{"answers":{"affected":"3 open source packages ship an affected version, including github.com/landlock-lsm/go-landlock.","exploited":"There is no known exploitation of GHSA-vv6c-69r6-chg9 in the wild and no public exploit code.","fix":"Upgrade github.com/landlock-lsm/go-landlock to 0.0.0-20241013234402-fb3ad845df46 or later.","what":"GHSA-vv6c-69r6-chg9 is a vulnerability in github.com/landlock-lsm/go-landlock, published on 14 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-vv6c-69r6-chg9 and fix it if it is affected.\n\nWhat it is: GHSA-vv6c-69r6-chg9 is a vulnerability in github.com/landlock-lsm/go-landlock, published on 14 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-vv6c-69r6-chg9 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/landlock-lsm/go-landlock (Go): affected all versions; fixed in 0.0.0-20241013234402-fb3ad845df46\n- github.com/landlock-lsm/go-landlock (Go): affected from 0.0.0-20240109; fixed in 0.0.0-20241013234402-fb3ad845df46\n- github.com/landlock-lsm/go-landlock (Go): affected from 0.0.0-20240109; fixed in 0.0.0-20241013234402-fb3ad845df46\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/ (Markdown: https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/index.md)","id":"GHSA-vv6c-69r6-chg9","markdown":"https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/index.md","name":"GHSA-vv6c-69r6-chg9","record":{"aliases":["GO-2024-3199"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Go Landlock library","requires_auth":"none","summary":"Go-Landlock library fails to restrict TCP bind and connect operations in best-effort mode, allowing network access bypass.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nWhen using the recommended \"best-effort\" mode, Go-Landlock did not restrict the TCP bind() and connect() operations any more when they were requested.  This affects Go-Landlock users to whom both of the following conditions apply:\n\n* They use Landlock rulesets that are supposed to restrict networking (through `landlock.V4`, `landlock.V5`, or self-configured).\n* These Landlock rulesets are used in best-effort mode.\n\nTypically, affected code uses the Go-Landlock API like this (the crucial part being the combination of `V4`/`V5` and `.BestEffort()`):\n\n```\nerr := landlock.V5.BestEffort().Restrict(...)\n```\n\n* This is a bug in the Go-Landlock library and does not affect programs that use Landlock via C or other language bindings.\n* The bug only affects networking restrictions. File system restrictions continue to work as expected.\n\n### Patches\nPatched in: https://github.com/landlock-lsm/go-landlock/commit/fb3ad845df462d013f9c8a965c496617c6a5778b\nUsers should upgrade to: v0.0.0-20241013234402-fb3ad845df46\n\nGo package dependencies can be updated using `go get -u` from the project directory.\n\nProjects on Github might get notified by Dependabot, once this advisory is public.\n\n### Workarounds\nNone.\n\n### References\nCurrently none.\n\n[The existing users of Go-Landlock on Github](https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landlock?tab=importedby) have the following bugs filed:\n* https://github.com/Foxboron/ssh-the-planet/issues/1\n* https://github.com/ngergs/websrv/issues/15\n* https://github.com/pufferffish/wireproxy/issues/142","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly","id":"GHSA-vv6c-69r6-chg9","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.0.0-20241013234402-fb3ad845df46"],"introduced":["0"],"last_affected":[],"package":"github.com/landlock-lsm/go-landlock","purl":"pkg:golang/github.com/landlock-lsm/go-landlock","source":"GO-2024-3199"},{"ecosystem":"Go","fixed":["0.0.0-20241013234402-fb3ad845df46"],"introduced":["0.0.0-20240109"],"last_affected":[],"package":"github.com/landlock-lsm/go-landlock","purl":null,"source":"GHSA-vv6c-69r6-chg9"},{"ecosystem":"Go","fixed":["0.0.0-20241013234402-fb3ad845df46"],"introduced":["0.0.0-20240109"],"last_affected":[],"package":"github.com/landlock-lsm/go-landlock","purl":"pkg:golang/github.com/landlock-lsm/go-landlock","source":"GHSA-vv6c-69r6-chg9"}],"products":null,"published":"2024-10-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Go-Landlock library fails to restrict TCP bind and connect operations in best-effort mode, allowing network access bypass.","url":"https://insights.sbomify.com/GHSA-vv6c-69r6-chg9/"}