x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-jf8p-3vjh-pq94

[GoVulnBot]

In GitHub Security Advisory GHSA-jf8p-3vjh-pq94, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/goharbor/harbor	2.5.2	>= 2.5, <= 2.5.1

Cross references:

• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-q9x4-q76f-5h5j #704 EFFECTIVELY_PRIVATE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-33p6-fx42-7rf5 #781 NOT_IMPORTABLE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-38r5-34mr-mvm7 #785 NOT_IMPORTABLE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-jr34-mff8-pc6f #853 NOT_IMPORTABLE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-q6cj-6jvq-jwmh #863 NOT_IMPORTABLE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-rffr-c932-cpxv #876 NOT_IMPORTABLE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: GHSA-w4x5-jqq4-qc8x #883 NOT_IMPORTABLE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31667, GHSA-xx9w-464f-7h6f #1009 EFFECTIVELY_PRIVATE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31669, GHSA-8c6p-v837-77f6 #1010 EFFECTIVELY_PRIVATE
• CVE-2022-31666 appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31666, GHSA-jf8p-3vjh-pq94 #1011 EFFECTIVELY_PRIVATE
• GHSA-jf8p-3vjh-pq94 appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31666, GHSA-jf8p-3vjh-pq94 #1011 EFFECTIVELY_PRIVATE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31666, GHSA-jf8p-3vjh-pq94 #1011 EFFECTIVELY_PRIVATE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31670, GHSA-3637-v6vq-xqqw #1012 EFFECTIVELY_PRIVATE
• Module github.com/goharbor/harbor appears in issue x/vulndb: potential Go vuln in github.com/goharbor/harbor: CVE-2022-31671, GHSA-q76q-q8hw-hmpw #1013 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/goharbor/harbor
    versions:
      - introduced: TODO (earliest fixed "2.5.2", vuln range ">= 2.5, <= 2.5.1")
    packages:
      - package: github.com/goharbor/harbor
  - module: github.com/goharbor/harbor
    versions:
      - introduced: TODO (earliest fixed "2.4.3", vuln range ">= 2.0, <= 2.4.2")
    packages:
      - package: github.com/goharbor/harbor
  - module: github.com/goharbor/harbor
    versions:
      - introduced: TODO (earliest fixed "1.10.13", vuln range ">= 1.0, <= 1.10.12")
    packages:
      - package: github.com/goharbor/harbor
description: |
    ### Impact
    Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is

      GET /projects/{project_name_or_id}/webhook/policies/{webhook_policy_id}

    By sending the below request and specifying different Webhook policy ids in the last part of the URL, the malicious user may disclose Webhook policies related to other repositories/projects.: none;">

    ### Patches
    This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.

    ### Workarounds
    There are no workarounds available.

    ### For more information
    If you have any questions or comments about this advisory:
    * Open an issue in [the Harbor GitHub repository](https://github.com/goharbor/harbor)

    ### Credits
    Thanks to [Gal Goldstein](https://www.linkedin.com/in/gal-goldshtein/) and [Daniel Abeles](https://www.linkedin.com/in/daniel-abeles/) from [Oxeye Security](https://www.oxeye.io/) for reporting this issue.
cves:
  - CVE-2022-31666
ghsas:
  - GHSA-jf8p-3vjh-pq94

[tatianab]

Duplicate of #1011