MEDIUM

GHSA-chxf-fjcf-7fwp

Possible filesystem space exhaustion by local users

Quick fix

GHSA-chxf-fjcf-7fwp — github.com/google/fscrypt: upgrade to the fixed version with the command below.

go get github.com/google/fscrypt@v0.3.3

Details

`fscrypt` through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to `fscrypt` v0.3.3 or above and adjusting the permissions on existing `fscrypt` metadata directories where applicable.

For more details, see [CVE-2022-25326](https://www.cve.org/CVERecord?id=CVE-2022-25326) and https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/google/fscrypt

Introduced in: 0Fixed in: 0.3.3

Fixgo get github.com/google/fscrypt@v0.3.3

References

https://github.com/google/fscrypt/security/advisories/GHSA-chxf-fjcf-7fwp[WEB]
https://github.com/google/fscrypt[PACKAGE]