x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31666, GHSA-jf8p-3vjh-pq94

[tatianab]

In GitHub Security Advisory GHSA-jf8p-3vjh-pq94, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/goharbor/harbor	2.5.2	>= 2.5, <= 2.5.1

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: TODO (earliest fixed "2.5.2", vuln range ">= 2.5, <= 2.5.1")
    packages:
      - package: github.com/goharbor/harbor
  - module: TODO
    versions:
      - introduced: TODO (earliest fixed "2.4.3", vuln range ">= 2.0, <= 2.4.2")
    packages:
      - package: github.com/goharbor/harbor
  - module: TODO
    versions:
      - introduced: TODO (earliest fixed "1.10.13", vuln range ">= 1.0, <= 1.10.12")
    packages:
      - package: github.com/goharbor/harbor
description: |
    ### Impact
    Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is

      GET /projects/{project_name_or_id}/webhook/policies/{webhook_policy_id}

    By sending the below request and specifying different Webhook policy ids in the last part of the URL, the malicious user may disclose Webhook policies related to other repositories/projects.: none;">

    ### Patches
    This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.

    ### Workarounds
    There are no workarounds available.

    ### For more information
    If you have any questions or comments about this advisory:
    * Open an issue in [the Harbor GitHub repository](https://github.com/goharbor/harbor)

    ### Credits
    Thanks to [Gal Goldstein](https://www.linkedin.com/in/gal-goldshtein/) and [Daniel Abeles](https://www.linkedin.com/in/daniel-abeles/) from [Oxeye Security](https://www.oxeye.io/) for reporting this issue.
cves:
  - CVE-2022-31666
ghsas:
  - GHSA-jf8p-3vjh-pq94

[gopherbot]

Change https://go.dev/cl/432170 mentions this issue: data/excluded: add GO-2022-1011.yaml for CVE-2022-31666