x/vulndb: potential Go vuln in vitess.io/vitess: GHSA-pqj7-jx24-wj7w

[GoVulnBot]

In GitHub Security Advisory GHSA-pqj7-jx24-wj7w, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
vitess.io/vitess	0.16.2	< 0.16.2

Cross references:

• Module vitess.io/vitess appears in issue x/vulndb: potential Go vuln in vitess.io/vitess: GHSA-735r-hv67-g38f #1717

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: vitess.io/vitess
    versions:
      - fixed: 0.16.2
    packages:
      - package: vitess.io/vitess
summary: VTAdmin users that can create shards can deny access to other functions
description: "### Impact\nUsers can either intentionally or inadvertently create a
    shard containing `/` characters from VTAdmin such that from that point on, anyone
    who tries to create a new shard from VTAdmin will receive an error. \nAttempting
    to view the keyspace(s) will also no longer work.\nCreating a shard using `vtctldclient`
    does not have the same problem because the CLI validates the input correctly.\n\n###
    Patches\nv16.0.2, corresponding to [0.16.2 on pkg.go.dev](https://pkg.go.dev/vitess.io/[email protected])\n\n###
    Workarounds\n- Always use `vtctldclient` to create shards, instead of using VTAdmin\n-
    Disable creating shards from VTAdmin using RBAC\n- Delete the topology record
    for the offending shard using the client for your topology server. For example,
    if you created a shard called `a/b` in keyspace `commerce`, and you are running
    etcd, it can be deleted by doing something like\n```\n% etcdctl --endpoints \"http://${ETCD_SERVER}\"
    del /vitess/global/keyspaces/commerce/shards/a/b/Shard\n```\n\n### References\nhttps://github.com/vitessio/vitess/issues/12842\n\nFound
    during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated
    by [OSTIF](https://ostif.org)."
cves:
  - CVE-2023-29195
ghsas:
  - GHSA-pqj7-jx24-wj7w
references:
  - advisory: https://github.com/vitessio/vitess/security/advisories/GHSA-pqj7-jx24-wj7w
  - report: https://github.com/vitessio/vitess/issues/12842
  - fix: https://github.com/vitessio/vitess/pull/12843
  - fix: https://github.com/vitessio/vitess/commit/9dcbd7de3180f47e94f54989fb5c66daea00c920
  - web: https://github.com/vitessio/vitess/releases/tag/v16.0.2
  - web: https://pkg.go.dev/vitess.io/[email protected]
  - advisory: https://github.com/advisories/GHSA-pqj7-jx24-wj7w

[gopherbot]

Change https://go.dev/cl/495335 mentions this issue: data/excluded: batch add GO-2023-1775, GO-2023-1778, GO-2023-1774, GO-2023-1771, GO-2023-1769, GO-2023-1768, GO-2023-1779

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports