x/vulndb: potential Go vuln in github.com/clastix/capsule-proxy: CVE-2022-23652

[GoVulnBot]

In CVE-2022-23652, the reference URL github.com/clastix/capsule-proxy (and possibly others) refers to something in Go.

• Commit: projectcapsule/capsule-proxy@efe91f6

module: github.com/clastix/capsule-proxy
package: capsule-proxy
description: |+
    capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.

cves:
  - CVE-2022-23652
links:
    commit: https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8
    context:
      - https://github.com/clastix/capsule-proxy/issues/188
      - https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjm

See doc/triage.md for instructions on how to triage this report.

[julieqiu]

Vulnerability in tool

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607216 mentions this issue: data/reports: unexclude 20 reports (14)