x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-v3hp-mcj5-pg39

[GoVulnBot]

In GitHub Security Advisory GHSA-v3hp-mcj5-pg39, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/vault	1.13.1	>= 1.13.0, < 1.13.1

Cross references:

• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-362v-wg5p-64w2 #578 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-c5wc-v287-82pc #590 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-pfmw-vj74-ph8g #611 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-qv95-g3gm-x542 #618 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-23fq-q7hc-993r #620 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-38j9-7pp9-2hjw #623 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-6239-28c2-9mrm, CVE-2021-38554 #632 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault/command: GHSA-25xj-89g5-fm6h #778 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-9vh5-r4qw-v3vv #816 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-fp52-qw33-mfmw #825 NOT_IMPORTABLE
• Module github.com/hashicorp/vault appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-7cgv-v83v-rr87 #1021 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/hashicorp/vault
    versions:
      - introduced: 1.13.0
        fixed: 1.13.1
    packages:
      - package: github.com/hashicorp/vault
  - module: github.com/hashicorp/vault
    versions:
      - introduced: 1.12.0
        fixed: 1.12.5
    packages:
      - package: github.com/hashicorp/vault
  - module: github.com/hashicorp/vault
    versions:
      - introduced: 0.8.0
        fixed: 1.11.9
    packages:
      - package: github.com/hashicorp/vault
summary: HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL
    Injection Via Configuration File
description: HashiCorp Vault and Vault Enterprise versions 0.8.0 until 1.13.1 are
    vulnerable to an SQL injection attack when using the Microsoft SQL (MSSQL) Database
    Storage Backend. When configuring the MSSQL plugin, certain parameters are required
    to establish a connection (schema, database, and table) are not sanitized when
    passed to the user-provided MSSQL database. A privileged attacker with the ability
    to write arbitrary data to Vault's configuration may modify these parameters to
    execute a malicious SQL command when the Vault configuration is applied. This
    issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
cves:
  - CVE-2023-0620
ghsas:
  - GHSA-v3hp-mcj5-pg39
references:
  - web: https://nvd.nist.gov/vuln/detail/CVE-2023-0620
  - web: https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080/1
  - fix: https://github.com/hashicorp/vault/pull/19591
  - web: https://github.com/hashicorp/vault/releases/tag/v1.11.9
  - web: https://github.com/hashicorp/vault/releases/tag/v1.12.5
  - web: https://github.com/hashicorp/vault/releases/tag/v1.13.1
  - advisory: https://github.com/advisories/GHSA-v3hp-mcj5-pg39

[gopherbot]

Change https://go.dev/cl/482615 mentions this issue: data/excluded: batch add GO-2023-1701, GO-2023-1700, GO-2023-1699, GO-2023-1687, GO-2023-1685, GO-2023-1695, GO-2023-1694, GO-2023-1693, GO-2023-1692, GO-2023-1691, GO-2023-1690

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606784 mentions this issue: data/reports: unexclude 20 reports (4)