GO-2020-0007

Improper input validation in github.com/seccomp/libseccomp-golang

En bref

Publiée: 2021-04-14 20:04 UTC
Mise à jour: 2024-05-20 16:03 UTC
CVE: CVE-2017-18367
Alias: GHSA-58v3-j75h-xr49

Description

Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments (AND is used rather than OR). These filters can be bypassed by only specifying a subset of the arguments due to this behavior.

Paquets affectés

Paquet	Versions
Go · github.com/seccomp/libseccomp-golang	introduced 0, fixed 0.9.1-0.20170424173420-06e7a29f36a3

Références

https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9e FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database