x/vulndb: potential Go vuln in github.com/jpillora/chisel: CVE-2024-43798

[GoVulnBot]

Advisory CVE-2024-43798 references a vulnerability in the following Go modules:

Module
github.com/jpillora/chisel

Description:
Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented AUTH environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the AUTH environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing ser...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-43798
• WEB: GHSA-38jh-8h67-m7mj

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/jpillora/chisel
      vulnerable_at: 1.10.0
summary: CVE-2024-43798 in github.com/jpillora/chisel
cves:
    - CVE-2024-43798
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-43798
    - web: https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj
source:
    id: CVE-2024-43798
    created: 2024-08-27T00:01:11.486381097Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/609141 mentions this issue: data/reports: add 21 unreviewed reports