Authorization Bypass Through User-Controlled Key Affecting zfs-lts package, versions <2.2.1-r1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.16% (54th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Authorization Bypass Through User-Controlled Key vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ALPINE319-ZFSLTS-6110196
  • published8 Dec 2023
  • disclosed24 Nov 2023

Introduced: 24 Nov 2023

CVE-2023-49298  (opens in a new tab)
CWE-639  (opens in a new tab)

How to fix?

Upgrade Alpine:3.19 zfs-lts to version 2.2.1-r1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream zfs-lts package and not the zfs-lts package as distributed by Alpine. See How to fix? for Alpine:3.19 relevant fixed versions and status.

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but can be security related in realistic situations. A possible example is cp, from a recent GNU Core Utilities (coreutils) version, when attempting to preserve a rule set for denying unauthorized access. (One might use cp when configuring access control, such as with the /etc/hosts.deny file specified in the IBM Support reference.) NOTE: this issue occurs less often in version 2.2.1, and in versions before 2.1.4, because of the default configuration in those versions.

CVSS Scores

version 3.1