GitHub Advisoryadvisory · Go
GHSA-p93v-m2r2-4387 Denial of service via insufficient metadata validation
MEDIUM
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/google/fscrypt
- Severity
- Moderate
- Reviewed
- 2022-03-01
Affected packages
• Go github.com/google/fscrypt: < 0.3.3 → fixed in 0.3.3
Description
The PAM module for `fscrypt` through v0.3.2 doesn't adequately validate `fscrypt` metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a `fscrypt` metadata file that prevents other users from logging into the system. We recommend upgrading to v0.3.3 or above.
For more details, see CVE-2022-25327.