x/vulndb: potential Go vuln in github.com/cloudflare/cfrpki/cmd/octorpki: GHSA-8459-6rc9-8vf8

[GoVulnBot]

In GitHub Security Advisory GHSA-8459-6rc9-8vf8, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/cloudflare/cfrpki/cmd/octorpki		<= 1.4.2

See doc/triage.md for instructions on how to triage this report.

package: github.com/cloudflare/cfrpki/cmd/octorpki
versions:
  - introduced: v0.0.0
description: "### Impact\n\nIn the case that a malicious TAL file is parsed pointing
    to a repository that provides a malicious ROA file which octorpki downloads, it
    is possible to bypass the current directory traversal mitigation to allow writing
    outside of the current directory. \n\n### Patches\n\nNo patch release has been
    made"
published: 2022-02-14T22:52:15Z
last_modified: 2022-02-15T00:14:52Z
ghsas:
  - GHSA-8459-6rc9-8vf8

[neild]

Duplicate of #248.

[tatianab]

Duplicate of #248

[tatianab]

@neild is this actually a duplicate of #248? To me they look like two separate issues...

[gopherbot]

Change https://go.dev/cl/539338 mentions this issue: data/reports: update GO-2022-0248 to include later fix