-
Notifications
You must be signed in to change notification settings - Fork 62
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x/vulndb: potential Go vuln in github.com/gravitl/netmaker: CVE-2022-36110 #986
Labels
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
NeedsTriage
Comments
Binary, has not been imported by any other module. The description also suggests this is a binary. |
zpavlinovic
added
the
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
label
Sep 16, 2022
Change https://go.dev/cl/431535 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
Sep 16, 2022
Fixes #986 Change-Id: I25ea7842ee6d9b31e578a5254d0246a2b96a38f5 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/431535 Reviewed-by: Damien Neil <dneil@google.com> Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Zvonimir Pavlinovic <zpavlinovic@google.com>
This was referenced Aug 24, 2023
Change https://go.dev/cl/592774 mentions this issue: |
Change https://go.dev/cl/607230 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
Aug 21, 2024
- data/reports/GO-2022-0985.yaml - data/reports/GO-2022-0986.yaml - data/reports/GO-2022-0987.yaml - data/reports/GO-2022-0989.yaml - data/reports/GO-2022-0995.yaml - data/reports/GO-2022-1000.yaml - data/reports/GO-2022-1006.yaml - data/reports/GO-2022-1014.yaml - data/reports/GO-2022-1015.yaml - data/reports/GO-2022-1019.yaml - data/reports/GO-2022-1021.yaml - data/reports/GO-2022-1023.yaml - data/reports/GO-2022-1029.yaml - data/reports/GO-2022-1032.yaml - data/reports/GO-2022-1033.yaml - data/reports/GO-2022-1060.yaml - data/reports/GO-2022-1062.yaml - data/reports/GO-2022-1065.yaml - data/reports/GO-2022-1066.yaml - data/reports/GO-2022-1067.yaml Updates #985 Updates #986 Updates #987 Updates #989 Updates #995 Updates #1000 Updates #1006 Updates #1014 Updates #1015 Updates #1019 Updates #1021 Updates #1023 Updates #1029 Updates #1032 Updates #1033 Updates #1060 Updates #1062 Updates #1065 Updates #1066 Updates #1067 Change-Id: I27b6f79e1898a13040a758a71348464c5e7c72a9 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607230 Auto-Submit: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Commit-Queue: Tatiana Bradley <tatianabradley@google.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
NeedsTriage
CVE-2022-36110 references github.com/gravitl/netmaker, which may be a Go module.
Description:
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.
References:
See doc/triage.md for instructions on how to triage this report.
The text was updated successfully, but these errors were encountered: