Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/docker/docker: GHSA-wxj3-qwv4-cvfm #752

Closed
julieqiu opened this issue Aug 1, 2022 · 3 comments
Assignees
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.

Comments

@julieqiu
Copy link
Member

julieqiu commented Aug 1, 2022

In GitHub Security Advisory GHSA-wxj3-qwv4-cvfm, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/docker/docker 1.0.1 < 1.0.1

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/docker/docker
    versions:
      - fixed: 1.0.1
description: Docker 1.0.0 uses world-readable and world-writable permissions on the
    management socket, which allows local users to gain privileges via unspecified
    vectors.
published: 2022-02-15T00:40:44Z
last_modified: 2022-02-15T00:40:44Z
cves:
  - CVE-2014-3499
ghsas:
  - GHSA-wxj3-qwv4-cvfm
links:
    context:
      - https://github.com/advisories/GHSA-wxj3-qwv4-cvfm

@julieqiu julieqiu self-assigned this Aug 3, 2022
@julieqiu
Copy link
Member Author

julieqiu commented Aug 3, 2022

Vulnerability in tool. Not importable.

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592770 mentions this issue: data/reports: unexclude 50 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/607223 mentions this issue: data/reports: unexclude 20 reports (21)

gopherbot pushed a commit that referenced this issue Aug 21, 2024
  - data/reports/GO-2022-0642.yaml
  - data/reports/GO-2022-0644.yaml
  - data/reports/GO-2022-0645.yaml
  - data/reports/GO-2022-0647.yaml
  - data/reports/GO-2022-0649.yaml
  - data/reports/GO-2022-0700.yaml
  - data/reports/GO-2022-0703.yaml
  - data/reports/GO-2022-0704.yaml
  - data/reports/GO-2022-0705.yaml
  - data/reports/GO-2022-0707.yaml
  - data/reports/GO-2022-0708.yaml
  - data/reports/GO-2022-0709.yaml
  - data/reports/GO-2022-0732.yaml
  - data/reports/GO-2022-0749.yaml
  - data/reports/GO-2022-0751.yaml
  - data/reports/GO-2022-0752.yaml
  - data/reports/GO-2022-0759.yaml
  - data/reports/GO-2022-0760.yaml
  - data/reports/GO-2022-0769.yaml
  - data/reports/GO-2022-0770.yaml

Updates #642
Updates #644
Updates #645
Updates #647
Updates #649
Updates #700
Updates #703
Updates #704
Updates #705
Updates #707
Updates #708
Updates #709
Updates #732
Updates #749
Updates #751
Updates #752
Updates #759
Updates #760
Updates #769
Updates #770

Change-Id: I3dabcc907fd498009a9bd4cf865198037615717e
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607223
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Tatiana Bradley <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable.
Projects
None yet
Development

No branches or pull requests

3 participants