x/vulndb: potential Go vuln in github.com/rudderlabs/rudder-server: CVE-2023-30625

[GoVulnBot]

CVE-2023-30625 references github.com/rudderlabs/rudder-server, which may be a Go module.

Description:
rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the rudder role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-30625
• JSON: https://github.com/CVEProject/cvelist/tree/ca8493a1b56e6c91c69c3a5ce1caa9dc93e8d8cd/2023/30xxx/CVE-2023-30625.json
• advisory: https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/
• fix: fix: changed query to accept user input in prepared sql statement rudderlabs/rudder-server#2652
• fix: fix: properly escape table name when querying for failed events rudderlabs/rudder-server#2663
• fix: fix: always use a sql safe table name in failed events manager rudderlabs/rudder-server#2664
• fix: rudderlabs/rudder-server@0d061ff
• fix: rudderlabs/rudder-server@2f956b7
• fix: rudderlabs/rudder-server@9c009d9
• Imported by: https://pkg.go.dev/github.com/rudderlabs/rudder-server?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/rudderlabs/rudder-server
      packages:
        - package: rudder-server
description: |
    rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.
cves:
    - CVE-2023-30625
references:
    - advisory: https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/
    - fix: https://github.com/rudderlabs/rudder-server/pull/2652
    - fix: https://github.com/rudderlabs/rudder-server/pull/2663
    - fix: https://github.com/rudderlabs/rudder-server/pull/2664
    - fix: https://github.com/rudderlabs/rudder-server/commit/0d061ff2d8c16845179d215bf8012afceba12a30
    - fix: https://github.com/rudderlabs/rudder-server/commit/2f956b7eb3d5eb2de3e79d7df2c87405af25071e
    - fix: https://github.com/rudderlabs/rudder-server/commit/9c009d9775abc99e72fc470f4c4c8e8f1775e82a

[gopherbot]

Change https://go.dev/cl/504860 mentions this issue: data/excluded: batch add 3 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606787 mentions this issue: data/reports: unexclude 20 reports (7)