Vulnerability · Published Jun 22, 2022 · Assigned by mitre
CVE-2022-29526
Medium 5.3
In plain English
A medium-severity security flaw in the docker package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)3.0%top 12.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | docker | 20.10.16-r0 | ALPINE-CVE-2022-29526 |
| Alpine:v3.21 | docker | 20.10.16-r0 | ALPINE-CVE-2022-29526 |
| Alpine:v3.22 | docker | 20.10.16-r0 | ALPINE-CVE-2022-29526 |
| Alpine:v3.23 | docker | 20.10.16-r0 | ALPINE-CVE-2022-29526 |
| Alpine:v3.24 | docker | 20.10.16-r0 | ALPINE-CVE-2022-29526 |
| Go | golang.org/x/sys | 0.0.0-20220412211240-33da011f77ad | GHSA-p782-xgp4-8hr8 |
| Go | golang.org/x/sys | 0.0.0-20220412211240-33da011f77ad | GO-2022-0493 |
| Go | stdlib | 1.17.10, 1.18.2 | GO-2022-0493 |
| Rocky Linux:8 | delve | 0:1.7.2-1.module+el8.6.0+824+8e984c20 | RLSA-2022:5337 |
| Rocky Linux:8 | go-toolset | 0:1.17.10-1.module+el8.6.0+986+efe4cea4 | RLSA-2022:5337 |
| Rocky Linux:9 | go-toolset | 0:1.17.12-1.el9_0 | RLSA-2022:5799 |
| Rocky Linux:8 | golang | 0:1.17.10-1.module+el8.6.0+986+efe4cea4 | RLSA-2022:5337 |
| Rocky Linux:9 | golang | 0:1.17.12-1.el9_0 | RLSA-2022:5799 |
| Ubuntu:22.04:LTS | golang-1.13 | 1.13.8-1ubuntu2.22.04.2 | USN-6038-2 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2022-29526 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.1 | USN-6038-1 |
| Ubuntu:22.04:LTS | golang-1.18 | 1.18.1-1ubuntu1.1 | UBUNTU-CVE-2022-29526 |
Affected products (as reported)
References
- https://groups.google.com/g/golang-announce x_refsource_MISC
- https://github.com/golang/go/issues/52313 x_refsource_MISC
- https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU x_refsource_MISC
- FEDORA-2022-fae3ecee19 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-ffe7dba2cb vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-ba365d3703 vendor-advisory, x_refsource_FEDORA
- https://security.netapp.com/advisory/ntap-20220729-0001/ x_refsource_CONFIRM
- GLSA-202208-02 vendor-advisory, x_refsource_GENTOO
- FEDORA-2022-30c5ed5625 vendor-advisory, x_refsource_FEDORA