data/reports: add symbols to GO-2022-1130.yaml

Aliases: CVE-2022-46146, GHSA-7rg2-cxvp-9p7p

Updates #1130

Change-Id: I905dd3fb942d474b63098ae1aac6528e53f533f6
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/459755
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-by: Julie Qiu <[email protected]>
Run-TryBot: Tatiana Bradley <[email protected]>

Author: tatianab

data/osv/GO-2022-1130.json

@@ -1,4 +1,5 @@
 {
+  "schema_version": "1.3.1",
   "id": "GO-2022-1130",
   "published": "0001-01-01T00:00:00Z",
   "modified": "0001-01-01T00:00:00Z",
@@ -38,7 +39,14 @@
       "ecosystem_specific": {
         "imports": [
           {
-            "path": "github.com/prometheus/exporter-toolkit/web"
+            "path": "github.com/prometheus/exporter-toolkit/web",
+            "symbols": [
+              "Listen",
+              "ListenAndServe",
+              "Serve",
+              "ServeMultiple",
+              "webHandler.ServeHTTP"
+            ]
           }
         ]
       }
@@ -58,6 +66,5 @@
     {
       "name": "Lei Wan"
     }
-  ],
-  "schema_version": "1.3.1"
+  ]
 }

data/reports/GO-2022-1130.yaml

@@ -1,20 +1,28 @@
 modules:
-  - module: github.com/prometheus/exporter-toolkit
-    versions:
-      - fixed: 0.7.2
-      - introduced: 0.8.0
-        fixed: 0.8.2
-    packages:
-      - package: github.com/prometheus/exporter-toolkit/web
+    - module: github.com/prometheus/exporter-toolkit
+      versions:
+        - fixed: 0.7.2
+        - introduced: 0.8.0
+          fixed: 0.8.2
+      vulnerable_at: 0.8.1
+      packages:
+        - package: github.com/prometheus/exporter-toolkit/web
+          symbols:
+            - webHandler.ServeHTTP
+          derived_symbols:
+            - Listen
+            - ListenAndServe
+            - Serve
+            - ServeMultiple
 description: |
     If an attacker has access to a Prometheus web.yml file and users' bcrypted
     passwords, it would be possible to bypass security via the built-in
     authentication cache.
 cves:
-  - CVE-2022-46146
+    - CVE-2022-46146
 ghsas:
-  - GHSA-7rg2-cxvp-9p7p
+    - GHSA-7rg2-cxvp-9p7p
 credit: Lei Wan
 references:
-  - advisory: https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
-  - fix: https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5
+    - advisory: https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
+    - fix: https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5