Overview
- Description
- In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. When only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed. This could permit the application to resolve domain names that were previously restricted.
- Source
- secteam@freebsd.org
- NVD status
- Modified
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Severity
- HIGH
Weaknesses
- nvd@nist.gov
- NVD-CWE-noinfo
- secteam@freebsd.org
- CWE-269
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA49E374-9F1A-4F62-B88D-CD36EDEA6060",
"versionEndExcluding": "13.2",
"versionStartIncluding": "13.0"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A87EFA20-DD6B-41C5-98FD-A29F67D2E732"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2888B0C1-4D85-42EC-9696-03FAD0A9C28F"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3306F11-D3C0-41D6-BB5E-2ABDC3927715"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E584FE1-3A34-492B-B10F-508DA7CBA768"
},
{
"criteria": "cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5605E90-D125-4CC9-8B9F-F5EED9D4EE0C"
}
],
"operator": "OR"
}
]
}
]