GHSA-w4f8-fxq2-j35v

Source

https://github.com/advisories/GHSA-w4f8-fxq2-j35v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-w4f8-fxq2-j35v/GHSA-w4f8-fxq2-j35v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w4f8-fxq2-j35v

Published

2022-03-01T21:04:57Z

Modified

2022-03-01T21:04:57Z

Summary

Possible privilege escalation via bash completion script

Details

The bash completion script for fscrypt through v0.3.2 allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to v0.3.3 or above.

For more details, see CVE-2022-25328.

Database specific

{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed_at": "2022-03-01T21:04:57Z",
    "github_reviewed": true,
    "cwe_ids": []
}

References

Affected packages

Go / github.com/google/fscrypt

Package

Name: github.com/google/fscrypt; View open source insights on deps.dev
Purl: pkg:golang/github.com/google/fscrypt

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.3.3