gopherbot]

Change https://go.dev/cl/592767 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607216 mentions this issue: data/reports: unexclude 20 reports (14)