CVE-2022-29526

Aliases:GHSA-p782-xgp4-8hr8BIT-golang-2022-29526GO-2022-0493DEBIAN-CVE-2022-29526CGA-2c7w-49jg-m2gmCGA-2jq2-r3r4-83mvCGA-2rjf-fv72-fjccCGA-2x4q-mcqh-88ffCGA-37rv-v757-w3xcCGA-4hmf-5pvf-rhrfCGA-4m6r-g268-w6wfCGA-5qvp-fc25-x69qCGA-6m5f-7729-8cr9CGA-7729-xwcm-gp3wCGA-7mj5-cp56-2wxqCGA-869f-xq75-j9fpCGA-87hv-rcqr-8f2gCGA-883x-4r6q-2g4pCGA-8rh6-gcx4-66vxCGA-94jr-6g46-6jvmCGA-956q-c9xr-3p58CGA-9qrc-v47h-3x33CGA-9xc4-jqv8-rxhfCGA-c635-26gw-5gc4CGA-fg3g-4pv3-f95fCGA-fxw3-5wgq-r2h9CGA-hcj4-q87p-vf4gCGA-hgfp-4x7p-c86wCGA-hjg6-3j6m-5jp8CGA-m747-vjg2-vgwwCGA-mcj9-q4pr-qvf8CGA-p5m9-6m54-jwx3CGA-p5qj-x397-rv9cCGA-p673-wp2p-g248CGA-pp93-gx47-gjcxCGA-27gq-m9w2-rf54CGA-27wx-vhqp-hfv2CGA-38w4-2w4c-jxjgCGA-583x-98qp-8fj3CGA-59mv-626p-vmhvCGA-663q-pp48-59hwCGA-679w-fxmp-3qg7CGA-67vr-mqfr-3wrqCGA-83pv-gcpm-x98rCGA-8759-98v3-2pm9CGA-8mp7-67q2-2536CGA-98xr-8mvp-6r2mCGA-993c-6c4c-h3gvCGA-9xw7-m522-grmxCGA-c6q4-fr5h-3x36CGA-crcr-c346-p7xqCGA-g6j2-5mmj-5q79CGA-g8hv-prh4-hvwrCGA-hgx7-c3hv-rfvpCGA-jx95-6ggx-62w8CGA-m867-3cj4-xfrfCGA-mf89-3qr7-wc4wCGA-p4cx-9qwm-c3c8CGA-p8hf-585r-q2hcCGA-q8pf-v2xm-p524CGA-q9f4-g4gp-c65qCGA-qgfx-8v55-cf3jCGA-qv2j-rgf8-6498CGA-r35q-6rjf-cgfxCGA-r3xm-49wv-96hfCGA-r6hm-phf4-32fvCGA-r6r3-fw47-5759CGA-r8r7-8gpm-wr5hCGA-r9fg-456q-7h2hCGA-rf83-h5v7-wrxrCGA-rh89-29vp-j22wCGA-rv79-84q8-4g6cCGA-rv8g-jxwx-xvg2CGA-rwx3-vpr6-phgfCGA-v94h-37jj-38hxCGA-vv89-rm27-g2j2CGA-vw48-783x-4xp5CGA-w5mh-3833-4rp6CGA-w9vj-m53w-j723CGA-wj2h-xjhj-cjm6
Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 22 Jun 2022, 13:15
Last modified:03 Aug 2024, 06:26

Vulnerability Summary

Overall Risk (default)
medium
32/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
2.95% LOW
3% probability +2.77%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

22 Jun 2022, 13:15
Published
Vulnerability first disclosed
03 Aug 2024, 06:26
Last Modified
Vulnerability information updated

Description

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 2.95%• Percentile: 87%

Techniques & Countermeasures

  • CWE-269•Improper Privilege Management

    The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Systems

  • chainguard•ctop

    < 0.7.7-r13

  • chainguard•dex-k8s-authenticator

    < 0

  • chainguard•dynamic-localpv-provisioner

    < 3.4.1-r3

  • chainguard•dynamic-localpv-provisioner-fips

    < 3.5.0-r0

  • chainguard•grpcurl

    < 1.8.7-r7

  • chainguard•k3d

    < 5.6.0-r11

  • chainguard•k3d-proxy

    < 5.6.0-r11

  • chainguard•k3d-tools

    < 5.6.0-r11

  • chainguard•kind

    < 0.22.0-r1

  • chainguard•kubeflow

    < 1.10.0-r2

  • chainguard•kubeflow-access-management

    < 1.10.0-r2

  • chainguard•kubeflow-access-management-compat

    < 1.10.0-r2

  • chainguard•kubeflow-access-management-fips

    < 0

  • chainguard•kubeflow-access-management-fips-compat

    < 0

  • chainguard•kubeflow-admission-webhook

    < 1.10.0-r2

  • chainguard•kubeflow-admission-webhook-compat

    < 1.10.0-r2

  • chainguard•kubeflow-admission-webhook-fips

    < 0

  • chainguard•kubeflow-admission-webhook-fips-compat

    < 0

  • chainguard•kubeflow-fips

    < 0

  • chainguard•kubeflow-notebook-controller

    < 1.10.0-r2

  • chainguard•kubeflow-notebook-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-notebook-controller-fips

    < 0

  • chainguard•kubeflow-notebook-controller-fips-compat

    < 0

  • chainguard•kubeflow-profile-controller

    < 1.10.0-r2

  • chainguard•kubeflow-profile-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-profile-controller-fips

    < 0

  • chainguard•kubeflow-profile-controller-fips-compat

    < 0

  • chainguard•kubeflow-pvcviewer-controller

    < 1.10.0-r2

  • chainguard•kubeflow-pvcviewer-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-pvcviewer-controller-fips

    < 0

  • chainguard•kubeflow-pvcviewer-controller-fips-compat

    < 0

  • chainguard•kubeflow-tensorboard-controller

    < 1.10.0-r2

  • chainguard•kubeflow-tensorboard-controller-compat

    < 1.10.0-r2

  • chainguard•kubeflow-tensorboard-controller-fips

    < 0

  • chainguard•kubeflow-tensorboard-controller-fips-compat

    < 0

  • chainguard•prometheus-postgres-exporter-0.10

    < 0

  • chainguard•terraform-provider-sendgrid

    < 1.0.1-r1

  • chainguard•terraform-provider-sendgrid-fips

    < 1.0.1-r1

  • wolfi•ctop

    < 0.7.7-r13

  • wolfi•dynamic-localpv-provisioner

    < 3.4.1-r3

  • wolfi•grpcurl

    < 1.8.7-r7

  • wolfi•k3d

    < 5.6.0-r11

  • wolfi•k3d-proxy

    < 5.6.0-r11

  • wolfi•k3d-tools

    < 5.6.0-r11

  • wolfi•kind

    < 0.22.0-r1

  • wolfi•kubeflow

    < 1.10.0-r2

  • wolfi•kubeflow-access-management

    < 1.10.0-r2

  • wolfi•kubeflow-access-management-compat

    < 1.10.0-r2

  • wolfi•kubeflow-admission-webhook

    < 1.10.0-r2

  • wolfi•kubeflow-admission-webhook-compat

    < 1.10.0-r2

Showing first 50 affected entries in server-rendered view.

References (21)