x/vulndb: potential Go vuln in github.com/v2fly/v2ray-core: GHSA-4cxw-hq44-r344

[julieqiu]

In GitHub Security Advisory GHSA-4cxw-hq44-r344, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/v2fly/v2ray-core		< 4.44.0

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/v2fly/v2ray-core
    versions:
      - introduced: TODO (earliest fixed "", vuln range "< 4.44.0")
  - package: github.com/v2fly/v2ray-core/v4
    versions:
      - fixed: 4.44.0
description: v2fly/v2ray-core prior to 4.44.0 is vulnerable to an off-by-one error.
    Indexing operations on arrays, slices, or strings should use an index at most
    one less than the length. If the index is checked for being less than or equal
    to the length (`<=`), instead of less than the length (`<`), the index could be
    out of bounds.
published: 2022-02-24T00:00:52Z
last_modified: 2022-03-03T19:17:50Z
cves:
  - CVE-2021-4070
ghsas:
  - GHSA-4cxw-hq44-r344
links:
    context:
      - https://github.com/advisories/GHSA-4cxw-hq44-r344

[gopherbot]

Change https://go.dev/cl/592768 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607220 mentions this issue: data/reports: unexclude 20 reports (18)