Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Delve may mistakenly report file as accessible

published 4 years ago
Summary

The Delve tool running on older Go versions can give the wrong answer about whether a file can be opened when special options are used. This could let someone think they have permission to read or change a file when they do not. Update the Go runtime to the latest release or apply the relevant security updates to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure delve <= 1.5.0-16
Original advisory text
CVE-2022-29526 affecting package delve 1.5.0-16
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Timeline
Published23 Jun 2022
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-45402 · OSV
Track software like this
Free during beta