x/vulndb: potential Go vuln in github.com/ossrs/srs: CVE-2023-34105

[GoVulnBot]

CVE-2023-34105 references github.com/ossrs/srs, which may be a Go module.

Description:
SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's api-server server is vulnerable to a drive-by command injection. An attacker may send a request to the /api/v1/snapshots endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-34105
• JSON: https://github.com/CVEProject/cvelist/tree/da49990d2735e64657dd435d1df53d575160a574/2023/34xxx/CVE-2023-34105.json
• advisory: GHSA-vpr5-779c-cx62
• fix: ossrs/srs@1d878c2
• web: https://github.com/ossrs/srs/blob/1d11d02e4b82fc3f37e4b048cff483b1581482c1/trunk/research/api-server/server.go#L761
• Imported by: https://pkg.go.dev/github.com/ossrs/srs?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/ossrs/srs
      packages:
        - package: srs
description: |
    SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and 6.0.48, SRS's `api-server` server is vulnerable to a drive-by command injection. An attacker may send a request to the `/api/v1/snapshots` endpoint containing any commands to be executed as part of the body of the POST request. This issue may lead to Remote Code Execution (RCE). Versions 5.0.157, 5.0-b1, and 6.0.48 contain a fix.
cves:
    - CVE-2023-34105
references:
    - advisory: https://github.com/ossrs/srs/security/advisories/GHSA-vpr5-779c-cx62
    - fix: https://github.com/ossrs/srs/commit/1d878c2daaf913ad01c6d0bc2f247116c8050338
    - web: https://github.com/ossrs/srs/blob/1d11d02e4b82fc3f37e4b048cff483b1581482c1/trunk/research/api-server/server.go#L761

[neild]

Vulnerability in package main.

[gopherbot]

Change https://go.dev/cl/503837 mentions this issue: data/excluded: batch add 21 excluded reports