x/vulndb: potential Go vuln in github.com/apptainer/apptainer: GHSA-mmx5-32m4-wxvx

[GoVulnBot]

In GitHub Security Advisory GHSA-mmx5-32m4-wxvx, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/apptainer/apptainer	1.2.1	>= 1.2.0, < 1.2.1

Cross references:

• Module github.com/apptainer/apptainer appears in issue x/vulndb: potential Go vuln in github.com/apptainer/apptainer: GHSA-j4rf-7357-f4cg #1738 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/apptainer/apptainer
      versions:
        - introduced: 1.2.0
          fixed: 1.2.1
      vulnerable_at: 1.2.0
      packages:
        - package: github.com/apptainer/apptainer
summary: Ineffective privileges drop when requesting container network
description: |-
    ### Impact

    Fix https://github.com/apptainer/apptainer/pull/1523 included in Apptainer
    1.2.0-rc.2 has introduced an ineffective privilege drop when requesting
    container network setup, therefore subsequent functions are called with root
    privileges. The attack surface is rather limited for users but an attacker could
    possibly craft a starter config to delete any directory on the host filesystems.
    Only affects setuid installations of Apptainer.

    ### Patches

    The security fix https://github.com/apptainer/apptainer/pull/1578 has been
    included in Apptainer 1.2.1

    ### Workarounds

    There is no known workaround outside of upgrading to Apptainer 1.2.1
cves:
    - CVE-2023-38496
ghsas:
    - GHSA-mmx5-32m4-wxvx
references:
    - advisory: https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-wxvx
    - fix: https://github.com/apptainer/apptainer/pull/1578
    - advisory: https://github.com/advisories/GHSA-mmx5-32m4-wxvx

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606789 mentions this issue: data/reports: unexclude 20 reports (9)