Fedora: Security Advisory for golang-github-rfjakob-gocryptfs (FEDORA-2022-3e1ade35db)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: golang-github-rfjakob-gocryptfs-1.8.0-6.fc35

Encrypted overlay filesystem written in Go...

Insecure Nonce Generation

github.com/rfjakob/gocryptfs is vulnerable to insecure nonce generation. The library does not randomly generate the nonce, allowing a malicious user to figure out the block write order...

File ID Poisoning

github.com/rfjakob/gocryptfs is vulnerable to file ID poisoning. A malicious user can change the contents of a file while retaining it's file ID...

Symlink Race Attacks

github.com/rfjakob/gocryptfs is vulnerable to symlink race attacks. It is possible because it adopts chown instead of Lchown in creating and setting the ownership of file system and directory...