Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege
Assignment. When called with a non-zero flags parameter, the Faccessat
function could incorrectly report that a file is accessible.
Author | Note |
---|---|
mdeslaur | Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. |
sbeattie | according to debian, introduced in https://github.com/golang/go/commit/60f78765022a59725121d3b800268adffe78bde3 (go1.15rc1) according to upstream, also affects “golang.org/x/sys/unix” |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 14.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.14 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.16 | < 1.16.2-0ubuntu1~18.04.2+esm1 | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.16 | < 1.16.2-0ubuntu1~20.04.1 | UNKNOWN |
ubuntu | 22.04 | noarch | golang-1.17 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.18 | < 1.18.1-1ubuntu1~18.04.4 | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.18 | < 1.18.1-1ubuntu1~20.04.2 | UNKNOWN |
ubuntu | 22.04 | noarch | golang-1.18 | < 1.18.1-1ubuntu1.1 | UNKNOWN |
github.com/golang/go/commit/f66925e854e71e0c54b581885380a490d7afa30c
go.dev/issue/52313
groups.google.com/g/golang-announce/c/Y5qrqw_lWdU
launchpad.net/bugs/cve/CVE-2022-29526
nvd.nist.gov/vuln/detail/CVE-2022-29526
security-tracker.debian.org/tracker/CVE-2022-29526
ubuntu.com/security/notices/USN-6038-1
ubuntu.com/security/notices/USN-6038-2
www.cve.org/CVERecord?id=CVE-2022-29526