Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

update: libcap #1652

Closed
dongsupark opened this issue Feb 18, 2025 · 0 comments · Fixed by flatcar/scripts#2682
Closed

update: libcap #1652

dongsupark opened this issue Feb 18, 2025 · 0 comments · Fixed by flatcar/scripts#2682
Labels
advisory security advisory cvss/MEDIUM >= 4 && < 7 assessed CVSS security security concerns

Comments

@dongsupark
Copy link
Member

Name: libcap
CVEs: CVE-2025-1390
CVSSs: 6.1
Action Needed: TBD

Summary: The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

See also https://bugzilla.redhat.com/show_bug.cgi?id=2346212, https://bugzilla.openanolis.cn/show_bug.cgi?id=18804.

refmap.gentoo: TBD
@dongsupark dongsupark added advisory security advisory cvss/MEDIUM >= 4 && < 7 assessed CVSS security security concerns labels Feb 18, 2025
@dongsupark dongsupark moved this from 📝 Needs Triage to 🪵Backlog in Flatcar tactical, release planning, and roadmap Feb 18, 2025
@github-actions github-actions bot mentioned this issue Feb 22, 2025
Open
@krnowak krnowak mentioned this issue Feb 25, 2025
Merged
2 tasks
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
advisory security advisory cvss/MEDIUM >= 4 && < 7 assessed CVSS security security concerns
Projects
Flatcar tactical, release planning, and roadmap
Status: Implemented
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Weekly portage-stable package updates 2025-02-24 flatcar/scripts
1 participant
@dongsupark