x/vulndb: potential Go vuln in github.com/cloudflare/cfrpki/cmd/octorpki: GHSA-3pqh-p72c-fj85

[julieqiu]

In GitHub Security Advisory GHSA-3pqh-p72c-fj85, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/cloudflare/cfrpki/cmd/octorpki	1.4.2	< 1.4.2

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/cloudflare/cfrpki/cmd/octorpki
    versions:
      - fixed: 1.4.2
description: "### Impact\n\nWhen copying files with rsync, octorpki uses the \"-a\"
    flag 0, which forces rsync to copy binaries with the suid bit set as root. Since
    the provided service definition defaults to root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service)
    this could allow for a vector, when combined with another vulnerability that causes
    octorpki to process a malicious TAL file, for a local privilege escalation.  \n\n##
    For more information\n\nIf you have any questions or comments about this advisory
    email us at [email protected]"
published: 2021-11-19T19:34:26Z
last_modified: 2022-04-19T19:03:15Z
cves:
  - CVE-2021-3978
ghsas:
  - GHSA-3pqh-p72c-fj85
links:
    context:
      - https://github.com/advisories/GHSA-3pqh-p72c-fj85

[tatianab]

Vulnerability in command, not importable

[gopherbot]

Change https://go.dev/cl/592769 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607221 mentions this issue: data/reports: unexclude 20 reports (19)