x/vulndb: potential Go vuln in github.com/hasura/graphql-engine: CVE-2022-46792

[GoVulnBot]

CVE-2022-46792 references github.com/hasura/graphql-engine, which may be a Go module.

Description:
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-46792
• JSON: https://github.com/CVEProject/cvelist/tree/586524d93df50db846e716f92fa734585a22140f/2022/46xxx/CVE-2022-46792.json
• web: https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU
• web: https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/
• web: GHSA-g7mj-g7f4-hgrg
• Imported by: https://pkg.go.dev/github.com/hasura/graphql-engine?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/hasura/graphql-engine
    packages:
      - package: n/a
description: |
    Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
cves:
  - CVE-2022-46792
references:
  - web: https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU
  - web: https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/
  - web: https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg

[gopherbot]

Change https://go.dev/cl/457635 mentions this issue: data/excluded: batch add GO-2022-1164, GO-2022-1161, GO-2022-1160, GO-2022-1158, GO-2022-1154, GO-2022-1153, GO-2022-1152, GO-2022-1151, GO-2022-1147, GO-2022-1162, GO-2022-1150

[gopherbot]

Change https://go.dev/cl/457636 mentions this issue: data/excluded: batch add GO-2022-1164, GO-2022-1161, GO-2022-1160, GO-2022-1154, GO-2022-1153, GO-2022-1152, GO-2022-1151, GO-2022-1147, GO-2022-1162, GO-2022-1150

[gopherbot]

Change https://go.dev/cl/592835 mentions this issue: data/reports: unexclude 50 reports