x/vulndb: potential Go vuln in github.com/woodpecker-ci/woodpecker: CVE-2023-40034

[GoVulnBot]

CVE-2023-40034 references github.com/woodpecker-ci/woodpecker, which may be a Go module.

Description:
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. This issue has been addressed in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-40034
• JSON: https://github.com/CVEProject/cvelist/tree/3fb83566bc95ca23e0ea6eb1891f68cef58b6508/2023/40xxx/CVE-2023-40034.json
• advisory: GHSA-4gcf-5m39-98mc
• fix: Validate webhook before changing any data woodpecker-ci/woodpecker#2221
• fix: Validate webhook before change any data (#2221) woodpecker-ci/woodpecker#2222
• fix: woodpecker-ci/woodpecker@6e4c2f8
• Imported by: https://pkg.go.dev/github.com/woodpecker-ci/woodpecker?tab=importedby

Cross references:

• Module github.com/woodpecker-ci/woodpecker appears in issue x/vulndb: potential Go vuln in github.com/woodpecker-ci/woodpecker: CVE-2022-29947 #440 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/woodpecker-ci/woodpecker
      vulnerable_at: 1.0.2
      packages:
        - package: woodpecker
description: |-
    Woodpecker is a community fork of the Drone CI system. In affected versions an
    attacker can post malformed webhook data witch lead to an update of the
    repository data that can e.g. allow the takeover of an repo. This is only
    critical if the CI is configured for public usage and connected to a forge witch
    is also in public usage. This issue has been addressed in version 1.0.2. Users
    are advised to upgrade. Users unable to upgrade should secure the CI system by
    making it inaccessible to untrusted entities, for example, by placing it behind
    a firewall.
cves:
    - CVE-2023-40034
references:
    - advisory: https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc
    - fix: https://github.com/woodpecker-ci/woodpecker/pull/2221
    - fix: https://github.com/woodpecker-ci/woodpecker/pull/2222
    - fix: https://github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105

[gopherbot]

Change https://go.dev/cl/522555 mentions this issue: data/excluded: batch add 11 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606790 mentions this issue: data/reports: unexclude 20 reports (10)