-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper privilege management in setuid operations introduced in PR #1523 and fixed in PR #1578. The key functions handling privilege escalation/dropping (Escalate/Drop in priv_linux.go) were modified in the fix to restore proper setresuid behavior. The original implementation's use of syscall.Setresuid without thread-locking considerations left privileged operations active, matching the CWE-269 (Improper Privilege Management) classification. The direct correlation between the vulnerability description, CWE mapping, and the patched functions in the referenced PRs provides high confidence.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/apptainer/apptainer | go | >= 1.2.0, < 1.2.1 | 1.2.1 |
Ongoing coverage of React2Shell