x/vulndb: potential Go vuln in github.com/openshift/apiserver-library-go: GHSA-92hx-3mh6-hc49

[GoVulnBot]

In GitHub Security Advisory GHSA-92hx-3mh6-hc49, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/openshift/apiserver-library-go	0.0.0-20230621	< 0.0.0-20230621

Cross references:

• Module github.com/openshift/apiserver-library-go appears in issue x/vulndb: potential Go vuln in github.com/openshift/apiserver-library-go: GHSA-5465-xc2j-6p84 #1549

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/openshift/apiserver-library-go
      versions:
        - fixed: 0.0.0-20230621
      packages:
        - package: github.com/openshift/apiserver-library-go
summary: kube-apiserver authentication bypass vulnerability
description: |-
    An authentication bypass vulnerability was discovered in kube-apiserver. This
    issue could allow a remote, authenticated attacker who has been given
    permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond
    what the default is. They would then need to create a new pod or patch one that
    they already have access to. This might allow evasion of SCC admission
    restrictions, thereby gaining control of a privileged pod.
cves:
    - CVE-2023-1260
ghsas:
    - GHSA-92hx-3mh6-hc49
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-1260
    - web: https://access.redhat.com/errata/RHSA-2023:3976
    - web: https://access.redhat.com/errata/RHSA-2023:4093
    - web: https://access.redhat.com/errata/RHSA-2023:4312
    - web: https://access.redhat.com/errata/RHSA-2023:4898
    - web: https://access.redhat.com/security/cve/CVE-2023-1260
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2176267
    - fix: https://github.com/openshift/apiserver-library-go/commit/a994128188486d2dce99a528fbcc017d276081e0
    - advisory: https://github.com/advisories/GHSA-92hx-3mh6-hc49

[jba]

The package containing the fix has no importers.

[gopherbot]

Change https://go.dev/cl/531705 mentions this issue: data/excluded: batch add 18 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports