x/vulndb: potential Go vuln in github.com/labring/sealos: CVE-2023-33190

[GoVulnBot]

CVE-2023-33190 references github.com/labring/sealos, which may be a Go module.

Description: Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.0 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-33190
• JSON: https://github.com/CVEProject/cvelist/tree/f8c7af637c74ac4f5edaeb4ca612eb8ea61b6bb7/2023/33xxx/CVE-2023-33190.json
• advisory: https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62
• Imported by: https://pkg.go.dev/github.com/labring/sealos?tab=importedby

Cross references: No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/labring/sealos
      vulnerable_at: 1.14.0
      packages:
        - package: sealos
description: |-
    Sealos is an open source cloud operating system distribution based on the
    Kubernetes kernel. In versions of Sealos prior to 4.2.0 an improper
    configuration of role based access control (RBAC) permissions resulted in an
    attacker being able to obtain cluster control permissions, which could control
    the entire cluster deployed with Sealos, as well as hundreds of pods and other
    resources within the cluster. This issue has been addressed in version 4.2.0.
    Users are advised to upgrade. There are no known workarounds for this
    vulnerability.
cves:
    - CVE-2023-33190
references:
    - advisory: https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62

[gopherbot]

Change https://go.dev/cl/507896 mentions this issue: data/excluded: batch add 10 excluded reports

[gopherbot]

Change https://go.dev/cl/507901 mentions this issue: data/excluded: batch add 8 excluded reports

[gopherbot]

Change https://go.dev/cl/507904 mentions this issue: data/excluded: batch add 8 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports