x/vulndb: potential Go vuln in github.com/snapcore/snapd: CVE-2024-29069

[GoVulnBot]

Advisory CVE-2024-29069 references a vulnerability in the following Go modules:

Module
github.com/snapcore/snapd

Description:
In snapd versions prior to 2.62, snapd failed to properly check the
destination of symbolic links when extracting a snap. The snap format
is a squashfs file-system image and so can contain symbolic links and
other file types. Various file entries within the snap squashfs image
(such as icons and desktop files etc) are directly read by snapd when
it is extracted. An attacker who could convince a user to install a
malicious snap which contained symbolic links at these paths could then
cause snapd to write out the contents of the symbolic link destination
into a world-readable directory. This i...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-29069
• FIX: many: container validation improvements canonical/snapd#13682

Cross references:

• github.com/snapcore/snapd appears in 5 other report(s):
  • data/excluded/GO-2023-2034.yaml (x/vulndb: potential Go vuln in github.com/snapcore/snapd: CVE-2023-1523 #2034) EFFECTIVELY_PRIVATE
  • data/excluded/GO-2023-2198.yaml (x/vulndb: potential Go vuln in github.com/snapcore/snapd: CVE-2017-14178 #2198) LEGACY_FALSE_POSITIVE
  • data/excluded/GO-2023-2233.yaml (x/vulndb: potential Go vuln in github.com/snapcore/snapd: CVE-2019-11503 #2233) LEGACY_FALSE_POSITIVE
  • data/reports/GO-2024-2468.yaml (x/vulndb: potential Go vuln in github.com/snapcore/snapd: GHSA-cjqf-877p-7m3f #2468)
  • data/reports/GO-2024-2906.yaml (x/vulndb: potential Go vuln in github.com/snapcore/snapd: CVE-2024-5138 #2906)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/snapcore/snapd
      vulnerable_at: 0.0.0-20240725195426-a8d817ac41d4
summary: CVE-2024-29069 in github.com/snapcore/snapd
cves:
    - CVE-2024-29069
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-29069
    - fix: https://github.com/snapcore/snapd/pull/13682
source:
    id: CVE-2024-29069
    created: 2024-07-25T21:01:18.189189191Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports