x/vulndb: potential Go vuln in github.com/edgelesssys/constellation/v2: GHSA-r2h5-3hgw-8j34

[GoVulnBot]

In GitHub Security Advisory GHSA-r2h5-3hgw-8j34, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/edgelesssys/constellation/v2	2.5.2	<= 2.5.1

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/edgelesssys/constellation/v2
    versions:
      - introduced: TODO (earliest fixed "2.5.2", vuln range "<= 2.5.1")
    packages:
      - package: github.com/edgelesssys/constellation/v2
description: |-
    ### Impact
    Attestation *user data* (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.

    ### Patches
    The issue has been patched in [v2.5.2](https://github.com/edgelesssys/constellation/releases/tag/v2.5.2).

    ### Workarounds
    none
ghsas:
  - GHSA-r2h5-3hgw-8j34
references:
  - advisory: https://github.com/edgelesssys/constellation/security/advisories/GHSA-r2h5-3hgw-8j34
  - web: https://github.com/edgelesssys/constellation/releases/tag/v2.5.2
  - advisory: https://github.com/advisories/GHSA-r2h5-3hgw-8j34

[gopherbot]

Change https://go.dev/cl/471796 mentions this issue: data/excluded: batch add excluded reports

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606782 mentions this issue: data/reports: unexclude 20 reports (2)