x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2: GHSA-4frv-5fj6-4p25

[GoVulnBot]

In GitHub Security Advisory GHSA-4frv-5fj6-4p25, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/nats-io/nats-server/v2	2.10.2	>= 2.10.0, < 2.10.2

Cross references:

• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2: GHSA-gwj5-3vfq-q992 #398 EFFECTIVELY_PRIVATE
• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2/server: GHSA-jp4j-47f9-2vc3 #852 NOT_IMPORTABLE
• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2/server: GHSA-m4jx-6526-vvhm #855 NOT_IMPORTABLE
• Module github.com/nats-io/nats-server/v2 appears in issue x/vulndb: potential Go vuln in github.com/nats-io/nats-server/v2: GHSA-fr2g-9hjm-wr23 #2133

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/nats-io/nats-server/v2
      versions:
        - introduced: 2.10.0
          fixed: 2.10.2
      vulnerable_at: 2.10.1
      packages:
        - package: github.com/nats-io/nats-server/v2
    - module: github.com/nats-io/nats-server/v2
      versions:
        - introduced: 2.2.0
          fixed: 2.9.23
      vulnerable_at: 2.9.22
      packages:
        - package: github.com/nats-io/nats-server/v2
summary: |-
    Duplicate Advisory: NATS.io: Adding accounts for just the system account adds
    auth bypass
ghsas:
    - GHSA-4frv-5fj6-4p25
references:
    - advisory: https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23
    - web: https://nvd.nist.gov/vuln/detail/CVE-2023-47090
    - web: https://www.openwall.com/lists/oss-security/2023/10/13/2
    - web: http://www.openwall.com/lists/oss-security/2023/10/30/1
    - advisory: https://github.com/advisories/GHSA-4frv-5fj6-4p25

[neild]

Upstream report withdrawn as a duplicate.

[gopherbot]

Change https://go.dev/cl/607820 mentions this issue: data/excluded: add 3 reports