x/vulndb: potential Go vuln in github.com/ory/oathkeeper: GHSA-vfvf-6gx5-mqv6

[GoVulnBot]

In GitHub Security Advisory GHSA-vfvf-6gx5-mqv6, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/ory/oathkeeper	0.38.12-beta.1	>= 0.38.0-beta.2, <= 0.38.11-beta.1

Cross references:

• CVE-2021-32701 appears in issue x/vulndb: potential Go vuln in github.com/ory/oathkeeper: CVE-2021-32701, GHSA-vfvf-6gx5-mqv6 #920 NOT_IMPORTABLE
• GHSA-vfvf-6gx5-mqv6 appears in issue x/vulndb: potential Go vuln in github.com/ory/oathkeeper: CVE-2021-32701, GHSA-vfvf-6gx5-mqv6 #920 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - introduced: TODO (earliest fixed "0.38.12-beta.1", vuln range ">= 0.38.0-beta.2,
            <= 0.38.11-beta.1")
    packages:
      - package: github.com/ory/oathkeeper
description: 'ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control
    Decision API that authorizes HTTP requests based on sets of Access Rules. When
    you make a request to an endpoint that requires the scope `foo` using an access
    token granted with that `foo` scope, introspection will be valid and that token
    will be cached. The problem comes when a second requests to an endpoint that requires
    the scope `bar` is made before the cache has expired. Whether the token is granted
    or not to the `bar` scope, introspection will be valid. A patch will be released
    with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection`
    authenticator. When caching is disabled, this vulnerability does not exist. The
    cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152).
    From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97)
    it seems that it only validates the token expiration date, but ignores whether
    the token has or not the proper scopes. The vulnerability was introduced in PR
    #424. During review, we failed to require appropriate test coverage by the submitter
    which is the primary reason that the vulnerability passed the review process.'
cves:
  - CVE-2021-32701
ghsas:
  - GHSA-vfvf-6gx5-mqv6

[tatianab]

Duplicate of #920