In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constraints are strictly subsets of the active constraints. When only a list of resolvable domain names was specified without setting any other limitations, an application could submit a new list of domains including include entries not previously listed. This could permit the application to resolve domain names that were previously restricted.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20231214-0003/ |
Configurations
Configuration 1 (hide)
|
History
14 Dec 2023, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Nov 2023, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-23:16.cap_net.asc - Vendor Advisory | |
| First Time |
Freebsd
Freebsd freebsd |
|
| CPE | cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | NVD-CWE-noinfo |
08 Nov 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-08 09:15
Updated : 2023-12-14 10:15
NVD link : CVE-2023-5978
Mitre link : CVE-2023-5978
JSON object : View
Products Affected
freebsd
- freebsd
CWE