Ubuntu.comUB:CVE-2022-29526CVE-2022-29526
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
64.7%
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege
Assignment. When called with a non-zero flags parameter, the Faccessat
function could incorrectly report that a file is accessible.
Bugs
- <https://go.dev/issue/52313>
- <https://github.com/golang/go/issues/52439>
- <https://github.com/golang/go/issues/52440>
Notes
| Author | Note |
|---|---|
| mdeslaur | Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. |
| sbeattie | according to debian, introduced in https://github.com/golang/go/commit/60f78765022a59725121d3b800268adffe78bde3 (go1.15rc1) according to upstream, also affects “golang.org/x/sys/unix” |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | golang-1.10 | < any | UNKNOWN |
| ubuntu | 14.04 | noarch | golang-1.10 | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | golang-1.10 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | golang-1.14 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | golang-1.16 | < 1.16.2-0ubuntu1~18.04.2+esm1 | UNKNOWN |
| ubuntu | 20.04 | noarch | golang-1.16 | < 1.16.2-0ubuntu1~20.04.1 | UNKNOWN |
| ubuntu | 22.04 | noarch | golang-1.17 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | golang-1.18 | < 1.18.1-1ubuntu1~18.04.4 | UNKNOWN |
| ubuntu | 20.04 | noarch | golang-1.18 | < 1.18.1-1ubuntu1~20.04.2 | UNKNOWN |
| ubuntu | 22.04 | noarch | golang-1.18 | < 1.18.1-1ubuntu1.1 | UNKNOWN |
References
github.com/golang/go/commit/f66925e854e71e0c54b581885380a490d7afa30c
go.dev/issue/52313
groups.google.com/g/golang-announce/c/Y5qrqw_lWdU
launchpad.net/bugs/cve/CVE-2022-29526
nvd.nist.gov/vuln/detail/CVE-2022-29526
security-tracker.debian.org/tracker/CVE-2022-29526
ubuntu.com/security/notices/USN-6038-1
ubuntu.com/security/notices/USN-6038-2
www.cve.org/CVERecord?id=CVE-2022-29526
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
64.7%