x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-67fw-w8f2-88wp

[GoVulnBot]

Advisory GHSA-67fw-w8f2-88wp references a vulnerability in the following Go modules:

Module
github.com/casdoor/casdoor

Description:
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.

References:

• ADVISORY: GHSA-67fw-w8f2-88wp
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-41264
• WEB: https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f
• WEB: https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go

Cross references:

• github.com/casdoor/casdoor appears in 4 other report(s):
  • data/excluded/GO-2022-0303.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: CVE-2022-24124 #303) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2022-1006.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: CVE-2022-38638, GHSA-9vm3-r8gq-cr6x #1006) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2022-1153.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-f93f-55c2-8c89 #1153) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-1868.yaml (x/vulndb: potential Go vuln in github.com/casdoor/casdoor: GHSA-rwcp-qrwg-56cg #1868) EFFECTIVELY_PRIVATE

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/casdoor/casdoor
      non_go_versions:
        - introduced: TODO (earliest fixed "", vuln range ">= 1.541.0, <= 1.636.0")
      vulnerable_at: 1.659.0
summary: casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification in github.com/casdoor/casdoor
cves:
    - CVE-2024-41264
ghsas:
    - GHSA-67fw-w8f2-88wp
references:
    - advisory: https://github.com/advisories/GHSA-67fw-w8f2-88wp
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-41264
    - web: https://gist.github.com/nyxfqq/33ceaccbc9b05d439a944c2b55fa1c0f
    - web: https://github.com/casdoor/casdoor/blob/v1.636.0/object/viaSSHDialer.go
source:
    id: GHSA-67fw-w8f2-88wp
    created: 2024-08-02T14:02:56.414611863Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports