GitHub Advisoryadvisory · Go

GHSA-p782-xgp4-8hr8 golang.org/x/sys/unix has Incorrect privilege reporting in syscall

MEDIUM Published 2022-06-24 Modified 2024-05-20 Official page ↗
Aliases
CVE-2022-29526
Ecosystem
Go
Packages
golang.org/x/sys
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-269
Reviewed
2023-02-08

Affected packages

• Go golang.org/x/sys: < 0.0.0-20220412211240-33da011f77ad → fixed in 0.0.0-20220412211240-33da011f77ad

Description

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. Specific Go Packages Affected golang.org/x/sys/unix

Related

Alias · CVE (1)

  • CVE-2022-29526 Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References