[GHSA-vrmr-f2qh-3hhf] Improper use of cryptographic key in wal-g

[andrewpollock]

Updates

• Affected products

Comments
Fix versions for SEMVER compliance

[shelbyc]

Hi @andrewpollock, as in #5001, we set the vulnerable version range to < 1.1 because there is no version 1.1.0 on https://github.com/wal-g/wal-g or on https://pkg.go.dev/github.com/wal-g/wal-g. The fix commit is tagged with 1.1 and the release notes for version 1.1 mention the fix, so we're confident that < 1.1 is the correct VVR and 1.1 is the correct patched version.

[andrewpollock]

Hey @shelbyc 👋

Oh, interesting. I hadn't properly appreciated until now that this record is published with an ECOSYSTEM range type (so this version is fine as is) but OSV.dev is coercing all records with ranges for the Go ecosystem to SEMVER, which is where this becomes problematic.

Not your problem 😸

Sorry for the noise!