GO-2020-0007

Improper input validation in github.com/seccomp/libseccomp-golang

At a glance

Published: 2021-04-14 20:04 UTC
Updated: 2024-05-20 16:03 UTC
CVE: CVE-2017-18367
Aliases: GHSA-58v3-j75h-xr49

Description

Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments (AND is used rather than OR). These filters can be bypassed by only specifying a subset of the arguments due to this behavior.

Affected packages

Package	Versions
Go · github.com/seccomp/libseccomp-golang	introduced 0, fixed 0.9.1-0.20170424173420-06e7a29f36a3

References

https://github.com/seccomp/libseccomp-golang/commit/06e7a29f36a34b8cf419aeb87b979ee508e58f9e FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database