GitHub Advisoryadvisory · Go

GHSA-p93v-m2r2-4387 Denial of service via insufficient metadata validation

MEDIUM Published 2022-03-01 Modified 2026-06-08 Official page ↗
Ecosystem
Go
Packages
github.com/google/fscrypt
Severity
Moderate
Reviewed
2022-03-01

Affected packages

• Go github.com/google/fscrypt: < 0.3.3 → fixed in 0.3.3

Description

The PAM module for `fscrypt` through v0.3.2 doesn't adequately validate `fscrypt` metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a `fscrypt` metadata file that prevents other users from logging into the system. We recommend upgrading to v0.3.3 or above. For more details, see CVE-2022-25327.

References