-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from two key elements: 1) The install binary's SUID configuration allowing root execution, and 2) The control flow that executes an external binary ('calico -v') without proper validation. The main install process in install.go was vulnerable because it created directories as root and executed untrusted binaries. The fixes in PR#8517 replaced binary execution with content verification, confirming these functions were problematic. The 'copyBinary' function's role in setting permissions and handling binaries contributed to the insecure configuration.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/projectcalico/calico | go | < 3.26.5 | 3.26.5 |
| github.com/projectcalico/calico | go | >= 3.27.0, < 3.27.3 | 3.27.3 |
Ongoing coverage of React2Shell