x/vulndb: potential Go vuln in github.com/mozilla-mobile/mozilla-vpn-client: CVE-2023-4104

[GoVulnBot]

CVE-2023-4104 references github.com/mozilla-mobile/mozilla-vpn-client, which may be a Go module.

Description:
An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.
This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected. This vulnerability affects Mozilla VPN client for Linux < v2.16.1.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-4104
• JSON: https://github.com/CVEProject/cvelist/tree/ebcfe0ed85610be7f3180d845c73fba85826938e/2023/4xxx/CVE-2023-4104.json
• web: https://bugzilla.mozilla.org/show_bug.cgi?id=1831318
• fix: Linux: Remove the use of polkit mozilla-mobile/mozilla-vpn-client#7055
• fix: Linux: Re-introduce D-Bus API Authorization mozilla-mobile/mozilla-vpn-client#7110
• fix: Polkit auth mozilla-mobile/mozilla-vpn-client#7151
• advisory: https://www.mozilla.org/security/advisories/mfsa2023-39/
• web: https://www.openwall.com/lists/oss-security/2023/08/03/1
• Imported by: https://pkg.go.dev/github.com/mozilla-mobile/mozilla-vpn-client?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/mozilla-mobile/mozilla-vpn-client
      vulnerable_at: 2.16.1+incompatible
      packages:
        - package: Mozilla VPN client for Linux
description: |-
    An invalid Polkit Authentication check and missing authentication requirements
    for D-Bus methods allowed any local user to configure arbitrary VPN setups.
    *This bug only affects Mozilla VPN on Linux. Other operating systems are
    unaffected.* This vulnerability affects Mozilla VPN client for Linux < v2.16.1.
cves:
    - CVE-2023-4104
references:
    - web: https://bugzilla.mozilla.org/show_bug.cgi?id=1831318
    - fix: https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055
    - fix: https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110
    - fix: https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7151
    - advisory: https://www.mozilla.org/security/advisories/mfsa2023-39/
    - web: https://www.openwall.com/lists/oss-security/2023/08/03/1

[gopherbot]

Change https://go.dev/cl/528596 mentions this issue: data/excluded: batch add 10 excluded reports