In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. Β When only a listΒ of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed. Β This could permit the application to resolve domain names that were previously restricted.
[
{
"defaultStatus": "unknown",
"modules": [
"libcap_net"
],
"product": "FreeBSD",
"vendor": "FreeBSD",
"versions": [
{
"lessThan": "p5",
"status": "affected",
"version": "13.2-RELEASE",
"versionType": "release"
}
]
}
]