Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/landlock-lsm/go-landlock

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedGoPublished

    Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly

    GHSA-vv6c-69r6-chg9

    Affected
    • Go github.com/landlock-lsm/go-landlock >= 0.0.0-20240109, < 0.0.0-20241013234402-fb3ad845df46
    Fixed in
    0.0.0-20241013234402-fb3ad845df46· Vendor fix available
    Issue
    Impact When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply: They use Landlock rulesets that are supposed to restrict networking (through landlock.V4, landlock.V5, or self-configured). These Landlock rulesets are used in best-effort mode. Typically, affected code uses the Go-Landlock API like this (the crucial part being the combination of V4/V5 and .BestEffort()): This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings. The bug only affects networking restrictions. File system restrictions continue to work as expected. Patches Patched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b Users should upgrade to: v0.0.0-20241013234402-fb3ad845df46 Go package dependencies can be updated using go get -u from…

    Recommended action: Upgrade to 0.0.0-20241013234402-fb3ad845df46 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →