x/vulndb: potential Go vuln in github.com/jumpserver/koko: GHSA-4r5x-x283-wm96

[GoVulnBot]

In GitHub Security Advisory GHSA-4r5x-x283-wm96, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/jumpserver/koko	3.7.1	>= 3.0.0, < 3.7.1

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/jumpserver/koko
      versions:
        - introduced: 3.0.0
          fixed: 3.7.1
      packages:
        - package: github.com/jumpserver/koko
    - module: github.com/jumpserver/koko
      versions:
        - introduced: 2.0.0
          fixed: 2.28.20
      packages:
        - package: github.com/jumpserver/koko
summary: |-
    Jumpserver Koko vulnerable to remote code execution on the host system via
    MongoDB shell
cves:
    - CVE-2023-43651
ghsas:
    - GHSA-4r5x-x283-wm96
references:
    - advisory: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-4r5x-x283-wm96
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-43651
    - fix: https://github.com/jumpserver/koko/commit/7d80db95d17c8f42bdf50260dfc21dc2bd0452c2
    - fix: https://github.com/jumpserver/koko/commit/857f8b9e41f0930dc6190a35d8601fffa5e884e7
    - advisory: https://github.com/advisories/GHSA-4r5x-x283-wm96

[timothy-king]

This project tags module versions at versions that do no match the go.mod file. This implies that the project is not intended to be imported as a library by users.

Note: Earliest tagged version is 2.0.2. go.dev/ref/mod instructions for how to release at version v2 or higher apply here.

[gopherbot]

Change https://go.dev/cl/538781 mentions this issue: data/excluded: batch add 4 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports