x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-6f4m-j56w-55c3

[GoVulnBot]

In GitHub Security Advisory GHSA-6f4m-j56w-55c3, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/kiali/kiali	1.57.4	< 1.57.4

Cross references:

• Module github.com/kiali/kiali appears in issue x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-465w-gg5p-85c9 #626 EFFECTIVELY_PRIVATE
• Module github.com/kiali/kiali appears in issue x/vulndb: potential Go vuln in github.com/kiali/kiali/config: GHSA-64rh-r86q-75ff #631 EFFECTIVELY_PRIVATE
• Module github.com/kiali/kiali appears in issue x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-mv55-23xp-3wp8 #645 EFFECTIVELY_PRIVATE
• Module github.com/kiali/kiali appears in issue x/vulndb: potential Go vuln in github.com/kiali/kiali: GHSA-ggjr-2f7v-vhq4 #700 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/kiali/kiali
      versions:
        - fixed: 1.57.4
      vulnerable_at: 1.57.3
      packages:
        - package: github.com/kiali/kiali
summary: Kiali content spoofing vulnerability
description: |-
    A content spoofing vulnerability was found in Kiali. It was discovered that
    Kiali does not implement error handling when the page or endpoint being accessed
    cannot be found. This issue allows an attacker to perform arbitrary text
    injection when an error response is retrieved from the URL being accessed.
cves:
    - CVE-2022-3962
ghsas:
    - GHSA-6f4m-j56w-55c3
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2022-3962
    - web: https://access.redhat.com/errata/RHSA-2023:0542
    - web: https://access.redhat.com/security/cve/CVE-2022-3962
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2148661
    - fix: https://github.com/kiali/kiali/commit/aab7694f850f04d7fd875fac5f720a93ccdf01ad
    - web: https://issues.redhat.com/browse/OSSM-2251?attachmentViewMode=list
    - advisory: https://github.com/advisories/GHSA-6f4m-j56w-55c3

[gopherbot]

Change https://go.dev/cl/531705 mentions this issue: data/excluded: batch add 18 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606791 mentions this issue: data/reports: unexclude 20 reports (11)