GO-2022-0558

Privilege escalation in github.com/containers/psgo

At a glance

Published: 2022-08-22 18:07 UTC
Updated: 2024-05-20 16:03 UTC
CVE: CVE-2022-1227
Aliases: GHSA-66vw-v2x9-hw75

Description

The psgo package executes the 'nsenter' binary, potentially allowing privilege escalation when used in environments where nsenter is provided by an untrusted source.

Affected packages

Package	Versions
Go · github.com/containers/psgo	introduced 0, fixed 1.7.2

References

https://github.com/containers/psgo/pull/92 FIX
https://github.com/containers/podman/issues/10941 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database