x/vulndb: potential Go vuln in github.com/zitadel/zitadel-go/v3: GHSA-qc6v-5g5m-8cw2

[GoVulnBot]

Advisory GHSA-qc6v-5g5m-8cw2 references a vulnerability in the following Go modules:

Module
github.com/zitadel/zitadel-go
github.com/zitadel/zitadel-go/v2
github.com/zitadel/zitadel-go/v3

Description:

Summary

Applications using the zitadel-go v3 library (next branch) might be impacted by package vulnerabilities.
The output of govulncheck suggests that only example code seems to be impacted, based on 1 of the 3 potential vulnerabilities. This vulnerability is located in the transitive dependency golang.org/x/net v0.19.0, CVE-2023-45288

Patches

3.0.0-next versions are fixed on >= 3.0.0-next.3

ZITADEL recommends upgrading to the latest versions available ...

References:

• ADVISORY: GHSA-qc6v-5g5m-8cw2
• ADVISORY: GHSA-qc6v-5g5m-8cw2
• WEB: https://github.com/zitadel/zitadel-go/releases/tag/v3.0.0-next.3
• WEB: https://www.cve.org/CVERecord?id=CVE-2023-45288

Cross references:
No existing reports found with this module or alias.
See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/zitadel/zitadel-go
      non_go_versions:
        - introduced: TODO (earliest fixed "3.0.0-next.3", vuln range ">= 3.0.0-next.1, <= 3.0.0-next.2")
      vulnerable_at: 0.3.5
    - module: github.com/zitadel/zitadel-go/v2
      vulnerable_at: 2.2.6
    - module: github.com/zitadel/zitadel-go/v3
      vulnerable_at: 3.0.0-next.3
summary: |-
    ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION
    flood in net/http in github.com/zitadel/zitadel-go
ghsas:
    - GHSA-qc6v-5g5m-8cw2
references:
    - advisory: https://github.com/advisories/GHSA-qc6v-5g5m-8cw2
    - advisory: https://github.com/zitadel/zitadel-go/security/advisories/GHSA-qc6v-5g5m-8cw2
    - web: https://github.com/zitadel/zitadel-go/releases/tag/v3.0.0-next.3
    - web: https://www.cve.org/CVERecord?id=CVE-2023-45288
source:
    id: GHSA-qc6v-5g5m-8cw2
    created: 2024-07-15T18:01:15.31629359Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/598592 mentions this issue: data/excluded,data/reports: review 2 reports, add GO-2024-2983