x/vulndb: potential Go vuln in istio.io/istio: GHSA-hqxw-mm44-gc4r

[GoVulnBot]

In GitHub Security Advisory GHSA-hqxw-mm44-gc4r, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
istio.io/istio	1.11.1	= 1.11.0

Cross references:

• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio/pkg/log: GHSA-6g5f-f5pm-mjrg #633 EFFECTIVELY_PRIVATE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio/pilot/pkg/security/authz/model/matcher: GHSA-82mm-ffjr-h86c #810 NOT_IMPORTABLE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio: CVE-2021-39155, GHSA-7774-7vr3-cc8j #931 NOT_IMPORTABLE
• CVE-2021-39156 appears in issue x/vulndb: potential Go vuln in istio.io/istio: CVE-2021-39156, GHSA-hqxw-mm44-gc4r #932 NOT_IMPORTABLE
• GHSA-hqxw-mm44-gc4r appears in issue x/vulndb: potential Go vuln in istio.io/istio: CVE-2021-39156, GHSA-hqxw-mm44-gc4r #932 NOT_IMPORTABLE
• Module istio.io/istio appears in issue x/vulndb: potential Go vuln in istio.io/istio: CVE-2021-39156, GHSA-hqxw-mm44-gc4r #932 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: istio.io/istio
    versions:
      - introduced: TODO (earliest fixed "1.11.1", vuln range "= 1.11.0")
    packages:
      - package: istio.io/istio
  - module: istio.io/istio
    versions:
      - introduced: 1.10.0
        fixed: 1.10.4
    packages:
      - package: istio.io/istio
  - module: istio.io/istio
    versions:
      - fixed: 1.9.8
    packages:
      - package: istio.io/istio
description: "### Impact\nIstio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain
    a remotely exploitable vulnerability where an HTTP request with `#fragment` in
    the path may bypass Istio’s URI path based authorization policies. \n\n### Patches\n*
    Istio 1.11.1 and above\n* Istio 1.10.4 and above\n* Istio 1.9.8 and above\n\n###
    Workarounds\nA Lua filter may be written to normalize the path.  This is similar
    to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization)
    guide.\n\n### References\nMore details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)\n\n###
    For more information\nIf you have any questions or comments about this advisory,
    please email us at [email protected]\n"
cves:
  - CVE-2021-39156
ghsas:
  - GHSA-hqxw-mm44-gc4r

[tatianab]

Duplicate of #932