x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-mv55-23xp-3wp8

[julieqiu]

In GitHub Security Advisory GHSA-mv55-23xp-3wp8, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/kiali/kiali	1.33.0	< 1.33.0

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/kiali/kiali
    versions:
      - fixed: 1.33.0
description: An incorrect access control flaw was found in the kiali-operator in versions
    before 1.33.0. This flaw allows an attacker with a basic level of access to the
    cluster (to deploy a kiali operand) to use this vulnerability and deploy a given
    image to anywhere in the cluster, potentially gaining access to privileged service
    account tokens. The highest threat from this vulnerability is to data confidentiality
    and integrity as well as system availability.
published: 2021-06-08T20:09:36Z
last_modified: 2021-06-15T19:56:21Z
cves:
  - CVE-2021-3495
ghsas:
  - GHSA-mv55-23xp-3wp8
links:
    context:
      - https://github.com/advisories/GHSA-mv55-23xp-3wp8

[rolandshoemaker]

Vuln in tool.

[gopherbot]

Change https://go.dev/cl/592770 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607223 mentions this issue: data/reports: unexclude 20 reports (21)