x/vulndb: potential Go vuln in github.com/apptainer/apptainer: CVE-2023-38496

[GoVulnBot]

CVE-2023-38496 references github.com/apptainer/apptainer, which may be a Go module.

Description:
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-38496
• JSON: https://github.com/CVEProject/cvelist/tree/08b7f4567ec80e6f6f00ea970fee88005a610c4d/2023/38xxx/CVE-2023-38496.json
• advisory: GHSA-mmx5-32m4-wxvx
• fix: Set real UID to zero when escalating privileges for CNI plugins to fix issue appeared with RHEL 9.X (release 1.2) apptainer/apptainer#1523
• fix: Restore old syscall setresuid behavior when escalating/dropping privileges. apptainer/apptainer#1578
• Imported by: https://pkg.go.dev/github.com/apptainer/apptainer?tab=importedby

Cross references:

• Module github.com/apptainer/apptainer appears in issue x/vulndb: potential Go vuln in github.com/apptainer/apptainer: GHSA-j4rf-7357-f4cg #1738 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/apptainer/apptainer
      vulnerable_at: 1.2.1
      packages:
        - package: apptainer
description: |-
    Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an
    ineffective privilege drop when requesting container network setup, therefore
    subsequent functions are called with root privileges, the attack surface is
    rather limited for users but an attacker could possibly craft a starter config
    to delete any directory on the host filesystems. A security fix has been
    included in Apptainer 1.2.1. There is no known workaround outside of upgrading
    to Apptainer 1.2.1.
cves:
    - CVE-2023-38496
references:
    - advisory: https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-wxvx
    - fix: https://github.com/apptainer/apptainer/pull/1523
    - fix: https://github.com/apptainer/apptainer/pull/1578

[tatianab]

Duplicate of #1965