x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-7cgv-v83v-rr87

[GoVulnBot]

In GitHub Security Advisory GHSA-7cgv-v83v-rr87, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/vault	1.9.9	>= 1.8.0, < 1.9.9

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: 1.8.0
        fixed: 1.9.9
    packages:
      - package: github.com/hashicorp/vault
  - module: TODO
    versions:
      - introduced: 1.10.0
        fixed: 1.10.6
    packages:
      - package: github.com/hashicorp/vault
  - module: TODO
    versions:
      - introduced: 1.11.0
        fixed: 1.11.3
    packages:
      - package: github.com/hashicorp/vault
description: An issue was discovered in HashiCorp Vault and Vault Enterprise before
    1.11.3. A vulnerability in the Identity Engine was found where, in a deployment
    where an entity has multiple mount accessors with shared alias names, Vault may
    overwrite metadata to the wrong alias due to an issue with checking the proper
    alias assigned to an entity. This may allow for unintended access to key/value
    paths using that metadata in Vault.
cves:
  - CVE-2022-40186
ghsas:
  - GHSA-7cgv-v83v-rr87

[gopherbot]

Change https://go.dev/cl/435460 mentions this issue: data/excluded: add GO-2022-1021.yaml for CVE-2022-40186