x/vulndb: potential Go vuln in github.com/apache/trafficcontrol: GHSA-pw59-4qgf-jxr8

[GoVulnBot]

In GitHub Security Advisory GHSA-pw59-4qgf-jxr8, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/apache/trafficcontrol	5.0.0	< 5.0.0

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/apache/trafficcontrol
    versions:
      - fixed: 5.0.0
description: When ORT (now via atstccfg) generates ip_allow.config files in Apache
    Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions
    that allow bad actors to push arbitrary content into and remove arbitrary content
    from CDN cache servers. Additionally, these permissions are potentially extended
    to IP addresses outside the desired range, resulting in them being granted to
    clients possibly outside the CDN arcitechture.
published: 2021-12-16T19:20:21Z
last_modified: 2022-04-12T22:17:55Z
cves:
  - CVE-2020-17522
ghsas:
  - GHSA-pw59-4qgf-jxr8
links:
    context:
      - https://github.com/advisories/GHSA-pw59-4qgf-jxr8

[neild]

Fix is in a Perl script.