x/vulndb: potential Go vuln in github.com/containers/podman/v4: GHSA-rh5f-2w6r-q7vj

[GoVulnBot]

In GitHub Security Advisory GHSA-rh5f-2w6r-q7vj, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/containers/podman/v4	1.4.0	< 1.4.0

Cross references:

• Module github.com/containers/podman/v4 appears in issue x/vulndb: potential Go vuln in github.com/containers/podman/v4: GHSA-rprg-4v7q-87v7 #1159
• Module github.com/containers/podman/v4 appears in issue x/vulndb: potential Go vuln in github.com/containers/podman/v4: GHSA-qwqv-rqgf-8qh8 #1681

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/containers/podman/v4
      versions:
        - fixed: 1.4.0
      packages:
        - package: github.com/containers/podman/v4
summary: Podman Path Traversal Vulnerability leads to arbitrary file read/write
description: |-
    A path traversal vulnerability has been discovered in podman before version
    1.4.0 in the way it handles symlinks inside containers. An attacker who has
    compromised an existing container can cause arbitrary files on the host
    filesystem to be read/written when an administrator tries to copy a file from/to
    the container.
cves:
    - CVE-2019-10152
ghsas:
    - GHSA-rh5f-2w6r-q7vj
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-10152
    - report: https://github.com/containers/libpod/issues/3211
    - fix: https://github.com/containers/libpod/pull/3214
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10152
    - web: https://github.com/containers/libpod/blob/master/RELEASE_NOTES.md#140
    - web: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00001.html
    - advisory: https://github.com/advisories/GHSA-rh5f-2w6r-q7vj

[gopherbot]

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)