Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-6hw5-6gcx-phmw #559

Closed
julieqiu opened this issue Aug 1, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-6hw5-6gcx-phmw #559

julieqiu opened this issue Aug 1, 2022 · 3 comments
Assignees
@julieqiu
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@julieqiu
Copy link
Member

julieqiu commented Aug 1, 2022

In GitHub Security Advisory GHSA-6hw5-6gcx-phmw, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/hashicorp/consul 1.8.15 < 1.8.15

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/hashicorp/consul
    versions:
      - fixed: 1.8.15
  - package: github.com/hashicorp/consul
    versions:
      - introduced: 1.9.0
        fixed: 1.9.9
  - package: github.com/hashicorp/consul
    versions:
      - introduced: TODO (earliest fixed "1.10.2", vuln range "= 1.10.1")
description: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed
    services to register proxies for other services, enabling access to service traffic.
    Fixed in 1.8.15, 1.9.9 and 1.10.2.
published: 2021-09-08T20:14:56Z
last_modified: 2021-09-16T18:57:25Z
cves:
  - CVE-2021-38698
ghsas:
  - GHSA-6hw5-6gcx-phmw
links:
    context:
      - https://github.com/advisories/GHSA-6hw5-6gcx-phmw
@julieqiu julieqiu self-assigned this Aug 3, 2022
@julieqiu
Copy link
Member Author

julieqiu commented Aug 3, 2022

Vuln in tool. Not importable.

@julieqiu julieqiu closed this as completed Aug 3, 2022
@neild neild added excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. and removed NotGoVuln labels Aug 10, 2022
@GoVulnBot GoVulnBot mentioned this issue Mar 16, 2023
Closed
This was referenced Jun 6, 2023
Closed
Closed
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Jul 19, 2023
Closed
This was referenced Feb 1, 2024
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 3, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 10, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592769 mentions this issue: data/reports: unexclude 50 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607220 mentions this issue: data/reports: unexclude 20 reports (18)

gopherbot pushed a commit that referenced this issue Aug 21, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (18)
2c69a3a 
  - data/reports/GO-2022-0507.yaml
  - data/reports/GO-2022-0508.yaml
  - data/reports/GO-2022-0509.yaml
  - data/reports/GO-2022-0510.yaml
  - data/reports/GO-2022-0511.yaml
  - data/reports/GO-2022-0512.yaml
  - data/reports/GO-2022-0516.yaml
  - data/reports/GO-2022-0517.yaml
  - data/reports/GO-2022-0518.yaml
  - data/reports/GO-2022-0540.yaml
  - data/reports/GO-2022-0547.yaml
  - data/reports/GO-2022-0550.yaml
  - data/reports/GO-2022-0554.yaml
  - data/reports/GO-2022-0556.yaml
  - data/reports/GO-2022-0559.yaml
  - data/reports/GO-2022-0560.yaml
  - data/reports/GO-2022-0561.yaml
  - data/reports/GO-2022-0562.yaml
  - data/reports/GO-2022-0566.yaml
  - data/reports/GO-2022-0570.yaml

Updates #507
Updates #508
Updates #509
Updates #510
Updates #511
Updates #512
Updates #516
Updates #517
Updates #518
Updates #540
Updates #547
Updates #550
Updates #554
Updates #556
Updates #559
Updates #560
Updates #561
Updates #562
Updates #566
Updates #570

Change-Id: I3197ea86e01d2ed4ae9e7f17dbd7a3e495c903e4
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607220
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This was referenced Oct 31, 2024
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@julieqiu julieqiu

Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @julieqiu @gopherbot